magniber | 598e6aa444a25c2442e321af24044fbfbf22a68843586cf058c29d5ac2b48461

Analysis

max time kernel
135s
max time network
129s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
29-02-2024 05:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

adcd96c04e6729479b71004ec131f43e.dll
Size

38KB
MD5

adcd96c04e6729479b71004ec131f43e
SHA1

08699a15fec12a40a1aab8cf8073c0fc4629ecfb
SHA256

598e6aa444a25c2442e321af24044fbfbf22a68843586cf058c29d5ac2b48461
SHA512

2400e0246eb653d254724e539b53bedc1e0817c61d23a58d9ca72c22ce4e71c480d92462dae06af8a8626d9e49a73f458a74c3aac10a735263ea11ba3c754985
SSDEEP

768:40PNWfnUqS31SdW3ZM0twjSamZjDrUim1hC3WpkqJNAhMO5zFtcAK72Rcv:4wemSdW3ZM0tc6jDw145mNAh95RtcAKa

Score

10^/10

magniber ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Pictures\readme.txt

Family

magniber

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://8c28f610e0ccc2407cdgkqvhhrv.hy5tprdl77synlgxroueyzpat4iszkkx52r4i3ufbg6l7b32zqkyc5ad.onion/dgkqvhhrv Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://8c28f610e0ccc2407cdgkqvhhrv.metthe.top/dgkqvhhrv http://8c28f610e0ccc2407cdgkqvhhrv.sameleg.site/dgkqvhhrv http://8c28f610e0ccc2407cdgkqvhhrv.keystwo.uno/dgkqvhhrv http://8c28f610e0ccc2407cdgkqvhhrv.iflook.club/dgkqvhhrv Note! These are temporary addresses! They will be available for a limited amount of time!

URLs

http://8c28f610e0ccc2407cdgkqvhhrv.hy5tprdl77synlgxroueyzpat4iszkkx52r4i3ufbg6l7b32zqkyc5ad.onion/dgkqvhhrv

http://8c28f610e0ccc2407cdgkqvhhrv.metthe.top/dgkqvhhrv

http://8c28f610e0ccc2407cdgkqvhhrv.sameleg.site/dgkqvhhrv

http://8c28f610e0ccc2407cdgkqvhhrv.keystwo.uno/dgkqvhhrv

http://8c28f610e0ccc2407cdgkqvhhrv.iflook.club/dgkqvhhrv

Signatures

Detect magniber ransomware 2 IoCs

resource	yara_rule
behavioral1/memory/2912-58-0x0000000001F20000-0x00000000025FA000-memory.dmp	family_magniber
behavioral1/memory/1040-254-0x00000000001B0000-0x00000000001B4000-memory.dmp	family_magniber

Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
ransomware magniber

Process spawned unexpected child process 10 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2820	1876	cmd.exe	47
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2524	1876	cmd.exe	47
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2532	1876	cmd.exe	47
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2808	1876	cmd.exe	47
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2504	1876	cmd.exe	47
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	752	1876	vssadmin.exe	47
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1984	1876	vssadmin.exe	47
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2224	1876	vssadmin.exe	47
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2228	1876	vssadmin.exe	47
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1924	1876	vssadmin.exe	47

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Renames multiple (76) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2912 set thread context of 1040	2912	rundll32.exe	11
PID 2912 set thread context of 1084	2912	rundll32.exe	10
PID 2912 set thread context of 1092	2912	rundll32.exe	9
PID 2912 set thread context of 1428	2912	rundll32.exe	5

Interacts with shadow copies 2 TTPs 5 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
2228	vssadmin.exe
1924	vssadmin.exe
752	vssadmin.exe
1984	vssadmin.exe
2224	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415347381"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000008cb78feeb87869d89339aa863b4f4f6f44411892a24b8787034e96d4d15f07c1000000000e80000000020000200000007c6177daef5c827fd1fede60e5eb17ad1c9cb643fdd00ceb383ead5a880ccb932000000066868ed167f7abec2a434f0280c86ba25470981be644d49b310a33f8d955335240000000e6169e8308d421dbfc4d6cd4a795a525b7a508c6b937bae447f91248b2e63e03108971401e9dbf20f0bc399c102cc7f601c07f6ff0dc66ae7db5befaaf2af193	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0d2188ad26ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc233000000000200000000001066000000010000200000009987110082d8f4760e2e0c809e130176f1fe18444a650ec168ef8a691f42ad3f000000000e80000000020000200000004b8b38d4f793cc7c4afb44449b1f0cb3ff450576c653c932a1c88cb9a63cabb79000000061c205ff93528323e2ea49dc124df0bc7bf4a70ac22cb1a272a00588dc9d5dd2052bde54337819c2e25fd8f8a5c6eb72ad87cec5735f6c6e09ab82c1b4ad8e44b0fe7b28d610d7e71ac3c4396736e41d4a2ab37a74c34314d9fa0f6efdd1d06de02296bafbd7229f7c9efe7cf301bf1d19a191dbb33f80c066665eddbb30644a0ee9de5bcc53165f5a44a09a5440656b400000009be99e507f871dfde0d2838a2e5daa35fd24d3a724c9b6cb23a6b514f1aa9b11c8a43c5466002b6a55503ffebf20c3f75445e525f6bc70106273ef5b071a46c4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B53D5121-D6C5-11EE-8F92-565622222C98} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\mscfile\shell\open\command	Dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\mscfile\shell	Dwm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	taskhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\mscfile	Dwm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	DllHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\mscfile\shell\open	Dwm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\mscfile\shell\open\command	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\mscfile\shell\open\command	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\mscfile\shell\open\command	DllHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\mscfile\shell\open\command	rundll32.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1392	notepad.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2912	rundll32.exe
2912	rundll32.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
2912	rundll32.exe
2912	rundll32.exe
2912	rundll32.exe
2912	rundll32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1084	Explorer.EXE
Token: SeShutdownPrivilege	1084	Explorer.EXE
Token: SeShutdownPrivilege	1084	Explorer.EXE
Token: SeIncreaseQuotaPrivilege	612	WMIC.exe
Token: SeSecurityPrivilege	612	WMIC.exe
Token: SeTakeOwnershipPrivilege	612	WMIC.exe
Token: SeLoadDriverPrivilege	612	WMIC.exe
Token: SeSystemProfilePrivilege	612	WMIC.exe
Token: SeSystemtimePrivilege	612	WMIC.exe
Token: SeProfSingleProcessPrivilege	612	WMIC.exe
Token: SeIncBasePriorityPrivilege	612	WMIC.exe
Token: SeCreatePagefilePrivilege	612	WMIC.exe
Token: SeBackupPrivilege	612	WMIC.exe
Token: SeRestorePrivilege	612	WMIC.exe
Token: SeShutdownPrivilege	612	WMIC.exe
Token: SeDebugPrivilege	612	WMIC.exe
Token: SeSystemEnvironmentPrivilege	612	WMIC.exe
Token: SeRemoteShutdownPrivilege	612	WMIC.exe
Token: SeUndockPrivilege	612	WMIC.exe
Token: SeManageVolumePrivilege	612	WMIC.exe
Token: 33	612	WMIC.exe
Token: 34	612	WMIC.exe
Token: 35	612	WMIC.exe
Token: SeShutdownPrivilege	1084	Explorer.EXE
Token: SeShutdownPrivilege	1084	Explorer.EXE
Token: SeIncreaseQuotaPrivilege	1008	WMIC.exe
Token: SeSecurityPrivilege	1008	WMIC.exe
Token: SeTakeOwnershipPrivilege	1008	WMIC.exe
Token: SeLoadDriverPrivilege	1008	WMIC.exe
Token: SeSystemProfilePrivilege	1008	WMIC.exe
Token: SeSystemtimePrivilege	1008	WMIC.exe
Token: SeProfSingleProcessPrivilege	1008	WMIC.exe
Token: SeIncBasePriorityPrivilege	1008	WMIC.exe
Token: SeCreatePagefilePrivilege	1008	WMIC.exe
Token: SeBackupPrivilege	1008	WMIC.exe
Token: SeRestorePrivilege	1008	WMIC.exe
Token: SeShutdownPrivilege	1008	WMIC.exe
Token: SeDebugPrivilege	1008	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1008	WMIC.exe
Token: SeRemoteShutdownPrivilege	1008	WMIC.exe
Token: SeUndockPrivilege	1008	WMIC.exe
Token: SeManageVolumePrivilege	1008	WMIC.exe
Token: 33	1008	WMIC.exe
Token: 34	1008	WMIC.exe
Token: 35	1008	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1860	WMIC.exe
Token: SeSecurityPrivilege	1860	WMIC.exe
Token: SeTakeOwnershipPrivilege	1860	WMIC.exe
Token: SeLoadDriverPrivilege	1860	WMIC.exe
Token: SeSystemProfilePrivilege	1860	WMIC.exe
Token: SeSystemtimePrivilege	1860	WMIC.exe
Token: SeProfSingleProcessPrivilege	1860	WMIC.exe
Token: SeIncBasePriorityPrivilege	1860	WMIC.exe
Token: SeCreatePagefilePrivilege	1860	WMIC.exe
Token: SeBackupPrivilege	1860	WMIC.exe
Token: SeRestorePrivilege	1860	WMIC.exe
Token: SeShutdownPrivilege	1860	WMIC.exe
Token: SeDebugPrivilege	1860	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1860	WMIC.exe
Token: SeRemoteShutdownPrivilege	1860	WMIC.exe
Token: SeUndockPrivilege	1860	WMIC.exe
Token: SeManageVolumePrivilege	1860	WMIC.exe
Token: 33	1860	WMIC.exe
Token: 34	1860	WMIC.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
820	iexplore.exe
1084	Explorer.EXE
1084	Explorer.EXE
1084	Explorer.EXE
1084	Explorer.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
820	iexplore.exe
820	iexplore.exe
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE
2604	IEXPLORE.EXE

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1084	Explorer.EXE
1084	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1040 wrote to memory of 1392	1040	Dwm.exe	28
PID 1040 wrote to memory of 1392	1040	Dwm.exe	28
PID 1040 wrote to memory of 1392	1040	Dwm.exe	28
PID 1040 wrote to memory of 564	1040	Dwm.exe	31
PID 1040 wrote to memory of 564	1040	Dwm.exe	31
PID 1040 wrote to memory of 564	1040	Dwm.exe	31
PID 1040 wrote to memory of 1708	1040	Dwm.exe	29
PID 1040 wrote to memory of 1708	1040	Dwm.exe	29
PID 1040 wrote to memory of 1708	1040	Dwm.exe	29
PID 1708 wrote to memory of 612	1708	cmd.exe	33
PID 1708 wrote to memory of 612	1708	cmd.exe	33
PID 1708 wrote to memory of 612	1708	cmd.exe	33
PID 1084 wrote to memory of 3004	1084	Explorer.EXE	34
PID 1084 wrote to memory of 3004	1084	Explorer.EXE	34
PID 1084 wrote to memory of 3004	1084	Explorer.EXE	34
PID 1092 wrote to memory of 452	1092	taskhost.exe	36
PID 1092 wrote to memory of 452	1092	taskhost.exe	36
PID 1092 wrote to memory of 452	1092	taskhost.exe	36
PID 1428 wrote to memory of 864	1428	DllHost.exe	38
PID 1428 wrote to memory of 864	1428	DllHost.exe	38
PID 1428 wrote to memory of 864	1428	DllHost.exe	38
PID 3004 wrote to memory of 1860	3004	cmd.exe	41
PID 3004 wrote to memory of 1860	3004	cmd.exe	41
PID 3004 wrote to memory of 1860	3004	cmd.exe	41
PID 452 wrote to memory of 1008	452	cmd.exe	42
PID 452 wrote to memory of 1008	452	cmd.exe	42
PID 452 wrote to memory of 1008	452	cmd.exe	42
PID 2912 wrote to memory of 1524	2912	rundll32.exe	40
PID 2912 wrote to memory of 1524	2912	rundll32.exe	40
PID 2912 wrote to memory of 1524	2912	rundll32.exe	40
PID 564 wrote to memory of 820	564	cmd.exe	44
PID 564 wrote to memory of 820	564	cmd.exe	44
PID 564 wrote to memory of 820	564	cmd.exe	44
PID 864 wrote to memory of 2840	864	cmd.exe	45
PID 864 wrote to memory of 2840	864	cmd.exe	45
PID 864 wrote to memory of 2840	864	cmd.exe	45
PID 1524 wrote to memory of 2084	1524	cmd.exe	46
PID 1524 wrote to memory of 2084	1524	cmd.exe	46
PID 1524 wrote to memory of 2084	1524	cmd.exe	46
PID 820 wrote to memory of 2604	820	iexplore.exe	48
PID 820 wrote to memory of 2604	820	iexplore.exe	48
PID 820 wrote to memory of 2604	820	iexplore.exe	48
PID 820 wrote to memory of 2604	820	iexplore.exe	48
PID 2524 wrote to memory of 2448	2524	cmd.exe	59
PID 2524 wrote to memory of 2448	2524	cmd.exe	59
PID 2524 wrote to memory of 2448	2524	cmd.exe	59
PID 2808 wrote to memory of 2476	2808	cmd.exe	60
PID 2808 wrote to memory of 2476	2808	cmd.exe	60
PID 2808 wrote to memory of 2476	2808	cmd.exe	60
PID 2504 wrote to memory of 2292	2504	cmd.exe	61
PID 2504 wrote to memory of 2292	2504	cmd.exe	61
PID 2504 wrote to memory of 2292	2504	cmd.exe	61
PID 2532 wrote to memory of 2892	2532	cmd.exe	62
PID 2532 wrote to memory of 2892	2532	cmd.exe	62
PID 2532 wrote to memory of 2892	2532	cmd.exe	62
PID 2820 wrote to memory of 2888	2820	cmd.exe	63
PID 2820 wrote to memory of 2888	2820	cmd.exe	63
PID 2820 wrote to memory of 2888	2820	cmd.exe	63
PID 2888 wrote to memory of 108	2888	CompMgmtLauncher.exe	65
PID 2888 wrote to memory of 108	2888	CompMgmtLauncher.exe	65
PID 2888 wrote to memory of 108	2888	CompMgmtLauncher.exe	65
PID 2292 wrote to memory of 2400	2292	CompMgmtLauncher.exe	64
PID 2292 wrote to memory of 2400	2292	CompMgmtLauncher.exe	64
PID 2292 wrote to memory of 2400	2292	CompMgmtLauncher.exe	64

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\adcd96c04e6729479b71004ec131f43e.dll,#1
1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    PID:2084

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:864
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    PID:2840

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:452
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1008

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1860

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Windows\system32\notepad.exe
  notepad.exe C:\Users\Public\readme.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1392
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1708
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:612
- C:\Windows\system32\cmd.exe
  cmd /c "start http://8c28f610e0ccc2407cdgkqvhhrv.metthe.top/dgkqvhhrv^&2^&35135563^&76^&351^&12"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:564
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://8c28f610e0ccc2407cdgkqvhhrv.metthe.top/dgkqvhhrv&2&35135563&76&351&12
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:820
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:820 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2604

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:108

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  PID:2448
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2752

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  PID:2892
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:1360

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  PID:2476
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:804

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2292
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2400

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:752

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1984

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2224

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2228

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1924

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
03da9da05d8ad1bebc13b0c1632da8b8

SHA1
1f08d4f9fdf0520de6dc16dec51dbaa6d9910a2a

SHA256
21df1225c6b57c919a3342247c1adcd61794c07ffc22c77dbaba6248e680b8da

SHA512
b0f7cf389f17942f291cab435bab23c1eb31ab3156f7c4a102c036795c9450911ec3cf13ebbac92301e5edf74c120a160d77089f83b2f6cf5b5e09141735d780

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1b1e44f4848178ea79a343276e692c54

SHA1
863328ad303111da93153929ad56e3c592b4c222

SHA256
68e17effb3403682b4d9555ce4054f023dd7ee9c20fb0602ecca8a59ad497945

SHA512
38c769a97b7019e8c0c85553149cef63fc970429c1730f85741fa4041917769ff6fc70f54d61924f8c41619d6056c24a0c0caff8149f231fc9d0ec0fdbacfcaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
02574a7659d9fce9b8e8dd7c5b6185dc

SHA1
6bca27de52d1219afb398fb17d9056b652587196

SHA256
906386deed476af05a5a5a6672a83a5025aedaf3b7970ef513e9cb23522745e4

SHA512
c27ee927b7e6004d172f6bec43aaac0d167fafc1b52c4fccd8eb16b728c691969baf12376b9f3f8fccb0fb723967d094100e97d460d10c222ea219f523a22dac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a030929a455cbcf13f9fdcd12fdd0b9f

SHA1
f75a7165226d184e5db008a08c67050753e6ad6f

SHA256
08b36f202473e3304484b26802b303b7e0860e233813f16e608af5fcadc8274e

SHA512
04c004951575c10f393dcc9ab9172286c08ae32b72d5c8cac92b55c4276730ac59e5a1a55967e3ad9226f1ad6583c330f2f6797f60807ec2ee84933ca7bddbb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6eb9f30bebcdc2c504b1a803fd399e8f

SHA1
1b8ad620704dc3aec53c4a6a97e1468205a95d79

SHA256
3541e5b4823a76dc545c615cb002d6112dc57d7fc1ed6be7b66213111c36aaaa

SHA512
1fa16eac99b3b499db78c3782c04f99d0b38f2acc9f9c20c5e33236765bc1510a541dcf307a269ef41b9d3a94e77935604ecd222f892971db28db7a1eb519bc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4c0cf950dc668eb3c2ae39c8546a888

SHA1
f8f42a77fec46527cc9cd8df80225fdd90f9977d

SHA256
77b5f7df0fe5e7ebffdc81cb4d4207882c73ba6c4bb69affea287d8076b90900

SHA512
a788e7f67bd0abe1fe83e0ad09f20d38f9f169e11841140bdfdd846afc3937b178b9b85c1da6648b63c1a154856dd02e1d26a5f18ecc9886d2ff323901cc088c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c833a3f403aff97f119d589819fc1f71

SHA1
fa36b5112dacf8d82ecc9b862dfb1d01a54d1fb6

SHA256
9005d2e4d990a42db0c5df29b72d45f971d13ac83337c55081cd692aa1f5f13f

SHA512
60df1d093f48f55daad3fc3ff16dff5e09f5e229e7db47b8f8796840111de9b7d3651590f89b1c913d8c40538710aa34bc5bfd37d9b9ce4d93b9a425efe9d862

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e48f163dae392e8dd8baa7897a1147c5

SHA1
77d1a74b6a1e31b0de6ee2befb1cf3bbab995894

SHA256
78ef1338ca3dbd41bf58c4252cefd4cd549616629c237a184b357652874f3b1a

SHA512
e227e5c2136acc852f9c62692b941456f905b36b8b3bad682b7292091636e95143a95a87e517c72046fec24e726e0f8537deb558edfea7516cbb899e9ffcbc18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
25747137f7a23257355e7813b33d717b

SHA1
c0ca8c44d82fb610abff9acaed02bc888005030e

SHA256
a1b5242b26750ce62d26d7fcf8947d58d8242140173b4a8dabed2e3a2549513a

SHA512
ac72c0c43d35c4295bb47086a63c0f9c7a04401f0bf2f3dcb7ff1ba4b0c94a0068c5cfcf16b3c0d685c43c6dd23c926029cd64582f1b5f4616291282950ea8ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ee80b2242725eb8a4e4326d3a63ba33

SHA1
e4c8e88765cad26ff51cb9428e8bcae8ea40eaac

SHA256
5914e90d69e72a143787216cfa0a51b0694dd1c0b9bc7e2da9021da9e2eb27c5

SHA512
36b19fd0a31e542ed2641a7e55b030a0b9fced4c9cfc07cb7a80c8406e9fcf54b66f660588e3b9112403cc8db1c20b5c7cc8ea86ff16d6016f1faabc45081d11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1455e51d86c2e9d0d60c486f355ff98

SHA1
1659cb65345ee770c78eca79ea3a0b0f0c3995af

SHA256
b0de103ec596c29ff7dd19856cdd0e8f15abbc836a288cece9730ca35302b6fe

SHA512
3550b534678a8ee2fd6b24102b9fe3ffad2a92f25c58ae187edd973e16ddebef00d1317cc864182e9f90b6fb59a88bd643b58edd6340a009efe217fc7ae4bde3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f42e39e60504d2acb5c9db67fd51eaab

SHA1
0cd31464e70fd8393ceb575939b4046fe1c26aa6

SHA256
ea9476ef31c94481383ab1e663f3f640999a33055fbdae5b0ab418df38be0694

SHA512
d3a803dafbd14e0de07769138ac1b546cd76bdd7d8c7db2d5b7fa2f80d5b132b448c49f668d804bbd5508a167526c1ef1385157b4796fc0a193faaff94cccf37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70d4fd8d2732f44397928c3cecfc9885

SHA1
8b7097bc2c692f9ab62e9fb3a89a31336de6ffce

SHA256
0c68b58ac5c0ff6f0f4003236e6339c809467d174b13db9fe42c0ab78361c30d

SHA512
2cc9d1ffddb9256301f35477a597c0ac35fac67007ac63527c49027eacc1642676a01853e09c43bfd542350a7bc3d3412b53419af9c0f29bd3b504103699cda1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a7e8d0b9e349b9d305895f4e2f5b57b7

SHA1
e4f7b0ecd748d43c5ff44643b2f4f6f690a663ce

SHA256
a6546ff38bc83254cd9bab28dab937f740ac893ddb89c87758cf8431ec72906b

SHA512
fac7873ed21529d5bb502c71ba956c205887d1f1de4ac46cd1dd7d96f20f93fa61865404d77225b35f902b73d54b4d296bffeca855563e234e0031deeded2a5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
745f6c3eba27b04db4a28c66330079e4

SHA1
de32be8e200320ed3e4ba5cc5899e93aba2b8f71

SHA256
1df560edbf5ca90bab1d0387045383be1d54823db52b8b48c3674acbc46daca8

SHA512
48443e83dd05fdd4e9d0b2552c0b11e4ca0a58867fbc4b2b8ae56ff4d7adca9fa189e122662dd63443d28da4a57a5e23a5b4d4a6991904c31f31aa7c8086382f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
452b9bb3c8d559a2a84dd6ef2bebf6f4

SHA1
0b567bfc8d85770bf497a82c274021ca94441db8

SHA256
4a72b0a5a10026cddb90df6a0b5de5d83d58be483f0fbc9ffe7b307426e6ce47

SHA512
2568cb0dd378233daad363583c4c9830c9a2f9aa631ac0f35641633097236e3f2cbc72a16bc4e83ee33d67da01db494d69fa5036e68dc98beef2a827e0eb6b9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8e2a6ed50ad8df510a28d91b0ed9daf6

SHA1
4790dc3c345c8ae82016c8d92718abe8deb908f0

SHA256
9bbcf20d656231850151480ab95469d495ec04d8c4136a45095ddf835cf47a93

SHA512
ba486853b22a8908ab5f72b97eb450ff020e97df6f3df9ed03ae868644f455393b0a94ff12157e10d871ba739da58f83ec9b6a555b431d05c7c4b5f2865a8406

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
14b094f615b01893be007e9ebd535a2c

SHA1
5066c82f1ecf9a0f17d5858681708ca4eab08ecc

SHA256
9af64e05d78c5a5ae3c45429778955b372b123a94c9f7a10db9b7bbe319832cc

SHA512
c852b2fa5d2130365ac5afc4bc941204ea0c1a1edf8790dd2d638b2ec3fe74df36015c8590f786a1fbc47fa123c82053f27ba59099916e157ba33e2563eac0f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d96aa90e155869fddbf8070ae24b6c9a

SHA1
a88f631f942b02d4e649d77626f6a0968bd37852

SHA256
347fc7cd181d40e1e920f6276671b90a97f6e73fc75d3c90df28204f8cd42372

SHA512
c5e2d03959d9fc159483503551c8bc8e630b991995d32c67390d5660ce231db12e9743f6544b3badf9b1ced743fe5074f7aa2640ca26da08ad3035b2291f3f3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\V01.log

Filesize
512KB

MD5
2fc61caa619e906fac87be36892d0216

SHA1
ee33bd6b0835bf6268bf90086273abc736f2f819

SHA256
7231116ef140daf96f8353bfc3061b2b9788bd463108eed2c96bd617b2722120

SHA512
f4599068290cd3e5556bbb952b227dc84f4238961394bb6670b4e25a1737d64f8886f5f0d924a1cd1a51033dabcb19ba0e2db6ad05f11c47e2620acb83b159f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3009.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3123.tmp

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3138.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit
C:\Users\Admin\Pictures\readme.txt

Filesize
1KB

MD5
f4d9ab1cab6344210476245ba690357a

SHA1
035c3b3f96f1feb6121f01fadf03593aa046aab4

SHA256
1d058b1f6c4275a1866af6808a73abbbb4e96f91b2ad409271a523daecf56064

SHA512
0f3c56ab132e785c418defb04d756f875a1e9aa1041515b49371e3775274679839118c007339ec891d2d52098f16870a3df05e38fb1c1d33aba2de7f1ad6c295

Download Submit
memory/1040-0-0x00000000001B0000-0x00000000001B4000-memory.dmp

Filesize
16KB

Download
memory/1040-254-0x00000000001B0000-0x00000000001B4000-memory.dmp

Filesize
16KB

Download
memory/1428-294-0x0000000001F50000-0x0000000001F58000-memory.dmp

Filesize
32KB

Download
memory/1428-277-0x0000000001DF0000-0x0000000001E00000-memory.dmp

Filesize
64KB

Download
memory/1428-283-0x0000000001E50000-0x0000000001E60000-memory.dmp

Filesize
64KB

Download
memory/2912-251-0x0000000002620000-0x0000000002621000-memory.dmp

Filesize
4KB

Download
memory/2912-252-0x0000000002630000-0x0000000002631000-memory.dmp

Filesize
4KB

Download
memory/2912-253-0x0000000002640000-0x0000000002641000-memory.dmp

Filesize
4KB

Download
memory/2912-250-0x0000000002610000-0x0000000002611000-memory.dmp

Filesize
4KB

Download
memory/2912-248-0x0000000001E70000-0x0000000001E71000-memory.dmp

Filesize
4KB

Download
memory/2912-249-0x0000000001E80000-0x0000000001E81000-memory.dmp

Filesize
4KB

Download
memory/2912-245-0x0000000001E60000-0x0000000001E61000-memory.dmp

Filesize
4KB

Download
memory/2912-201-0x0000000001E50000-0x0000000001E51000-memory.dmp

Filesize
4KB

Download
memory/2912-178-0x0000000001E40000-0x0000000001E41000-memory.dmp

Filesize
4KB

Download
memory/2912-256-0x00000000029A0000-0x00000000029A1000-memory.dmp

Filesize
4KB

Download
memory/2912-170-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2912-141-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/2912-58-0x0000000001F20000-0x00000000025FA000-memory.dmp

Filesize
6.9MB

Download