2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe

General
Target

2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe

Filesize

656KB

Completed

20-10-2021 10:00

Score
10/10
MD5

538d23ef01426d1157fa1137471a5cf7

SHA1

ab553df2bb4f7f8d98cc39ac773aaaa1c7ca110f

SHA256

af8e74d00babaae01b6f3b137cff7b6a6951456c66ffa95122695dad6c7b41a9

Malware Config

Extracted

Path C:\KSPREIW-MANUAL.txt
Family gandcrab
Ransom Note
---= GANDCRAB V5.2 =--- ***********************UNDER NO CIRCUMSTANCES DO NOT DELETE THIS FILE, UNTIL ALL YOUR DATA IS RECOVERED*********************** *****FAILING TO DO SO, WILL RESULT IN YOUR SYSTEM CORRUPTION, IF THERE ARE DECRYPTION ERRORS***** Attention! All your files, documents, photos, databases and other important files are encrypted and have the extension: .KSPREIW The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. The server with your key is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- | 0. Download Tor browser - https://www.torproject.org/ | 1. Install Tor browser | 2. Open Tor Browser | 3. Open link in TOR browser: http://gandcrabmfe6mnef.onion/9dd5ac38f623035 | 4. Follow the instructions on this page ---------------------------------------------------------------------------------------- On our page you will see instructions on payment and get the opportunity to decrypt 1 file for free. ATTENTION! IN ORDER TO PREVENT DATA DAMAGE: * DO NOT MODIFY ENCRYPTED FILES * DO NOT CHANGE DATA BELOW ---BEGIN GANDCRAB KEY--- lAQAANIit1arAsJBGWadVuSJMdHbghSpRBX+r21M/fDl0YqRs3GtaR4Ir4t4w1gC4CPncgafDMeqAF65VfUpPCuZ/boSmieCrLKpDIapDyHFERpOkjlSbYQpOwAxLStwBMBulsDjHmpKuaHEusBqHOMLtLBpkQmCu9w0VAAzKUFP0DWi3les5yYrCWr4/EwsNHY+sOCFsRqZFwWgXXxagusGYTThOTcyRyY6GsrtRk7zGBU/kJo1nBvuzgepFKhuoT4zz1ub82leLSuG/+sUK2IzQtW41SIinyZqbomsRKtAsCZQ9f4YUgE2ehs2ZX4OXRDa5pIeInyI2XYZ8JBpXqnqoz5x9McQUucZ07bixTcuqd4Cme8WHu8kPV3nvhwDjBFoZTojSGI+AJmSuA848F+wVzco7bengZthkVB0l6+mZEDy5lLoY8OP5Pss8ze1rueSWMddS9DdjO1nOaTVqtijw5DFbPQmLwUy5XNYOxoRw6CO/36V+SewLMNbhD26anOslQYVj6ryUYxuMiil/8mr7Mqmw/dXUmTXriM3f93wqG8ush36dhtElyzMEADo4xPf3fr9I9yIkkeglY2QByxvdw01sbvVVIEHCVgX38tddan2yaOCBqZmFp4xMl8lqnIIC6VIG8wsTvkI04hInPQum1XEDI3QqoX6Zo2PFyxemEyooHQsrh/9j8eAddV4oceb2N8KDTt6W4GwTKbU3gpNW3We3lfIUS/tyd0g5QxhPozjrj/UkqVhmcipUGF09BPZc0o6hl8viEoZTwIQD/UmTnqUSilFq0OCT4rKncNBcIs9YDJL1YW0DpvnH2LnkI/Kqq5ZS4L2VCu0PRmx8IQIcKAPVOu07bXFdhr/JMpJPGiXnWclO/ZfQ0uaP/8CZ2WuAjtVhGEO2lGcE4RJDJisFmm2utKDZ7iPN4fSfXEHH7JAhjqF2hMTugnHzbOS623D4BehCns2CoePojx7RCgOxPpG+HcgpeYVarowwfwbGxVSB6ma3sLuEfkmqvCKLtHyHgzikRuGE5B1337MeI3dJAqzJWIj/rqKmo5T3GWn4WQ2erbVh+qy3ZIFJXsBUDiScCQvIEv6wiRPHoCnRXZoDVkk3CYpTxbt8RQZ9ZtsR7sc5nQOKwaf7QyMWDgbwGfU6XiLTjpac6WzMZDI6IsGuInValsBw4CQ4vpGFB/raizVVPu0beH2VB4dQ1oBtUHrbuI5bGACmQrGCQruuMi928UQLpHPE4pwpCvEfxdn8w80dU7oAfQM05j1uAR+u6AYZgZxqm7/tYtUN0hpbP4JZ/0FeMJrvXHy0Ltxb3D69g/gETmfJy2r6S54ENj8AM83m0H23q1hNg2tnVWjbsHXz2raxoDe7vAkCY0njRW8+3OX2rKRxgPiZ7uwYpSi78u6ZVS1NxJcyO4q+nOKuTczWFx+tZce0gjP3uqPNrqVvyj2gYtM5DQIYw0LvuKQ7ulxNTQTK9UuQkfJ1N21GvHY9IsqYww/TK1ZaPWYbFsBcgehOT0QP8qWlP6qQg0CnHga7JpbKSQVX+X2cUJVhFpM8vf5S3Dev6FIlzbPjeuKulMYjCDXqNtL02ObTGaJ0V4qt8jEngi8+yvE2//L5z/9caMxa+P0pb4totR0hrOomyciAr6wS795d4q2Z1mnlIr7Iy1nL7ZjlDPmgyqVhq2wLjlUqNwM5fxr5jcr5jlWa5tXv9HK1opB9Q/Y8isUmEyTixuv20RnclbcJjdjLjX7EuJfIrCdzkMhZ4SAVhSZ/H4Z/sDj0iMDtU3hod0KcJMO2eBXEJPKg+p2Kkvju2X67R1/kUn3B0ZcGJ1eMo7lzBQhh1WuN95+Qz/MsjN87bB7Dwb2gnjAr1U6693idYd8dyRoKvBNT3EiLqXY2C0Dpo2Dk3AvldQiPtdZ3juD16dMEGp1zI6fE/o5gSSx2nnL/o+wPFMxMtbh0mPml+BzFeC5/XByGLbWs89gbw5v1A0+OOS6gZ/MPKmubTRl3za6tR8nAfWkH1L2AocqeBcCVmnvcqKfwFNVYCL9rYi/uBlgxCiBGVcz7I2jJj+Z8+IO31hs5abrJak/11OHT3TL+bp2qnwmnuee8EX+Uev9PoRONGbW1IXNaHXQu8AB7P0ZNmLWLPduGKd7wNaHuOWdfhOdhbFfnIB9ypnx9SmJXeSkT7ngWvcXkOcwiiNJwrM88AEo8kZPE0k2GQDPv+EuhqIxJkIRc+8mSTpYRpd+CsQ98rT+gws= ---END GANDCRAB KEY--- ---BEGIN PC DATA--- 7ftDEgLb/ZS0lcmZbHM61KDJ6AOtD78KkA7absMgUXYxWLsC+5+UYF9xVmDs9M/JL5DWAuiVveDZRWXIKnQXQzua3LPyzokSUuglaqKXwabsGM4pXku5In6gtMQMqg7sgEh1XW1iPMFgiUj/s1LdWpJHdiPjMpn7rCZNO/A31mak0K8RefoREu3BxtlAsseHWfVIIKN0U4NnA3w0Ga7XDLlF3iOIB6ImYbF6Z/7MBN2mgBr2rZ2gU1R7jNxjWLwyoIX95yRHFXKdMI+BkVChenio/1q0nJSZoF9ASQvO7zBnmOH7+ICDGAMpA6ikRWoVdffN00xSVyCWtLmJddBbBiJqrMY9R+C3MrHJmcKR1EfUP43y8fMWLL7jL6Obr2BWwOYITy/J3fayLzJ0v/eISzKziqAuoTvFrp2NPDax/ChAud3oN1oI6iuVzemsqBxvZrwArtoypS8R1aOlCzmc7qd4A+wugXqwckyKb/0f4NwELWWjqbjVwFTi8zPJKLqg0o3dWOf+twlLvHCigIFeEudEtyMvAIvhltRRIBf1D0HFyeWMPZ1Z1lc/pOQ= ---END PC DATA---
URLs

http://gandcrabmfe6mnef.onion/9dd5ac38f623035

Signatures 14

Filter: none

Collection
Credential Access
Defense Evasion
Discovery
Impact
  • Gandcrab

    Description

    Gandcrab is a Trojan horse that encrypts files on a computer.

  • Deletes shadow copies

    Description

    Ransomware often targets backup files to inhibit system recovery.

    Tags

    TTPs

    File DeletionInhibit System Recovery
  • Modifies extensions of user files
    2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe

    Description

    Ransomware generally changes the extension on encrypted files.

    Tags

    Reported IOCs

    descriptioniocprocess
    File opened for modificationC:\Users\Admin\Pictures\EnableConfirm.tiff2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File renamedC:\Users\Admin\Pictures\NewHide.crw => C:\Users\Admin\Pictures\NewHide.crw.kspreiw2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File renamedC:\Users\Admin\Pictures\ProtectLimit.raw => C:\Users\Admin\Pictures\ProtectLimit.raw.kspreiw2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File renamedC:\Users\Admin\Pictures\SaveDeny.png => C:\Users\Admin\Pictures\SaveDeny.png.kspreiw2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File renamedC:\Users\Admin\Pictures\GrantJoin.png => C:\Users\Admin\Pictures\GrantJoin.png.kspreiw2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File renamedC:\Users\Admin\Pictures\UnprotectUpdate.raw => C:\Users\Admin\Pictures\UnprotectUpdate.raw.kspreiw2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File renamedC:\Users\Admin\Pictures\InvokeUndo.crw => C:\Users\Admin\Pictures\InvokeUndo.crw.kspreiw2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File renamedC:\Users\Admin\Pictures\PingFind.tif => C:\Users\Admin\Pictures\PingFind.tif.kspreiw2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File renamedC:\Users\Admin\Pictures\ClearSuspend.raw => C:\Users\Admin\Pictures\ClearSuspend.raw.kspreiw2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File renamedC:\Users\Admin\Pictures\ExpandSave.crw => C:\Users\Admin\Pictures\ExpandSave.crw.kspreiw2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File opened for modificationC:\Users\Admin\Pictures\ExportExpand.tiff2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File renamedC:\Users\Admin\Pictures\ExportExpand.tiff => C:\Users\Admin\Pictures\ExportExpand.tiff.kspreiw2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File renamedC:\Users\Admin\Pictures\EnableConfirm.tiff => C:\Users\Admin\Pictures\EnableConfirm.tiff.kspreiw2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File renamedC:\Users\Admin\Pictures\InitializeLimit.raw => C:\Users\Admin\Pictures\InitializeLimit.raw.kspreiw2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
  • Drops startup file
    2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe

    Reported IOCs

    descriptioniocprocess
    File createdC:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\KSPREIW-MANUAL.txt2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File createdC:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\8f6237d58f62303941c.lock2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    TTPs

    Data from Local SystemCredentials in Files
  • Enumerates connected drives
    2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe

    Description

    Attempts to read the root path of hard drives other than the default C: drive.

    TTPs

    Query RegistryPeripheral Device DiscoverySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    File opened (read-only)\??\B:2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File opened (read-only)\??\Q:2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File opened (read-only)\??\Z:2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File opened (read-only)\??\N:2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File opened (read-only)\??\O:2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File opened (read-only)\??\R:2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File opened (read-only)\??\W:2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File opened (read-only)\??\Y:2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File opened (read-only)\??\E:2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File opened (read-only)\??\J:2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File opened (read-only)\??\L:2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File opened (read-only)\??\S:2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File opened (read-only)\??\V:2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File opened (read-only)\??\X:2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File opened (read-only)\??\A:2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File opened (read-only)\??\F:2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File opened (read-only)\??\M:2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File opened (read-only)\??\K:2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File opened (read-only)\??\P:2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File opened (read-only)\??\T:2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File opened (read-only)\??\U:2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File opened (read-only)\??\G:2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File opened (read-only)\??\H:2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File opened (read-only)\??\I:2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
  • Sets desktop wallpaper using registry
    2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe

    Tags

    TTPs

    DefacementModify Registry

    Reported IOCs

    descriptioniocprocess
    Set value (str)\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\bxmeoengtf.bmp"2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
  • Drops file in Program Files directory
    2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe

    Reported IOCs

    descriptioniocprocess
    File createdC:\Program Files\KSPREIW-MANUAL.txt2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File opened for modificationC:\Program Files\SendMerge.cfg2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File opened for modificationC:\Program Files\UninstallInvoke.htm2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File opened for modificationC:\Program Files\UsePush.txt2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File createdC:\Program Files (x86)\KSPREIW-MANUAL.txt2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File createdC:\Program Files (x86)\8f6237d58f62303941c.lock2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File opened for modificationC:\Program Files\SkipMove.xht2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File opened for modificationC:\Program Files\ClosePublish.jpeg2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File opened for modificationC:\Program Files\DismountUndo.wps2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File opened for modificationC:\Program Files\PingJoin.wmf2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File opened for modificationC:\Program Files\RegisterConfirm.jpeg2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File opened for modificationC:\Program Files\RestoreUnblock.wmv2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File opened for modificationC:\Program Files\ResumeInvoke.eprtx2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File opened for modificationC:\Program Files\SaveUnlock.dib2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File opened for modificationC:\Program Files\CompareUnblock.html2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File opened for modificationC:\Program Files\FormatSave.tiff2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File opened for modificationC:\Program Files\HideSet.mp42019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File opened for modificationC:\Program Files\TraceClear.shtml2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File opened for modificationC:\Program Files\WatchTrace.css2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File createdC:\Program Files\8f6237d58f62303941c.lock2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File opened for modificationC:\Program Files\CheckpointFind.potx2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File opened for modificationC:\Program Files\CompressOut.wmf2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File opened for modificationC:\Program Files\ExitEnter.doc2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File opened for modificationC:\Program Files\JoinUpdate.vdw2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    File opened for modificationC:\Program Files\SearchResize.cr22019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Checks processor information in registry
    2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe

    Description

    Processor information is often read in order to detect sandboxing environments.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key opened\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\02019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
  • Interacts with shadow copies
    vssadmin.exe

    Description

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    Tags

    TTPs

    File DeletionInhibit System Recovery

    Reported IOCs

    pidprocess
    68vssadmin.exe
  • Suspicious behavior: EnumeratesProcesses
    2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe

    Reported IOCs

    pidprocess
    25842019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    25842019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    25842019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    25842019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    25842019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    25842019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
  • Suspicious use of AdjustPrivilegeToken
    vssvc.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeBackupPrivilege2412vssvc.exe
    Token: SeRestorePrivilege2412vssvc.exe
    Token: SeAuditPrivilege2412vssvc.exe
  • Suspicious use of WriteProcessMemory
    2019-05-22-Rig-EK-payload-Gandcrab-ransomware.execmd.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 2584 wrote to memory of 180825842019-05-22-Rig-EK-payload-Gandcrab-ransomware.execmd.exe
    PID 2584 wrote to memory of 180825842019-05-22-Rig-EK-payload-Gandcrab-ransomware.execmd.exe
    PID 2584 wrote to memory of 180825842019-05-22-Rig-EK-payload-Gandcrab-ransomware.execmd.exe
    PID 1808 wrote to memory of 681808cmd.exevssadmin.exe
    PID 1808 wrote to memory of 681808cmd.exevssadmin.exe
    PID 1808 wrote to memory of 681808cmd.exevssadmin.exe
Processes 6
  • C:\Users\Admin\AppData\Local\Temp\2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2019-05-22-Rig-EK-payload-Gandcrab-ransomware.exe"
    Modifies extensions of user files
    Drops startup file
    Enumerates connected drives
    Sets desktop wallpaper using registry
    Drops file in Program Files directory
    Checks processor information in registry
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of WriteProcessMemory
    PID:2584
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c vssadmin delete shadows /all /quiet
      Suspicious use of WriteProcessMemory
      PID:1808
      • C:\Windows\SysWOW64\vssadmin.exe
        vssadmin delete shadows /all /quiet
        Interacts with shadow copies
        PID:68
  • \??\c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k networkservice -s TapiSrv
    PID:2244
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    Suspicious use of AdjustPrivilegeToken
    PID:2412
  • C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\KSPREIW-MANUAL.txt
    PID:1224
Network
MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Execution
      Exfiltration
        Initial Access
          Lateral Movement
            Persistence
              Privilege Escalation
                Replay Monitor
                00:00 00:00
                Downloads
                • C:\Users\Admin\Desktop\KSPREIW-MANUAL.txt

                  MD5

                  bfdac2e89d6d76a40416770da4b2399a

                  SHA1

                  18825238f8f5f59d91c066f212d20690fb22658f

                  SHA256

                  dc1a103184deb9fcff751b3956dfde357fb0b8668d64846df22aeb686b938b75

                  SHA512

                  81b195c4d465c72f0386b28b1388f9896a666b0c9d865a6ccb8a0bf660cc52c9c566782c41097a69dbbac341b6f1a49a675708173a6a1e005a89883d997881ec

                • memory/68-119-0x0000000000000000-mapping.dmp

                • memory/1808-118-0x0000000000000000-mapping.dmp

                • memory/2584-115-0x0000000000730000-0x0000000000740000-memory.dmp

                • memory/2584-116-0x0000000002260000-0x0000000002261000-memory.dmp

                • memory/2584-117-0x0000000000400000-0x00000000004A9000-memory.dmp