magniber | 3589d019564eedff37d7fd5efbc465144ca6a991fd23fadd9191ff169fa38ef0

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11-03-2024 02:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bfa86847c33dfb1ece4323369a271f7a.dll
Size

38KB
MD5

bfa86847c33dfb1ece4323369a271f7a
SHA1

87866e440b4e9ef1039df2ce78a278f4ac22ceb1
SHA256

3589d019564eedff37d7fd5efbc465144ca6a991fd23fadd9191ff169fa38ef0
SHA512

2b0018f3be33cb984e8cebcf6ee6443883776284fba8f502cc8ac0571267aad0cc4226f85bc411e649b122ef1793f3aa0bc488abb19b5239c547553f50f68c52
SSDEEP

768:Vbmx6Yq3MT9sxNNEIj4v7JuYtcxRdf9Ijsg1b1pKo/OYGI:VbmDvsNE+4zJuYi3df9yLk6dd

Score

10^/10

magniber ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Pictures\readme.txt

Family

magniber

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://182838d8a2a8b8d022genhtaat.r45ucj44wxpb2pf2kewwscy5pcpzsx6wnqsa53xhpexxazksajplfmid.onion/genhtaat Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://182838d8a2a8b8d022genhtaat.datause.monster/genhtaat http://182838d8a2a8b8d022genhtaat.hidtook.club/genhtaat http://182838d8a2a8b8d022genhtaat.agofair.fit/genhtaat http://182838d8a2a8b8d022genhtaat.abeing.website/genhtaat Note! These are temporary addresses! They will be available for a limited amount of time!

URLs

http://182838d8a2a8b8d022genhtaat.r45ucj44wxpb2pf2kewwscy5pcpzsx6wnqsa53xhpexxazksajplfmid.onion/genhtaat

http://182838d8a2a8b8d022genhtaat.datause.monster/genhtaat

http://182838d8a2a8b8d022genhtaat.hidtook.club/genhtaat

http://182838d8a2a8b8d022genhtaat.agofair.fit/genhtaat

http://182838d8a2a8b8d022genhtaat.abeing.website/genhtaat

Signatures

Detect magniber ransomware 2 IoCs

resource	yara_rule
behavioral1/memory/2736-1-0x0000000001C50000-0x0000000002492000-memory.dmp	family_magniber
behavioral1/memory/1100-16-0x0000000001DE0000-0x0000000001DE5000-memory.dmp	family_magniber

Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
ransomware magniber

Process spawned unexpected child process 12 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1940	3020	vssadmin.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1852	3020	cmd.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2688	3020	vssadmin.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1708	3020	cmd.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2300	3020	vssadmin.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2056	3020	cmd.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2144	3020	vssadmin.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	644	3020	vssadmin.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	680	3020	vssadmin.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2008	3020	cmd.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1852	3020	vssadmin.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2620	3020	vssadmin.exe	36

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Renames multiple (54) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2736 set thread context of 1100	2736	rundll32.exe	19
PID 2736 set thread context of 1164	2736	rundll32.exe	20
PID 2736 set thread context of 1192	2736	rundll32.exe	21
PID 2736 set thread context of 872	2736	rundll32.exe	23

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 8 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
1852	vssadmin.exe
2620	vssadmin.exe
1940	vssadmin.exe
2688	vssadmin.exe
2300	vssadmin.exe
2144	vssadmin.exe
644	vssadmin.exe
680	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0da67c05f73da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416287643"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c230677000000000200000000001066000000010000200000004dadcf9b59e4314a3920c13a460f225a1ac621815587b06f76b61b05692e67b2000000000e80000000020000200000005e605f422978f09869f2ce73295e225fc97ca971b38d239ac01c4620a13daf83900000007d4792ab0bab247807328e24767ccaed457b74ac5057e998c2fce365c5aa5fde4599d941f70fd6bfabc3196c183a576bb6d22b9dbf4da1b5bf6a6bde115b8c44fc02dce7f919ba4e8f45f542e9377b77df5bd91cc052c784bfb496ba84e5b16ecf33cc178c159c0a35b0447706280a3d7342a952a9691bdc4ba7c7df8badf48288c0d1d8f11eee08bde2568f0f46d135400000001256b9f523e04dbdeccd6dc71a27b37038b23ad8bad680736f34b178869db587133637334724ab237865271da03235ca5c98b9c615c4bc60328860b460d3ee3c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EB2152B1-DF52-11EE-AE56-729E5AF85804} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c23067700000000020000000000106600000001000020000000d5c96788c542ad4b78fad4025d15255ec5ab4ef9f6bbdbdd5edd0c7cb214e63e000000000e80000000020000200000006e3fdc38f0376134bdce24270b609323d42bb1bf7f03633cc7f928e6210910492000000070479d64bdd321572204f13d14eb88f86ca3972339db6c4ddda1baa495f87c23400000008e2931762aa0faf0c0f0f3ba76e82af14f2a9949e93f2b43336378ecee2aef62265baec75e632e6d896146d4d2427b2d25c0a1560f6d05471dc1f53880f9b075	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\mscfile\shell\open\command	Dwm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Dwm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\mscfile\shell\open\command	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\mscfile\shell\open	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\mscfile\shell\open\command	taskhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\mscfile\shell\open\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\mscfile	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\mscfile\shell	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Explorer.EXE

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1516	notepad.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2736	rundll32.exe
2736	rundll32.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
2736	rundll32.exe
2736	rundll32.exe
2736	rundll32.exe
2736	rundll32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1192	Explorer.EXE
Token: SeShutdownPrivilege	1192	Explorer.EXE
Token: SeShutdownPrivilege	1192	Explorer.EXE
Token: SeShutdownPrivilege	1192	Explorer.EXE
Token: SeIncreaseQuotaPrivilege	1312	wmic.exe
Token: SeSecurityPrivilege	1312	wmic.exe
Token: SeTakeOwnershipPrivilege	1312	wmic.exe
Token: SeLoadDriverPrivilege	1312	wmic.exe
Token: SeSystemProfilePrivilege	1312	wmic.exe
Token: SeSystemtimePrivilege	1312	wmic.exe
Token: SeProfSingleProcessPrivilege	1312	wmic.exe
Token: SeIncBasePriorityPrivilege	1312	wmic.exe
Token: SeCreatePagefilePrivilege	1312	wmic.exe
Token: SeBackupPrivilege	1312	wmic.exe
Token: SeRestorePrivilege	1312	wmic.exe
Token: SeShutdownPrivilege	1312	wmic.exe
Token: SeDebugPrivilege	1312	wmic.exe
Token: SeSystemEnvironmentPrivilege	1312	wmic.exe
Token: SeRemoteShutdownPrivilege	1312	wmic.exe
Token: SeUndockPrivilege	1312	wmic.exe
Token: SeManageVolumePrivilege	1312	wmic.exe
Token: 33	1312	wmic.exe
Token: 34	1312	wmic.exe
Token: 35	1312	wmic.exe
Token: SeIncreaseQuotaPrivilege	2600	WMIC.exe
Token: SeSecurityPrivilege	2600	WMIC.exe
Token: SeTakeOwnershipPrivilege	2600	WMIC.exe
Token: SeLoadDriverPrivilege	2600	WMIC.exe
Token: SeSystemProfilePrivilege	2600	WMIC.exe
Token: SeSystemtimePrivilege	2600	WMIC.exe
Token: SeProfSingleProcessPrivilege	2600	WMIC.exe
Token: SeIncBasePriorityPrivilege	2600	WMIC.exe
Token: SeCreatePagefilePrivilege	2600	WMIC.exe
Token: SeBackupPrivilege	2600	WMIC.exe
Token: SeRestorePrivilege	2600	WMIC.exe
Token: SeShutdownPrivilege	2600	WMIC.exe
Token: SeDebugPrivilege	2600	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2600	WMIC.exe
Token: SeRemoteShutdownPrivilege	2600	WMIC.exe
Token: SeUndockPrivilege	2600	WMIC.exe
Token: SeManageVolumePrivilege	2600	WMIC.exe
Token: 33	2600	WMIC.exe
Token: 34	2600	WMIC.exe
Token: 35	2600	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1312	wmic.exe
Token: SeSecurityPrivilege	1312	wmic.exe
Token: SeTakeOwnershipPrivilege	1312	wmic.exe
Token: SeLoadDriverPrivilege	1312	wmic.exe
Token: SeSystemProfilePrivilege	1312	wmic.exe
Token: SeSystemtimePrivilege	1312	wmic.exe
Token: SeProfSingleProcessPrivilege	1312	wmic.exe
Token: SeIncBasePriorityPrivilege	1312	wmic.exe
Token: SeCreatePagefilePrivilege	1312	wmic.exe
Token: SeBackupPrivilege	1312	wmic.exe
Token: SeRestorePrivilege	1312	wmic.exe
Token: SeShutdownPrivilege	1312	wmic.exe
Token: SeDebugPrivilege	1312	wmic.exe
Token: SeSystemEnvironmentPrivilege	1312	wmic.exe
Token: SeRemoteShutdownPrivilege	1312	wmic.exe
Token: SeUndockPrivilege	1312	wmic.exe
Token: SeManageVolumePrivilege	1312	wmic.exe
Token: 33	1312	wmic.exe
Token: 34	1312	wmic.exe
Token: 35	1312	wmic.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
816	iexplore.exe
1192	Explorer.EXE
1192	Explorer.EXE
1192	Explorer.EXE
1192	Explorer.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
816	iexplore.exe
816	iexplore.exe
1600	IEXPLORE.EXE
1600	IEXPLORE.EXE
1600	IEXPLORE.EXE
1600	IEXPLORE.EXE

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1192	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 1516	1192	Explorer.EXE	28
PID 1192 wrote to memory of 1516	1192	Explorer.EXE	28
PID 1192 wrote to memory of 1516	1192	Explorer.EXE	28
PID 1192 wrote to memory of 2076	1192	Explorer.EXE	29
PID 1192 wrote to memory of 2076	1192	Explorer.EXE	29
PID 1192 wrote to memory of 2076	1192	Explorer.EXE	29
PID 1192 wrote to memory of 1312	1192	Explorer.EXE	30
PID 1192 wrote to memory of 1312	1192	Explorer.EXE	30
PID 1192 wrote to memory of 1312	1192	Explorer.EXE	30
PID 1192 wrote to memory of 1148	1192	Explorer.EXE	33
PID 1192 wrote to memory of 1148	1192	Explorer.EXE	33
PID 1192 wrote to memory of 1148	1192	Explorer.EXE	33
PID 1148 wrote to memory of 2600	1148	cmd.exe	35
PID 1148 wrote to memory of 2600	1148	cmd.exe	35
PID 1148 wrote to memory of 2600	1148	cmd.exe	35
PID 2076 wrote to memory of 816	2076	cmd.exe	37
PID 2076 wrote to memory of 816	2076	cmd.exe	37
PID 2076 wrote to memory of 816	2076	cmd.exe	37
PID 1852 wrote to memory of 1524	1852	cmd.exe	43
PID 1852 wrote to memory of 1524	1852	cmd.exe	43
PID 1852 wrote to memory of 1524	1852	cmd.exe	43
PID 816 wrote to memory of 1600	816	iexplore.exe	45
PID 816 wrote to memory of 1600	816	iexplore.exe	45
PID 816 wrote to memory of 1600	816	iexplore.exe	45
PID 816 wrote to memory of 1600	816	iexplore.exe	45
PID 1524 wrote to memory of 2656	1524	CompMgmtLauncher.exe	47
PID 1524 wrote to memory of 2656	1524	CompMgmtLauncher.exe	47
PID 1524 wrote to memory of 2656	1524	CompMgmtLauncher.exe	47
PID 1100 wrote to memory of 1480	1100	taskhost.exe	53
PID 1100 wrote to memory of 1480	1100	taskhost.exe	53
PID 1100 wrote to memory of 1480	1100	taskhost.exe	53
PID 1100 wrote to memory of 704	1100	taskhost.exe	54
PID 1100 wrote to memory of 704	1100	taskhost.exe	54
PID 1100 wrote to memory of 704	1100	taskhost.exe	54
PID 704 wrote to memory of 1612	704	cmd.exe	57
PID 704 wrote to memory of 1612	704	cmd.exe	57
PID 704 wrote to memory of 1612	704	cmd.exe	57
PID 1164 wrote to memory of 3040	1164	Dwm.exe	62
PID 1164 wrote to memory of 3040	1164	Dwm.exe	62
PID 1164 wrote to memory of 3040	1164	Dwm.exe	62
PID 1164 wrote to memory of 1072	1164	Dwm.exe	63
PID 1164 wrote to memory of 1072	1164	Dwm.exe	63
PID 1164 wrote to memory of 1072	1164	Dwm.exe	63
PID 1708 wrote to memory of 1148	1708	cmd.exe	66
PID 1708 wrote to memory of 1148	1708	cmd.exe	66
PID 1708 wrote to memory of 1148	1708	cmd.exe	66
PID 1072 wrote to memory of 592	1072	cmd.exe	67
PID 1072 wrote to memory of 592	1072	cmd.exe	67
PID 1072 wrote to memory of 592	1072	cmd.exe	67
PID 2056 wrote to memory of 2792	2056	cmd.exe	72
PID 2056 wrote to memory of 2792	2056	cmd.exe	72
PID 2056 wrote to memory of 2792	2056	cmd.exe	72
PID 1148 wrote to memory of 2724	1148	CompMgmtLauncher.exe	73
PID 1148 wrote to memory of 2724	1148	CompMgmtLauncher.exe	73
PID 1148 wrote to memory of 2724	1148	CompMgmtLauncher.exe	73
PID 2792 wrote to memory of 2208	2792	CompMgmtLauncher.exe	77
PID 2792 wrote to memory of 2208	2792	CompMgmtLauncher.exe	77
PID 2792 wrote to memory of 2208	2792	CompMgmtLauncher.exe	77
PID 2736 wrote to memory of 2804	2736	rundll32.exe	83
PID 2736 wrote to memory of 2804	2736	rundll32.exe	83
PID 2736 wrote to memory of 2804	2736	rundll32.exe	83
PID 2736 wrote to memory of 1688	2736	rundll32.exe	84
PID 2736 wrote to memory of 1688	2736	rundll32.exe	84
PID 2736 wrote to memory of 1688	2736	rundll32.exe	84

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Windows\system32\wbem\wmic.exe
  C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  PID:1480
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:704
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    PID:1612

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Windows\system32\wbem\wmic.exe
  C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  PID:3040
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    PID:592

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\bfa86847c33dfb1ece4323369a271f7a.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Windows\system32\wbem\wmic.exe
    C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2804
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
    3⤵
    PID:1688
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
      4⤵
      PID:1256
- C:\Windows\notepad.exe
  notepad.exe C:\Users\Public\readme.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1516
- C:\Windows\system32\cmd.exe
  cmd /c "start http://182838d8a2a8b8d022genhtaat.datause.monster/genhtaat^&2^&38450438^&54^&289^&12"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://182838d8a2a8b8d022genhtaat.datause.monster/genhtaat&2&38450438&54&289&12
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:816
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:816 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1600
- C:\Windows\system32\wbem\wmic.exe
  C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1312
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1148
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2600

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:872

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1524
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2656

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1940

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2092

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2688

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2300

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1708
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1148
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2724

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2208

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2144

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:644

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:680

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
PID:2008
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  PID:1992
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:1616

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1852

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f17b27ae1afce8fa96136b756a777022

SHA1
4b5090d02665acb179e021eba64b8fdb1535054b

SHA256
393729850501c7aeaaefc32e92e9e1b1f75b9b55fe47652ce3a84021281e6119

SHA512
9b95aa94a481faf501110c5b11e8e314b4977e30bd5b00d7de305aedb35063fe41ab68233bcc12d7fcbc5276d832c58659352fb6aff5dea82f623b1e1d5d8814

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ef4ecbcd976ae38d7b339853bb77770

SHA1
e629a01131b84d9a54910d9504f1e5148a629dca

SHA256
df3395e2a80fbc132121157206b4fc21b5a3c4271e26b85013c8ed73de047a75

SHA512
7a1d42d543787ebd8930df2c4740c4207d9a11e9719259423299617ae643e147d90ae638fea0dd00b14e34a0714a3f48b4f6c862ecd0b5d2e3a5c1a5b8a9ef09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
15c2e7d5ee052f391a52167b30e02600

SHA1
7c1515ebabe3dedcfdd2b8f98d084db7ca2fcbb5

SHA256
ed931ecedd05eeda876db3cb1e7d410839fd7079f4e1645763e1fb37b5726bf6

SHA512
5b45e11a02e8aaa9783a76ad2721522695fddac780656114137c2d9ce18e9dafe86ee18f6a6ef376db41d6038e3b2b8d73577bdc067fc4c6bbf1551c3e7dba00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2f779251f283cf4b02444067985eeac8

SHA1
f331e0d9005566c425f9e8f0782f5684f1bb2dc5

SHA256
4cab7675a11d7cfa02e02abbbd41e2752af378cdfad78f4fa23ca77300a51f45

SHA512
66c247370063a0c7d51f17f40cfc5e6f8b183c23641ca64abb8d69b975ff3b0b58c9eb948727a57ac990d67256dff705a1373fc47b197fb44a8eb12748bff82f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0aad664c1977ee680ac09cbb784ba418

SHA1
f7afde5b4571776f051eca391f546851cf405db5

SHA256
20481493eb4b525c31e63a17c7dc25d31565b5b860fa4dfdecfe2f70197412dc

SHA512
aea3ae2134ef110faffe85007d701cad28c08439b67b2b716bb84e8e541a278aa648ae874e91261804a30aacee46752eb12a5c1e8ea74015be40fda565d308b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d9b3f8bec9ff5c4b502172d32eaf3976

SHA1
92e62a331797220419431bd264a8324bc4976524

SHA256
56dd7da00771f7097a1af97c551d21b2b8943c3843bfa234345620ef34196038

SHA512
e6df676147d2e14815d361eae080c132427bdfbcd61a3438d1ae6994b5c82a676b04fe8106d8bc763e84b5ea8f983fec6ad7618262f6f4133bdbf07e6478708d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f43cf561d4902333eb064288e1e9593f

SHA1
2f6ff908311e0646554950e33f3b12e8b00fd517

SHA256
0a63d88c1f50807832e86c741fe4b751dd7aad48858ced519cccf37a2ad14b15

SHA512
156327b423b72a3d4ad13d777429c098af0c4991da228e257e41e6c3589a9e1fd2424a22d388f609585b7203cc1c11d1bcea5d4255067c2328e6e24c2d17f7a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
41119182387d863fb0103f18f45f43d5

SHA1
3d8f13d64a1ecd50af40b843d44c5db1894374af

SHA256
752b3d4ef9bbfe524348f94faffaad636c891a6f9de9658c59d131b6cb984c96

SHA512
3e09ca2aec7a8a0ed507fad8cd869c59c317ceae6fc68986c3dc4e2ac9ec6e89738f8df8cb281db6fb616851dee2391e2442dc638a03db73d4ef7b46230ef6c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9ee1edc06a498c883606ac5e3cd4faae

SHA1
f36c84100a4ab01539961417e401f133511a1845

SHA256
36e82b983d6bd556ab4ab03596155bc1173e96334b30a32a40c5cc02bd6e9fc5

SHA512
e0c75ca4ec8b2ea9ab8baf24cb246e8356dad1b27b57158e145b437801c29d966ea05b220d392b053197b76709baf28aafaac5bdf4cdb9207df655777cc5c153

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
db5d096c007e68e2c2d70f5d237e2969

SHA1
7460328207f7fa73b32b9bfd0b86c7975cbe0366

SHA256
9ed34c1619eafc42dc2bd75222aae2d0902cf7261bb34edae62aec4ac9a172b3

SHA512
55bf744137a674aa2b7a857ae79c9e1f9d9857c503d92ad2004a3dce70cbdf84cd0dd36c2a8d5281f408c70da713488c37defc4e6533a9114dbaad140de8361c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e23ecb08e2b20b5c40ad749d9afc13cd

SHA1
ee60a65b93d23807ff1d6a765c8ee84fd1601beb

SHA256
b9dba03b7f9e7aa37d4d53a2249d72202498a871197e66617890c461b65540ed

SHA512
5869d8cf80f2b7c2bd331c1f77c1ae3267b24f8462768df564c8357e57dc80b0010c85608dc2cb2a8b1f6ef2bdf7b4a8ec7d8e95dd337b5fe9c0d6dcbfa9c360

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f5a783ac457862a2e1165d2294a7163b

SHA1
d99015c2c58f787216ab0f07c1f7bacd6728d3d4

SHA256
b9eed5cad64cde06c1d18011f981034cedce1b0873adda19bc6738d9e8e15c78

SHA512
316be02abd5fb6496e8190f027c5dda858545183c42b130949131f434ad4741f716b3b22985102d4cbff80ab149f1a0e0ed781c6da612e85a6d6646773e31571

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0898d81c52ab60c35bf02fded5e90071

SHA1
4c3b9dfa4e1b03cbb4291d1257b674c58156b17c

SHA256
b73bad170e310077799e3932c68f2f9167f5986b111a7531a17fe220ec676091

SHA512
d0d336878bf268d8457d7f5b90a37973e1782cebc868bfc1448e340aa2278af719f0e6fd73b57b15fd183eb67c7db968659ec5e0e0cedcba1e46dd70d13dd245

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3fd36371d6414bfb2f75a33596b6b74e

SHA1
50c769e571c61053dac463d07ab61f530ea20056

SHA256
108d781d295eaec220b97953d9965af744a979dc32d71a2c29d89442fc40e418

SHA512
a783126ea8a48cc8703ebfe98b6cb101bbf472ab3d2fac2afa9893ade771a26aecf2cdb546c021a813e57eb6586c05567b5f38d8134c1e1036619ce2a576c37f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c04bb1018c347a384578a8976312d8cb

SHA1
550e85c46fbf914100099b70a21a8e381b1ca24b

SHA256
dc8d65edcc6b3459ecd51d4c4c291c3f76ed01947654fc21a0bf1820d941a066

SHA512
ed7102ab53c96bb4b28f680d47b104ddc6c4fac7918b310ec36232d1e5295624a896f2f0860f4410c28a2af632bcea841463fd881fb1172551d0cb2f3626b294

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2e62929a708a67c74fa561bd3dee6a3b

SHA1
47b085768d7d4913a8e6a85335daf4a10a313d4c

SHA256
4d5b66506a577bb35ec887bba743bc848a02be79e381f5bfbe904b0f2b6c6e8a

SHA512
ee8608f7187b1797d93a75573b088314263b1a4718a07cda04c24a393eaa560c5c036734c26033e607d8fb41c9ec175628f0742e4e446db2bd6d91cc1eb02fec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2eb5389074778e6fa0854395b90cfea6

SHA1
38d61262a310048ba600dbe09c3bdc7da4d080ac

SHA256
748b53f11b4eaede00dcb26181aa7845b98daa7146199380bbbbb7cd4000e445

SHA512
52cd9a6a20fb545b69008357c38fe208aa1117a7e0fa372c9e96334d33df54bbe9c5115a7d18b52c794f557457ffdc95da2ede049931882175e876b8723f3582

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
61ef1c149af4aaa4c879cb25458ad38b

SHA1
f857ec30c4f0718899aa3f773dd3cfe25029eff0

SHA256
87de6d50d8580330bbaf90541087a6d8947c8ad8a95b814bedaccec9bc513388

SHA512
926d17feb538b75ba9c2ae05ef9c7900d2ea137c66c07cbbfa980aa87395b2485567f98c8de2800fb38251e341905118f64df576fdb5dca83499099a46b46405

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
74fc18a0c808c422a52621f8c4cff218

SHA1
7e742c5787d48974a5d4f1aa1b21d97f900ef51d

SHA256
b1d3a3e014420eebdc8e6f49cc412d46c26458e636515ff5fa0f84b3759c25e6

SHA512
a1155eeddf0d85ff06bae409e96da713edbb73c1822a0fc174d5c2e2ebb9df8779bbc93ac8310445a110fdbfd8fd32a2b7cb945e91ba281cd52c44668fa2b6bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
52e2911210e531a8c4b506de289ff431

SHA1
0a51f00fcce53270e16bfd9f16d72f593e59ae57

SHA256
812375daaa954057ef2ad5f0f89b14237871c7be04ba98a1ab287314d63b40dd

SHA512
bdc6eef750ca815659ba608639e7ea8430b1513caf5553e2a2a5cb5a2b65fd2d8295ba242addfcc42e94054d2db192f3499dfa6e73740134af6ad2858a92808c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
91deb18a455f03bbe9ba6bfceee6f2a5

SHA1
f6f1a1de4f80b2e01c62b9746fc237889b52261a

SHA256
270b4a30c7c144a479a2ea5bb8190043e975b1beda121bfce7def0ac99d52e01

SHA512
4d02fcf5bcc4a33a8236489dfe60939f5b7a5a4eece0bd38d0627eea4900d5d9cd21849fa432eca447d758cd67fc2ff430601e218f71623949166317f8658fcc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bb03bb8d4c0e2a3052841d60212f8176

SHA1
fd7dedc9ed6c6a56ff3774375672e07a08751ccc

SHA256
7589287d1b52687d4bfe3fb5c2ab58b4a3367ac9e09bc30f6f8109976c6ce8a4

SHA512
6e809ed3340b6336f01172b8d9a074f23b6940c58223b322611b7d84eecb3e912d6a79bffd6e8bd5a731b7289460fad4187d08fb8d2c4d164aad09e95b43af06

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB8F6.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBA54.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit
C:\Users\Admin\Pictures\readme.txt

Filesize
1KB

MD5
f837d2cef0ba3123660b62fd9f41b432

SHA1
24dc38158ce7a03038bb166429e66f558f254188

SHA256
7c7d7b974ef3e07943ba5312a76a10247fa0b45e0a01ed348b18cd5ea093a2ee

SHA512
125ab5cdfbb3f70ac612c0458a1bf628f728a7a821b1ba1eb5e3863fba2b5b32c96e3c9338675917000b0481c9fa64f91c42df615292e32fce8c97fb78ab4364

Download Submit
memory/1100-16-0x0000000001DE0000-0x0000000001DE5000-memory.dmp

Filesize
20KB

Download
memory/1100-0-0x0000000001DE0000-0x0000000001DE5000-memory.dmp

Filesize
20KB

Download
memory/2736-17-0x00000000043D0000-0x00000000043D1000-memory.dmp

Filesize
4KB

Download
memory/2736-15-0x0000000001B90000-0x0000000001B91000-memory.dmp

Filesize
4KB

Download
memory/2736-707-0x00000000043F0000-0x00000000043F1000-memory.dmp

Filesize
4KB

Download
memory/2736-5-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/2736-1-0x0000000001C50000-0x0000000002492000-memory.dmp

Filesize
8.3MB

Download
memory/2736-704-0x00000000043F0000-0x00000000043F1000-memory.dmp

Filesize
4KB

Download
memory/2736-6-0x0000000001AF0000-0x0000000001AF1000-memory.dmp

Filesize
4KB

Download
memory/2736-13-0x0000000001B70000-0x0000000001B71000-memory.dmp

Filesize
4KB

Download
memory/2736-14-0x0000000001B80000-0x0000000001B81000-memory.dmp

Filesize
4KB

Download
memory/2736-12-0x0000000001B60000-0x0000000001B61000-memory.dmp

Filesize
4KB

Download
memory/2736-11-0x0000000001B20000-0x0000000001B21000-memory.dmp

Filesize
4KB

Download
memory/2736-9-0x0000000001B10000-0x0000000001B11000-memory.dmp

Filesize
4KB

Download
memory/2736-3-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/2736-2-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/2736-8-0x0000000001B00000-0x0000000001B01000-memory.dmp

Filesize
4KB

Download