phobos | b25587ffe305c8f1374213d7cdf586ad8e0f8d9cf1cd49b3ce0c1b34ba8fa5b3

Analysis

max time kernel
152s
max time network
32s
platform
windows7_x64
resource
win7v200430
submitted
07-07-2020 13:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Fast.exe
Size

55KB
MD5

4a3762d49120264f48deb29ca8668082
SHA1

4ed52a74441ed443c09d51b625d07cded9e2ba08
SHA256

b25587ffe305c8f1374213d7cdf586ad8e0f8d9cf1cd49b3ce0c1b34ba8fa5b3
SHA512

dcbe5bb3f9cd2bbdacd0a2fad7728d7a78e07950e6cd8423bcd10f2c698e81b80fa9f8582af0925cae9a4c3c08c786ac38b07068a61a6b97d82a3f408a6b8f39

Score

10^/10

phobos evasion persistence ransomware spyware

Malware Config

Extracted

Path

\??\c:\users\admin\desktop\info.txt

Ransom Note

All your files have been ENCRYPTED!!! Install ICQ software on your PC or mobile phone here https://icq.com/windows/ Write to our ICQ @VIRTUALHORSE https://icq.im/VIRTUALHORSE Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss.

URLs

https://icq.com/windows/

https://icq.im/VIRTUALHORSE

Extracted

Path

C:\users\public\desktop\info.hta

Ransom Note

All your files have been encrypted! All your files have been encrypted due to a security problem with your PC. If you want to restore them, install ICQ software on your PC or mobile phone here https://icq.com/windows/ Write to our ICQ @VIRTUALHORSE https://icq.im/VIRTUALHORSE Write this ID in the title of your message B5E5EFE9-2797 You have to pay for decryption in Bitcoins. The price depends on how fast you write to us. After payment we will send you the tool that will decrypt all your files. Free decryption as guarantee Before paying you can send us up to 5 files for free decryption. The total size of files must be less than 4Mb (non archived), and files should not contain valuable information. (databases,backups, large excel sheets, etc.) How to obtain Bitcoins The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price. https://localbitcoins.com/buy_bitcoins Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins/ Attention! Do not rename encrypted files. Do not try to decrypt your data using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

URLs

https://icq.com/windows/

https://icq.im/VIRTUALHORSE

Signatures

Phobos
Phobos ransomware appeared at the beginning of 2019.
ransomware phobos
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exebcdedit.exebcdedit.exe

pid process

996 bcdedit.exe
1400 bcdedit.exe
1840 bcdedit.exe
1600 bcdedit.exe
Deletes backup catalog 3 TTPs 2 IoCs
Uses wbadmin.exe to inhibit system recovery.
ransomware

Command-Line Interface
T1059

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

wbadmin.exewbadmin.exe

pid process

672 wbadmin.exe
1768 wbadmin.exe
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

pid	process
996	bcdedit.exe
1400	bcdedit.exe
1840	bcdedit.exe
1600	bcdedit.exe

pid	process
672	wbadmin.exe
1768	wbadmin.exe

Drops startup file 3 IoCs

Processes:

Fast.exe

description	ioc	process
File created	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\Fast.exe	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	Fast.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.id[B5E5EFE9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe

Loads dropped DLL 22 IoCs

Processes:

MsiExec.exeMsiExec.exe

pid	process
780	MsiExec.exe
780	MsiExec.exe
1160	MsiExec.exe
780	MsiExec.exe
780	MsiExec.exe
780	MsiExec.exe
780	MsiExec.exe
1160	MsiExec.exe
780	MsiExec.exe
780	MsiExec.exe
780	MsiExec.exe
780	MsiExec.exe
780	MsiExec.exe
780	MsiExec.exe
780	MsiExec.exe
1160	MsiExec.exe
780	MsiExec.exe
1160	MsiExec.exe
780	MsiExec.exe
780	MsiExec.exe
1160	MsiExec.exe
1160	MsiExec.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Fast.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Fast = "C:\\Users\\Admin\\AppData\\Local\\Fast.exe"	Fast.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\Fast = "C:\\Users\\Admin\\AppData\\Local\\Fast.exe"	Fast.exe

Drops desktop.ini file(s) 64 IoCs

Processes:

Fast.exe

description	ioc	process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OT4YD26O\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	Fast.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	Fast.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	Fast.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	Fast.exe
File opened for modification	C:\Program Files\desktop.ini	Fast.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini	Fast.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	Fast.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Fast.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	Fast.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini	Fast.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	Fast.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	Fast.exe
File opened for modification	C:\Users\Public\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	Fast.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	Fast.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\5Q8AAMSB\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\LUBVL9MG\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1IGGBW8Z\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\557LH6Z9\desktop.ini	Fast.exe
File opened for modification	C:\Users\Public\Recorded TV\Sample Media\desktop.ini	Fast.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	Fast.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	Fast.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	Fast.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	Fast.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	Fast.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-910373003-3952921535-3480519689-1000\desktop.ini	Fast.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	Fast.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini	Fast.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	Fast.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	Fast.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	Fast.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	Fast.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\IQD6DIKV\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	Fast.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\ZDAW0I3Y\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XGJ27KX4\desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	Fast.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	Fast.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	Fast.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	Fast.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe

Drops file in Program Files directory 64 IoCs

Processes:

Fast.exe

description	ioc	process
File opened for modification	C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Opulent.xml	Fast.exe
File created	C:\Program Files\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Slate\TAB_OFF.GIF.id[B5E5EFE9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tl.gif.id[B5E5EFE9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\msadc\msadcer.dll	Fast.exe
File created	C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGACCBAR.XML.id[B5E5EFE9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0200279.WMF	Fast.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\CONVERT\TRANSMGR.DLL	Fast.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\wmpconfig.exe	Fast.exe
File created	C:\Program Files\Microsoft Office\Office14\PAGESIZE\PGLBL075.XML.id[B5E5EFE9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\Microsoft.Ink.dll	Fast.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl	Fast.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-ui_zh_CN.jar.id[B5E5EFE9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0251007.WMF	Fast.exe
File opened for modification	C:\Program Files\Windows Sidebar\en-US\Sidebar.exe.mui	Fast.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialoccasion.png	Fast.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\MSACCESS_COL.HXT.id[B5E5EFE9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-oql_zh_CN.jar.id[B5E5EFE9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File created	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\DD01163_.WMF.id[B5E5EFE9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File created	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\SY00882_.WMF.id[B5E5EFE9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File opened for modification	C:\Program Files\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18200_.WMF	Fast.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\codec\libaribsub_plugin.dll.id[B5E5EFE9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File opened for modification	C:\Program Files\Java\jre7\bin\jpeg.dll	Fast.exe
File created	C:\Program Files\Java\jre7\lib\logging.properties.id[B5E5EFE9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File created	C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh88.id[B5E5EFE9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0239079.WMF	Fast.exe
File created	C:\Program Files\Microsoft Office\Office14\Groove\ToolIcons\SessionMember.ico.id[B5E5EFE9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-explorer_ja.jar	Fast.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-modules.xml	Fast.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\PUBWIZ\DGTOC.DPV	Fast.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.sig	Fast.exe
File created	C:\Program Files\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.AR.XML.id[B5E5EFE9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\can03.ths.id[B5E5EFE9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\journal.dll	Fast.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	Fast.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\join.avi	Fast.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_es.jar	Fast.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-7.id[B5E5EFE9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\MEDIA\ARROW.WAV	Fast.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_foggy.png	Fast.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Office.en-us\PSS10R.CHM	Fast.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\title.htm	Fast.exe
File created	C:\Program Files\Microsoft Office\Document Themes 14\Theme Fonts\Office 2.xml.id[B5E5EFE9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\1033\WINWORD.DEV_COL.HXC	Fast.exe
File created	C:\Program Files\VideoLAN\VLC\locale\sr\LC_MESSAGES\vlc.mo.id[B5E5EFE9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Framework.dll	Fast.exe
File created	C:\Program Files\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql90.xsl.id[B5E5EFE9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File created	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\EN00006_.WMF.id[B5E5EFE9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File created	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\J0107130.WMF.id[B5E5EFE9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\PUBSPAPR\PDIR18F.GIF.id[B5E5EFE9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationTypes.dll	Fast.exe
File created	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\AN02122_.WMF.id[B5E5EFE9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File opened for modification	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\ED00010_.WMF	Fast.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\EntityPickerIntl.dll.id[B5E5EFE9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\FORMS\1033\SECRECS.ICO	Fast.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClient.dll	Fast.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\ink\penjpn.dll	Fast.exe
File created	C:\Program Files\Common Files\Microsoft Shared\THEMES14\BLUEPRNT\THMBNAIL.PNG.id[B5E5EFE9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\THEMES14\QUAD\PREVIEW.GIF	Fast.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Indian\Maldives	Fast.exe
File created	C:\Program Files\Microsoft Office\CLIPART\PUB60COR\FD00775_.WMF.id[B5E5EFE9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File created	C:\Program Files\Microsoft Office\Office14\JFONT.DAT.id[B5E5EFE9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\file_obj.gif.id[B5E5EFE9-2797].[ICQ@VIRTUALHORSE].eight	Fast.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Web.Extensions.Design.dll	Fast.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\vlc.mo	Fast.exe

Drops file in Windows directory 28 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSI523F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI62AE.tmp	msiexec.exe
File created	C:\Windows\Installer\3310e.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3330.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI340B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3DFF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5435.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5E46.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\33110.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\3310e.mst	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6175.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4716.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI60A8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI64A2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI34D7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3B0F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI531A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI53B7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6135.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3CE4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3D62.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3E4E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI58F7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5908.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI45AE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4801.tmp	msiexec.exe
File created	C:\Windows\Installer\33110.ipi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exe

pid process

1840 vssadmin.exe
1144 vssadmin.exe

pid	process
1840	vssadmin.exe
1144	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

Processes:

mshta.exemshta.exemshta.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Fast.exe

pid	process
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe
240	Fast.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Fast.exevssvc.exeWMIC.exewbengine.exemsiexec.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	240	Fast.exe
Token: SeBackupPrivilege	1880	vssvc.exe
Token: SeRestorePrivilege	1880	vssvc.exe
Token: SeAuditPrivilege	1880	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2028	WMIC.exe
Token: SeSecurityPrivilege	2028	WMIC.exe
Token: SeTakeOwnershipPrivilege	2028	WMIC.exe
Token: SeLoadDriverPrivilege	2028	WMIC.exe
Token: SeSystemProfilePrivilege	2028	WMIC.exe
Token: SeSystemtimePrivilege	2028	WMIC.exe
Token: SeProfSingleProcessPrivilege	2028	WMIC.exe
Token: SeIncBasePriorityPrivilege	2028	WMIC.exe
Token: SeCreatePagefilePrivilege	2028	WMIC.exe
Token: SeBackupPrivilege	2028	WMIC.exe
Token: SeRestorePrivilege	2028	WMIC.exe
Token: SeShutdownPrivilege	2028	WMIC.exe
Token: SeDebugPrivilege	2028	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2028	WMIC.exe
Token: SeRemoteShutdownPrivilege	2028	WMIC.exe
Token: SeUndockPrivilege	2028	WMIC.exe
Token: SeManageVolumePrivilege	2028	WMIC.exe
Token: 33	2028	WMIC.exe
Token: 34	2028	WMIC.exe
Token: 35	2028	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2028	WMIC.exe
Token: SeSecurityPrivilege	2028	WMIC.exe
Token: SeTakeOwnershipPrivilege	2028	WMIC.exe
Token: SeLoadDriverPrivilege	2028	WMIC.exe
Token: SeSystemProfilePrivilege	2028	WMIC.exe
Token: SeSystemtimePrivilege	2028	WMIC.exe
Token: SeProfSingleProcessPrivilege	2028	WMIC.exe
Token: SeIncBasePriorityPrivilege	2028	WMIC.exe
Token: SeCreatePagefilePrivilege	2028	WMIC.exe
Token: SeBackupPrivilege	2028	WMIC.exe
Token: SeRestorePrivilege	2028	WMIC.exe
Token: SeShutdownPrivilege	2028	WMIC.exe
Token: SeDebugPrivilege	2028	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2028	WMIC.exe
Token: SeRemoteShutdownPrivilege	2028	WMIC.exe
Token: SeUndockPrivilege	2028	WMIC.exe
Token: SeManageVolumePrivilege	2028	WMIC.exe
Token: 33	2028	WMIC.exe
Token: 34	2028	WMIC.exe
Token: 35	2028	WMIC.exe
Token: SeBackupPrivilege	1672	wbengine.exe
Token: SeRestorePrivilege	1672	wbengine.exe
Token: SeSecurityPrivilege	1672	wbengine.exe
Token: SeRestorePrivilege	1264	msiexec.exe
Token: SeTakeOwnershipPrivilege	1264	msiexec.exe
Token: SeSecurityPrivilege	1264	msiexec.exe
Token: SeRestorePrivilege	1264	msiexec.exe
Token: SeTakeOwnershipPrivilege	1264	msiexec.exe
Token: SeRestorePrivilege	1264	msiexec.exe
Token: SeTakeOwnershipPrivilege	1264	msiexec.exe
Token: SeRestorePrivilege	1264	msiexec.exe
Token: SeTakeOwnershipPrivilege	1264	msiexec.exe
Token: SeRestorePrivilege	1264	msiexec.exe
Token: SeTakeOwnershipPrivilege	1264	msiexec.exe
Token: SeRestorePrivilege	1264	msiexec.exe
Token: SeTakeOwnershipPrivilege	1264	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1572	WMIC.exe
Token: SeSecurityPrivilege	1572	WMIC.exe
Token: SeTakeOwnershipPrivilege	1572	WMIC.exe
Token: SeLoadDriverPrivilege	1572	WMIC.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

mshta.exemshta.exemshta.exe

pid process

1268 mshta.exe
1748 mshta.exe
1380 mshta.exe

pid	process
1268	mshta.exe
1748	mshta.exe
1380	mshta.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Fast.execmd.execmd.exemsiexec.execmd.exe

description	pid	process	target process
PID 240 wrote to memory of 1096	240	Fast.exe	cmd.exe
PID 240 wrote to memory of 1096	240	Fast.exe	cmd.exe
PID 240 wrote to memory of 1096	240	Fast.exe	cmd.exe
PID 240 wrote to memory of 1096	240	Fast.exe	cmd.exe
PID 240 wrote to memory of 1060	240	Fast.exe	cmd.exe
PID 240 wrote to memory of 1060	240	Fast.exe	cmd.exe
PID 240 wrote to memory of 1060	240	Fast.exe	cmd.exe
PID 240 wrote to memory of 1060	240	Fast.exe	cmd.exe
PID 1096 wrote to memory of 1828	1096	cmd.exe	netsh.exe
PID 1096 wrote to memory of 1828	1096	cmd.exe	netsh.exe
PID 1096 wrote to memory of 1828	1096	cmd.exe	netsh.exe
PID 1060 wrote to memory of 1840	1060	cmd.exe	vssadmin.exe
PID 1060 wrote to memory of 1840	1060	cmd.exe	vssadmin.exe
PID 1060 wrote to memory of 1840	1060	cmd.exe	vssadmin.exe
PID 1096 wrote to memory of 1752	1096	cmd.exe	netsh.exe
PID 1096 wrote to memory of 1752	1096	cmd.exe	netsh.exe
PID 1096 wrote to memory of 1752	1096	cmd.exe	netsh.exe
PID 1060 wrote to memory of 2028	1060	cmd.exe	WMIC.exe
PID 1060 wrote to memory of 2028	1060	cmd.exe	WMIC.exe
PID 1060 wrote to memory of 2028	1060	cmd.exe	WMIC.exe
PID 1060 wrote to memory of 996	1060	cmd.exe	bcdedit.exe
PID 1060 wrote to memory of 996	1060	cmd.exe	bcdedit.exe
PID 1060 wrote to memory of 996	1060	cmd.exe	bcdedit.exe
PID 1060 wrote to memory of 1400	1060	cmd.exe	bcdedit.exe
PID 1060 wrote to memory of 1400	1060	cmd.exe	bcdedit.exe
PID 1060 wrote to memory of 1400	1060	cmd.exe	bcdedit.exe
PID 1060 wrote to memory of 672	1060	cmd.exe	wbadmin.exe
PID 1060 wrote to memory of 672	1060	cmd.exe	wbadmin.exe
PID 1060 wrote to memory of 672	1060	cmd.exe	wbadmin.exe
PID 1264 wrote to memory of 780	1264	msiexec.exe	MsiExec.exe
PID 1264 wrote to memory of 780	1264	msiexec.exe	MsiExec.exe
PID 1264 wrote to memory of 780	1264	msiexec.exe	MsiExec.exe
PID 1264 wrote to memory of 780	1264	msiexec.exe	MsiExec.exe
PID 1264 wrote to memory of 780	1264	msiexec.exe	MsiExec.exe
PID 1264 wrote to memory of 1160	1264	msiexec.exe	MsiExec.exe
PID 1264 wrote to memory of 1160	1264	msiexec.exe	MsiExec.exe
PID 1264 wrote to memory of 1160	1264	msiexec.exe	MsiExec.exe
PID 1264 wrote to memory of 1160	1264	msiexec.exe	MsiExec.exe
PID 1264 wrote to memory of 1160	1264	msiexec.exe	MsiExec.exe
PID 1264 wrote to memory of 1160	1264	msiexec.exe	MsiExec.exe
PID 1264 wrote to memory of 1160	1264	msiexec.exe	MsiExec.exe
PID 240 wrote to memory of 1380	240	Fast.exe	mshta.exe
PID 240 wrote to memory of 1380	240	Fast.exe	mshta.exe
PID 240 wrote to memory of 1380	240	Fast.exe	mshta.exe
PID 240 wrote to memory of 1380	240	Fast.exe	mshta.exe
PID 240 wrote to memory of 1748	240	Fast.exe	mshta.exe
PID 240 wrote to memory of 1748	240	Fast.exe	mshta.exe
PID 240 wrote to memory of 1748	240	Fast.exe	mshta.exe
PID 240 wrote to memory of 1748	240	Fast.exe	mshta.exe
PID 240 wrote to memory of 1268	240	Fast.exe	mshta.exe
PID 240 wrote to memory of 1268	240	Fast.exe	mshta.exe
PID 240 wrote to memory of 1268	240	Fast.exe	mshta.exe
PID 240 wrote to memory of 1268	240	Fast.exe	mshta.exe
PID 240 wrote to memory of 1548	240	Fast.exe	cmd.exe
PID 240 wrote to memory of 1548	240	Fast.exe	cmd.exe
PID 240 wrote to memory of 1548	240	Fast.exe	cmd.exe
PID 240 wrote to memory of 1548	240	Fast.exe	cmd.exe
PID 1548 wrote to memory of 1144	1548	cmd.exe	vssadmin.exe
PID 1548 wrote to memory of 1144	1548	cmd.exe	vssadmin.exe
PID 1548 wrote to memory of 1144	1548	cmd.exe	vssadmin.exe
PID 1548 wrote to memory of 1572	1548	cmd.exe	WMIC.exe
PID 1548 wrote to memory of 1572	1548	cmd.exe	WMIC.exe
PID 1548 wrote to memory of 1572	1548	cmd.exe	WMIC.exe
PID 1548 wrote to memory of 1840	1548	cmd.exe	bcdedit.exe

C:\Users\Admin\AppData\Local\Temp\Fast.exe
"C:\Users\Admin\AppData\Local\Temp\Fast.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:240

C:\Users\Admin\AppData\Local\Temp\Fast.exe
"C:\Users\Admin\AppData\Local\Temp\Fast.exe"
2⤵
PID:1604

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1096

C:\Windows\system32\netsh.exe
netsh advfirewall set currentprofile state off
3⤵
PID:1828

C:\Windows\system32\netsh.exe
netsh firewall set opmode mode=disable
3⤵
PID:1752

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1060

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:1840

C:\Windows\System32\Wbem\WMIC.exe
wmic shadowcopy delete
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2028

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
3⤵
- Modifies boot configuration data using bcdedit
PID:996

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
3⤵
- Modifies boot configuration data using bcdedit
PID:1400

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
3⤵
- Deletes backup catalog
PID:672

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\info.hta"
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
PID:1380

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\users\public\desktop\info.hta"
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
PID:1748

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\info.hta"
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
PID:1268

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1548

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:1144

C:\Windows\System32\Wbem\WMIC.exe
wmic shadowcopy delete
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1572

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} bootstatuspolicy ignoreallfailures
3⤵
- Modifies boot configuration data using bcdedit
PID:1840

C:\Windows\system32\bcdedit.exe
bcdedit /set {default} recoveryenabled no
3⤵
- Modifies boot configuration data using bcdedit
PID:1600

C:\Windows\system32\wbadmin.exe
wbadmin delete catalog -quiet
3⤵
- Deletes backup catalog
PID:1768

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1880

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1672

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:1376

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:1760

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1264

C:\Windows\system32\MsiExec.exe
C:\Windows\system32\MsiExec.exe -Embedding 813CC05FF424D95CB74DDBD7E1175429
2⤵
- Loads dropped DLL
PID:780

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding B8FCDC9F4E7FC1A081A8D4478E965295
2⤵
- Loads dropped DLL
PID:1160

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Desktop\info.hta

MD5
523aeddb755571f2a3d9ca383e72f28c

SHA1
40df669950d98c1d42ed13169bef0ee253e7d719

SHA256
03a0954ba3d85b699ce375d10b06b99e6e1a96b16b67d2b806046d409b1acdcc

SHA512
9d5332fc08cfe260fd7ef7b769ab49796298311caa00893f57c0de75d92305592a83e3780d62e24461afda6a65d62382ab2ecbb09133eef54dbe6944fc34055d

Download Submit
C:\Windows\Installer\MSI3330.tmp

MD5
775ebbee693d62609044a6c8464b086f

SHA1
97183084ff4218af22dc7d157108a3bc23dd56ee

SHA256
5c8037db562ce6f0bee1f029fed736c82c11babf62e16b841ffbed1d4cf3bd20

SHA512
e296f89516870da17b682dab6953ee102f19fcf51d41224b4bb047ddabe04153464cb2ab0c078a80181a88290a06456a4de137cd468e2b5bacf6c4b59b9bd9a8

Download Submit
C:\Windows\Installer\MSI340B.tmp

MD5
775ebbee693d62609044a6c8464b086f

SHA1
97183084ff4218af22dc7d157108a3bc23dd56ee

SHA256
5c8037db562ce6f0bee1f029fed736c82c11babf62e16b841ffbed1d4cf3bd20

SHA512
e296f89516870da17b682dab6953ee102f19fcf51d41224b4bb047ddabe04153464cb2ab0c078a80181a88290a06456a4de137cd468e2b5bacf6c4b59b9bd9a8

Download Submit
C:\Windows\Installer\MSI34D7.tmp

MD5
9cadbfa797783ff9e7fc60301de9e1ff

SHA1
83bde6d6b75dfc88d3418ec1a2e935872b8864bb

SHA256
c1eda5c42be64cfc08408a276340c9082f424ec1a4e96e78f85e9f80d0634141

SHA512
095963d9e01d46dae7908e3de6f115d7a0eebb114a5ec6e4e9312dbc22ba5baa268f5acece328066c9456172e90a95e097a35b9ed61589ce9684762e38f1385b

Download Submit
C:\Windows\Installer\MSI3B0F.tmp

MD5
13810e6e8bf54ff502728fcb577ad4d3

SHA1
30c5ecdb4a0b8275c6e5dd44a87678cd4cab186c

SHA256
f313e17ffd7247ceefd8f8e8b5d52b37b1500b1602b7fd6cf18fbc2143ea2a70

SHA512
ebf9c0162c9f3e560a083312e11d9b7eae4702532021f2b5bac1295208e09129c775674548d799006aa6a6ad15069933ce897bcaf3ad348ed1f8a05a22c9656b

Download Submit
C:\Windows\Installer\MSI3CE4.tmp

MD5
13810e6e8bf54ff502728fcb577ad4d3

SHA1
30c5ecdb4a0b8275c6e5dd44a87678cd4cab186c

SHA256
f313e17ffd7247ceefd8f8e8b5d52b37b1500b1602b7fd6cf18fbc2143ea2a70

SHA512
ebf9c0162c9f3e560a083312e11d9b7eae4702532021f2b5bac1295208e09129c775674548d799006aa6a6ad15069933ce897bcaf3ad348ed1f8a05a22c9656b

Download Submit
C:\Windows\Installer\MSI3D62.tmp

MD5
775ebbee693d62609044a6c8464b086f

SHA1
97183084ff4218af22dc7d157108a3bc23dd56ee

SHA256
5c8037db562ce6f0bee1f029fed736c82c11babf62e16b841ffbed1d4cf3bd20

SHA512
e296f89516870da17b682dab6953ee102f19fcf51d41224b4bb047ddabe04153464cb2ab0c078a80181a88290a06456a4de137cd468e2b5bacf6c4b59b9bd9a8

Download Submit
C:\Windows\Installer\MSI3DFF.tmp

MD5
020b4ef49f97ae2ea491f4e52c264166

SHA1
0cae4e1574c1fe09498d86cd7de64c78f45620d0

SHA256
3888dea3eb6679ecf0a03daeb977b2d661c8f3512d569364b7d54dfa71405028

SHA512
3c75afd898ff9a0ccb695f74d5961580d828043e24b58d8121cf8faac82c5dce8b14c9548489b763b94cae810040b29395b261f507d3cf21a3e74e6d17df839a

Download Submit
C:\Windows\Installer\MSI3E4E.tmp

MD5
5a1e6b155435693938596d58eaca74bb

SHA1
27fb323ccc215136ef350469072b6ad559d39c3d

SHA256
f2d5eb947b85f763f72de7f800118844a5207c9e3dd456f13186c2aaf0c485ac

SHA512
4fee8576ef5541d4923aacb514b09e1e4dc8d6cbb1dcaada67c65240358147b971c2a1d034faf50c594ae7edb4a3c68dd4ffbbb69893413ffb52e71a86c65388

Download Submit
C:\Windows\Installer\MSI45AE.tmp

MD5
775ebbee693d62609044a6c8464b086f

SHA1
97183084ff4218af22dc7d157108a3bc23dd56ee

SHA256
5c8037db562ce6f0bee1f029fed736c82c11babf62e16b841ffbed1d4cf3bd20

SHA512
e296f89516870da17b682dab6953ee102f19fcf51d41224b4bb047ddabe04153464cb2ab0c078a80181a88290a06456a4de137cd468e2b5bacf6c4b59b9bd9a8

Download Submit
C:\Windows\Installer\MSI4716.tmp

MD5
a67e2f3d60da58c6c599bb9a7645883b

SHA1
b0d097490705b401233d16a7b409948db1424c8b

SHA256
67ed68bb015a500f1205024265106dc5bba30e8638a9c6e7ac2b89d9ba0167e7

SHA512
f02ca74811df68448a89fe6e68fec485d8a06c43eca713333f18ca45808d39d7506f6743c4c73a5cc4c19d6795707ae683eff9017bbce1074da0668f52c2714d

Download Submit
C:\Windows\Installer\MSI4801.tmp

MD5
020b4ef49f97ae2ea491f4e52c264166

SHA1
0cae4e1574c1fe09498d86cd7de64c78f45620d0

SHA256
3888dea3eb6679ecf0a03daeb977b2d661c8f3512d569364b7d54dfa71405028

SHA512
3c75afd898ff9a0ccb695f74d5961580d828043e24b58d8121cf8faac82c5dce8b14c9548489b763b94cae810040b29395b261f507d3cf21a3e74e6d17df839a

Download Submit
C:\Windows\Installer\MSI523F.tmp

MD5
13810e6e8bf54ff502728fcb577ad4d3

SHA1
30c5ecdb4a0b8275c6e5dd44a87678cd4cab186c

SHA256
f313e17ffd7247ceefd8f8e8b5d52b37b1500b1602b7fd6cf18fbc2143ea2a70

SHA512
ebf9c0162c9f3e560a083312e11d9b7eae4702532021f2b5bac1295208e09129c775674548d799006aa6a6ad15069933ce897bcaf3ad348ed1f8a05a22c9656b

Download Submit
C:\Windows\Installer\MSI531A.tmp

MD5
775ebbee693d62609044a6c8464b086f

SHA1
97183084ff4218af22dc7d157108a3bc23dd56ee

SHA256
5c8037db562ce6f0bee1f029fed736c82c11babf62e16b841ffbed1d4cf3bd20

SHA512
e296f89516870da17b682dab6953ee102f19fcf51d41224b4bb047ddabe04153464cb2ab0c078a80181a88290a06456a4de137cd468e2b5bacf6c4b59b9bd9a8

Download Submit
C:\Windows\Installer\MSI53B7.tmp

MD5
775ebbee693d62609044a6c8464b086f

SHA1
97183084ff4218af22dc7d157108a3bc23dd56ee

SHA256
5c8037db562ce6f0bee1f029fed736c82c11babf62e16b841ffbed1d4cf3bd20

SHA512
e296f89516870da17b682dab6953ee102f19fcf51d41224b4bb047ddabe04153464cb2ab0c078a80181a88290a06456a4de137cd468e2b5bacf6c4b59b9bd9a8

Download Submit
C:\Windows\Installer\MSI5435.tmp

MD5
775ebbee693d62609044a6c8464b086f

SHA1
97183084ff4218af22dc7d157108a3bc23dd56ee

SHA256
5c8037db562ce6f0bee1f029fed736c82c11babf62e16b841ffbed1d4cf3bd20

SHA512
e296f89516870da17b682dab6953ee102f19fcf51d41224b4bb047ddabe04153464cb2ab0c078a80181a88290a06456a4de137cd468e2b5bacf6c4b59b9bd9a8

Download Submit
C:\Windows\Installer\MSI5908.tmp

MD5
85221b3bcba8dbe4b4a46581aa49f760

SHA1
746645c92594bfc739f77812d67cfd85f4b92474

SHA256
f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f

SHA512
060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

Download Submit
C:\Windows\Installer\MSI5E46.tmp

MD5
200eb7671d84357cfde07e377a597899

SHA1
cd2e4d503b8ae89d27ef78b6c4e16800f18d4c6d

SHA256
0780200cc5ae52e19fe5b65aa22ae0cf1c643c9ca175d116570a599946f37ad2

SHA512
1c262085ad9662bf174ac6b5a6dcc3d00505e84e22b63c76c5377b1a3d827aff3458f77372b3d60047d1af2f3d9d21baa7482baf8e36c3e85b7b36bf9e1efc33

Download Submit
C:\Windows\Installer\MSI60A8.tmp

MD5
33908aa43ac0aaabc06a58d51b1c2cca

SHA1
0a0d1ce3435abe2eed635481bac69e1999031291

SHA256
4447faacefaba8f040822101e2a4103031660de9139e70ecff9aa3a89455a783

SHA512
d5216a53df9cfbe1a78629c103286eb17042f639149c46b6a1cd76498531ae82afd265462fbe0ba9baaff275fc95c66504804f107c449f3fc5833b1ed9c3da46

Download Submit
C:\Windows\Installer\MSI6135.tmp

MD5
200eb7671d84357cfde07e377a597899

SHA1
cd2e4d503b8ae89d27ef78b6c4e16800f18d4c6d

SHA256
0780200cc5ae52e19fe5b65aa22ae0cf1c643c9ca175d116570a599946f37ad2

SHA512
1c262085ad9662bf174ac6b5a6dcc3d00505e84e22b63c76c5377b1a3d827aff3458f77372b3d60047d1af2f3d9d21baa7482baf8e36c3e85b7b36bf9e1efc33

Download Submit
C:\Windows\Installer\MSI6175.tmp

MD5
13810e6e8bf54ff502728fcb577ad4d3

SHA1
30c5ecdb4a0b8275c6e5dd44a87678cd4cab186c

SHA256
f313e17ffd7247ceefd8f8e8b5d52b37b1500b1602b7fd6cf18fbc2143ea2a70

SHA512
ebf9c0162c9f3e560a083312e11d9b7eae4702532021f2b5bac1295208e09129c775674548d799006aa6a6ad15069933ce897bcaf3ad348ed1f8a05a22c9656b

Download Submit
C:\Windows\Installer\MSI62AE.tmp

MD5
399075975c41f7e85b12bc6668f59cf3

SHA1
04f5140a93f4fd7721cd305d12cdb80d75b36a16

SHA256
b5129d385ac5d296142ba97faf663ffbb6c50761fc414d4528d8b8a26bc31ac3

SHA512
1266087db1d06405ccdb4e3cfc8f086b361da2a276a62dcbd2ecfa4532571cf57fdc568b07493fb5d0d9171c1eac8b9d371cd3e35600ee08b108b2688c0c95bf

Download Submit
C:\Windows\Installer\MSI64A2.tmp

MD5
9471017b246f1b3dbbd8984ecc1f4293

SHA1
d498d3f0fdf3c5d90e244094f3df3e618da36341

SHA256
e75f900e7240da9993c267a11f5a68d4c2cebb205fa690200bcdf8e1d0b6e7d8

SHA512
d950f8e613b8585ba8148cad5731134105bf992d160cdedffdf914e78e7b9f1eac0fa3d1071c87343ee942a92ad8ebd1970850edb5fb278326ef03e9ab4160c7

Download Submit
C:\info.hta

MD5
523aeddb755571f2a3d9ca383e72f28c

SHA1
40df669950d98c1d42ed13169bef0ee253e7d719

SHA256
03a0954ba3d85b699ce375d10b06b99e6e1a96b16b67d2b806046d409b1acdcc

SHA512
9d5332fc08cfe260fd7ef7b769ab49796298311caa00893f57c0de75d92305592a83e3780d62e24461afda6a65d62382ab2ecbb09133eef54dbe6944fc34055d

Download Submit
C:\users\public\desktop\info.hta

MD5
523aeddb755571f2a3d9ca383e72f28c

SHA1
40df669950d98c1d42ed13169bef0ee253e7d719

SHA256
03a0954ba3d85b699ce375d10b06b99e6e1a96b16b67d2b806046d409b1acdcc

SHA512
9d5332fc08cfe260fd7ef7b769ab49796298311caa00893f57c0de75d92305592a83e3780d62e24461afda6a65d62382ab2ecbb09133eef54dbe6944fc34055d

Download Submit
\Windows\Installer\MSI3330.tmp

MD5
775ebbee693d62609044a6c8464b086f

SHA1
97183084ff4218af22dc7d157108a3bc23dd56ee

SHA256
5c8037db562ce6f0bee1f029fed736c82c11babf62e16b841ffbed1d4cf3bd20

SHA512
e296f89516870da17b682dab6953ee102f19fcf51d41224b4bb047ddabe04153464cb2ab0c078a80181a88290a06456a4de137cd468e2b5bacf6c4b59b9bd9a8

Download Submit
\Windows\Installer\MSI340B.tmp

MD5
775ebbee693d62609044a6c8464b086f

SHA1
97183084ff4218af22dc7d157108a3bc23dd56ee

SHA256
5c8037db562ce6f0bee1f029fed736c82c11babf62e16b841ffbed1d4cf3bd20

SHA512
e296f89516870da17b682dab6953ee102f19fcf51d41224b4bb047ddabe04153464cb2ab0c078a80181a88290a06456a4de137cd468e2b5bacf6c4b59b9bd9a8

Download Submit
\Windows\Installer\MSI34D7.tmp

MD5
9cadbfa797783ff9e7fc60301de9e1ff

SHA1
83bde6d6b75dfc88d3418ec1a2e935872b8864bb

SHA256
c1eda5c42be64cfc08408a276340c9082f424ec1a4e96e78f85e9f80d0634141

SHA512
095963d9e01d46dae7908e3de6f115d7a0eebb114a5ec6e4e9312dbc22ba5baa268f5acece328066c9456172e90a95e097a35b9ed61589ce9684762e38f1385b

Download Submit
\Windows\Installer\MSI3B0F.tmp

MD5
13810e6e8bf54ff502728fcb577ad4d3

SHA1
30c5ecdb4a0b8275c6e5dd44a87678cd4cab186c

SHA256
f313e17ffd7247ceefd8f8e8b5d52b37b1500b1602b7fd6cf18fbc2143ea2a70

SHA512
ebf9c0162c9f3e560a083312e11d9b7eae4702532021f2b5bac1295208e09129c775674548d799006aa6a6ad15069933ce897bcaf3ad348ed1f8a05a22c9656b

Download Submit
\Windows\Installer\MSI3CE4.tmp

MD5
13810e6e8bf54ff502728fcb577ad4d3

SHA1
30c5ecdb4a0b8275c6e5dd44a87678cd4cab186c

SHA256
f313e17ffd7247ceefd8f8e8b5d52b37b1500b1602b7fd6cf18fbc2143ea2a70

SHA512
ebf9c0162c9f3e560a083312e11d9b7eae4702532021f2b5bac1295208e09129c775674548d799006aa6a6ad15069933ce897bcaf3ad348ed1f8a05a22c9656b

Download Submit
\Windows\Installer\MSI3D62.tmp

MD5
775ebbee693d62609044a6c8464b086f

SHA1
97183084ff4218af22dc7d157108a3bc23dd56ee

SHA256
5c8037db562ce6f0bee1f029fed736c82c11babf62e16b841ffbed1d4cf3bd20

SHA512
e296f89516870da17b682dab6953ee102f19fcf51d41224b4bb047ddabe04153464cb2ab0c078a80181a88290a06456a4de137cd468e2b5bacf6c4b59b9bd9a8

Download Submit
\Windows\Installer\MSI3DFF.tmp

MD5
020b4ef49f97ae2ea491f4e52c264166

SHA1
0cae4e1574c1fe09498d86cd7de64c78f45620d0

SHA256
3888dea3eb6679ecf0a03daeb977b2d661c8f3512d569364b7d54dfa71405028

SHA512
3c75afd898ff9a0ccb695f74d5961580d828043e24b58d8121cf8faac82c5dce8b14c9548489b763b94cae810040b29395b261f507d3cf21a3e74e6d17df839a

Download Submit
\Windows\Installer\MSI3E4E.tmp

MD5
5a1e6b155435693938596d58eaca74bb

SHA1
27fb323ccc215136ef350469072b6ad559d39c3d

SHA256
f2d5eb947b85f763f72de7f800118844a5207c9e3dd456f13186c2aaf0c485ac

SHA512
4fee8576ef5541d4923aacb514b09e1e4dc8d6cbb1dcaada67c65240358147b971c2a1d034faf50c594ae7edb4a3c68dd4ffbbb69893413ffb52e71a86c65388

Download Submit
\Windows\Installer\MSI45AE.tmp

MD5
775ebbee693d62609044a6c8464b086f

SHA1
97183084ff4218af22dc7d157108a3bc23dd56ee

SHA256
5c8037db562ce6f0bee1f029fed736c82c11babf62e16b841ffbed1d4cf3bd20

SHA512
e296f89516870da17b682dab6953ee102f19fcf51d41224b4bb047ddabe04153464cb2ab0c078a80181a88290a06456a4de137cd468e2b5bacf6c4b59b9bd9a8

Download Submit
\Windows\Installer\MSI4716.tmp

MD5
a67e2f3d60da58c6c599bb9a7645883b

SHA1
b0d097490705b401233d16a7b409948db1424c8b

SHA256
67ed68bb015a500f1205024265106dc5bba30e8638a9c6e7ac2b89d9ba0167e7

SHA512
f02ca74811df68448a89fe6e68fec485d8a06c43eca713333f18ca45808d39d7506f6743c4c73a5cc4c19d6795707ae683eff9017bbce1074da0668f52c2714d

Download Submit
\Windows\Installer\MSI4801.tmp

MD5
020b4ef49f97ae2ea491f4e52c264166

SHA1
0cae4e1574c1fe09498d86cd7de64c78f45620d0

SHA256
3888dea3eb6679ecf0a03daeb977b2d661c8f3512d569364b7d54dfa71405028

SHA512
3c75afd898ff9a0ccb695f74d5961580d828043e24b58d8121cf8faac82c5dce8b14c9548489b763b94cae810040b29395b261f507d3cf21a3e74e6d17df839a

Download Submit
\Windows\Installer\MSI523F.tmp

MD5
13810e6e8bf54ff502728fcb577ad4d3

SHA1
30c5ecdb4a0b8275c6e5dd44a87678cd4cab186c

SHA256
f313e17ffd7247ceefd8f8e8b5d52b37b1500b1602b7fd6cf18fbc2143ea2a70

SHA512
ebf9c0162c9f3e560a083312e11d9b7eae4702532021f2b5bac1295208e09129c775674548d799006aa6a6ad15069933ce897bcaf3ad348ed1f8a05a22c9656b

Download Submit
\Windows\Installer\MSI531A.tmp

MD5
775ebbee693d62609044a6c8464b086f

SHA1
97183084ff4218af22dc7d157108a3bc23dd56ee

SHA256
5c8037db562ce6f0bee1f029fed736c82c11babf62e16b841ffbed1d4cf3bd20

SHA512
e296f89516870da17b682dab6953ee102f19fcf51d41224b4bb047ddabe04153464cb2ab0c078a80181a88290a06456a4de137cd468e2b5bacf6c4b59b9bd9a8

Download Submit
\Windows\Installer\MSI53B7.tmp

MD5
775ebbee693d62609044a6c8464b086f

SHA1
97183084ff4218af22dc7d157108a3bc23dd56ee

SHA256
5c8037db562ce6f0bee1f029fed736c82c11babf62e16b841ffbed1d4cf3bd20

SHA512
e296f89516870da17b682dab6953ee102f19fcf51d41224b4bb047ddabe04153464cb2ab0c078a80181a88290a06456a4de137cd468e2b5bacf6c4b59b9bd9a8

Download Submit
\Windows\Installer\MSI5435.tmp

MD5
775ebbee693d62609044a6c8464b086f

SHA1
97183084ff4218af22dc7d157108a3bc23dd56ee

SHA256
5c8037db562ce6f0bee1f029fed736c82c11babf62e16b841ffbed1d4cf3bd20

SHA512
e296f89516870da17b682dab6953ee102f19fcf51d41224b4bb047ddabe04153464cb2ab0c078a80181a88290a06456a4de137cd468e2b5bacf6c4b59b9bd9a8

Download Submit
\Windows\Installer\MSI5908.tmp

MD5
85221b3bcba8dbe4b4a46581aa49f760

SHA1
746645c92594bfc739f77812d67cfd85f4b92474

SHA256
f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f

SHA512
060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

Download Submit
\Windows\Installer\MSI5E46.tmp

MD5
200eb7671d84357cfde07e377a597899

SHA1
cd2e4d503b8ae89d27ef78b6c4e16800f18d4c6d

SHA256
0780200cc5ae52e19fe5b65aa22ae0cf1c643c9ca175d116570a599946f37ad2

SHA512
1c262085ad9662bf174ac6b5a6dcc3d00505e84e22b63c76c5377b1a3d827aff3458f77372b3d60047d1af2f3d9d21baa7482baf8e36c3e85b7b36bf9e1efc33

Download Submit
\Windows\Installer\MSI60A8.tmp

MD5
33908aa43ac0aaabc06a58d51b1c2cca

SHA1
0a0d1ce3435abe2eed635481bac69e1999031291

SHA256
4447faacefaba8f040822101e2a4103031660de9139e70ecff9aa3a89455a783

SHA512
d5216a53df9cfbe1a78629c103286eb17042f639149c46b6a1cd76498531ae82afd265462fbe0ba9baaff275fc95c66504804f107c449f3fc5833b1ed9c3da46

Download Submit
\Windows\Installer\MSI6135.tmp

MD5
200eb7671d84357cfde07e377a597899

SHA1
cd2e4d503b8ae89d27ef78b6c4e16800f18d4c6d

SHA256
0780200cc5ae52e19fe5b65aa22ae0cf1c643c9ca175d116570a599946f37ad2

SHA512
1c262085ad9662bf174ac6b5a6dcc3d00505e84e22b63c76c5377b1a3d827aff3458f77372b3d60047d1af2f3d9d21baa7482baf8e36c3e85b7b36bf9e1efc33

Download Submit
\Windows\Installer\MSI6175.tmp

MD5
13810e6e8bf54ff502728fcb577ad4d3

SHA1
30c5ecdb4a0b8275c6e5dd44a87678cd4cab186c

SHA256
f313e17ffd7247ceefd8f8e8b5d52b37b1500b1602b7fd6cf18fbc2143ea2a70

SHA512
ebf9c0162c9f3e560a083312e11d9b7eae4702532021f2b5bac1295208e09129c775674548d799006aa6a6ad15069933ce897bcaf3ad348ed1f8a05a22c9656b

Download Submit
\Windows\Installer\MSI62AE.tmp

MD5
399075975c41f7e85b12bc6668f59cf3

SHA1
04f5140a93f4fd7721cd305d12cdb80d75b36a16

SHA256
b5129d385ac5d296142ba97faf663ffbb6c50761fc414d4528d8b8a26bc31ac3

SHA512
1266087db1d06405ccdb4e3cfc8f086b361da2a276a62dcbd2ecfa4532571cf57fdc568b07493fb5d0d9171c1eac8b9d371cd3e35600ee08b108b2688c0c95bf

Download Submit
\Windows\Installer\MSI64A2.tmp

MD5
9471017b246f1b3dbbd8984ecc1f4293

SHA1
d498d3f0fdf3c5d90e244094f3df3e618da36341

SHA256
e75f900e7240da9993c267a11f5a68d4c2cebb205fa690200bcdf8e1d0b6e7d8

SHA512
d950f8e613b8585ba8148cad5731134105bf992d160cdedffdf914e78e7b9f1eac0fa3d1071c87343ee942a92ad8ebd1970850edb5fb278326ef03e9ab4160c7

Download Submit
memory/672-8-0x0000000000000000-mapping.dmp

Download
memory/780-9-0x0000000000000000-mapping.dmp

Download
memory/996-6-0x0000000000000000-mapping.dmp

Download
memory/1060-1-0x0000000000000000-mapping.dmp

Download
memory/1096-0-0x0000000000000000-mapping.dmp

Download
memory/1144-23-0x0000000000000000-mapping.dmp

Download
memory/1160-14-0x0000000000000000-mapping.dmp

Download
memory/1264-54-0x0000000000520000-0x0000000000524000-memory.dmp

Filesize
16KB

Download
memory/1264-59-0x0000000000520000-0x0000000000524000-memory.dmp

Filesize
16KB

Download
memory/1264-53-0x0000000001330000-0x0000000001334000-memory.dmp

Filesize
16KB

Download
memory/1264-88-0x0000000001330000-0x0000000001334000-memory.dmp

Filesize
16KB

Download
memory/1264-55-0x0000000000520000-0x0000000000524000-memory.dmp

Filesize
16KB

Download
memory/1264-86-0x0000000008800000-0x0000000008804000-memory.dmp

Filesize
16KB

Download
memory/1268-17-0x0000000000000000-mapping.dmp

Download
memory/1380-15-0x0000000000000000-mapping.dmp

Download
memory/1400-7-0x0000000000000000-mapping.dmp

Download
memory/1548-18-0x0000000000000000-mapping.dmp

Download
memory/1572-24-0x0000000000000000-mapping.dmp

Download
memory/1600-26-0x0000000000000000-mapping.dmp

Download
memory/1748-16-0x0000000000000000-mapping.dmp

Download
memory/1752-4-0x0000000000000000-mapping.dmp

Download
memory/1768-27-0x0000000000000000-mapping.dmp

Download
memory/1828-2-0x0000000000000000-mapping.dmp

Download
memory/1840-3-0x0000000000000000-mapping.dmp

Download
memory/1840-25-0x0000000000000000-mapping.dmp

Download
memory/2028-5-0x0000000000000000-mapping.dmp

Download