Overview

overview

10

Static

static

23f8aa94ff...b2.exe

windows10_x64

10

Analysis

  • max time kernel
    142s
  • max time network
    294s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    20-10-2021 12:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exe

  • Size

    384KB

  • MD5

    5ac0f050f93f86e69026faea1fbb4450

  • SHA1

    9709774fde9ec740ad6fed8ed79903296ca9d571

  • SHA256

    23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2

  • SHA512

    b554487c4e26a85ec5179cdcc1d25b5bc494e8821a8899fbbf868c3cf41f70cc72db107613b3f6655d3ab70f4db94cce2589066bb354b1ed955098d3911b844d

Score
10/10
ryukpersistenceransomwarespywarestealer

Malware Config

Extracted

Path

C:\RyukReadMe.txt

Family

ryuk

Ransom Note
Your network has been penetrated. All files on each host in the network have been encrypted with a strong algorithm. Backups were either encrypted or deleted or backup disks were formatted. Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover. We exclusively have decryption software for your situation No decryption software is available in the public. DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT RENAME OR MOVE the encrypted and readme files. DO NOT DELETE readme files. This may lead to the impossibility of recovery of the certain files. To get info (decrypt your files) contact us at WayneEvenson@protonmail.com or WayneEvenson@tutanota.com BTC wallet: 14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk Ryuk No system is safe
Emails

WayneEvenson@protonmail.com

WayneEvenson@tutanota.com
Wallets

14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

    ransomwareryuk
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Executes dropped EXE 1 IoCs
  • Modifies Installed Components in the registry 2 TTPs
    persistence
  • Deletes itself 1 IoCs
  • Drops startup file 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 33 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 12 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Interacts with shadow copies 2 TTPs 64 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1780
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\users\Public\window.bat"
      2⤵
        PID:3692
        • C:\Windows\system32\vssadmin.exe
          vssadmin Delete Shadows /all /quiet
          3⤵
          • Interacts with shadow copies
          PID:78708
        • C:\Windows\system32\vssadmin.exe
          vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB
          3⤵
          • Interacts with shadow copies
          PID:1252
        • C:\Windows\system32\vssadmin.exe
          vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded
          3⤵
          • Interacts with shadow copies
          PID:2252
        • C:\Windows\system32\vssadmin.exe
          vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB
          3⤵
          • Interacts with shadow copies
          PID:3584
        • C:\Windows\system32\vssadmin.exe
          vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded
          3⤵
          • Interacts with shadow copies
          PID:1744
        • C:\Windows\system32\vssadmin.exe
          vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB
          3⤵
          • Interacts with shadow copies
          PID:2712
        • C:\Windows\system32\vssadmin.exe
          vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded
          3⤵
            PID:1688
          • C:\Windows\system32\vssadmin.exe
            vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB
            3⤵
            • Interacts with shadow copies
            PID:3552
          • C:\Windows\system32\vssadmin.exe
            vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded
            3⤵
            • Interacts with shadow copies
            PID:4100
          • C:\Windows\system32\vssadmin.exe
            vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB
            3⤵
            • Interacts with shadow copies
            PID:2748
          • C:\Windows\system32\vssadmin.exe
            vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded
            3⤵
            • Interacts with shadow copies
            PID:2036
          • C:\Windows\system32\vssadmin.exe
            vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB
            3⤵
            • Interacts with shadow copies
            PID:3516
          • C:\Windows\system32\vssadmin.exe
            vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded
            3⤵
            • Interacts with shadow copies
            PID:2828
          • C:\Windows\system32\vssadmin.exe
            vssadmin Delete Shadows /all /quiet
            3⤵
            • Interacts with shadow copies
            PID:78592
      • C:\Windows\system32\DllHost.exe
        C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
        1⤵
          PID:3760
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -u -p 3760 -s 812
            2⤵
            • Program crash
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1836
        • C:\Windows\System32\RuntimeBroker.exe
          C:\Windows\System32\RuntimeBroker.exe -Embedding
          1⤵
          • Drops startup file
          • Drops file in Program Files directory
          • Modifies registry class
          • Suspicious use of UnmapMainImage
          • Suspicious use of WriteProcessMemory
          PID:3480
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /C "C:\users\Public\window.bat"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:4204
            • C:\Windows\system32\vssadmin.exe
              vssadmin Delete Shadows /all /quiet
              3⤵
              • Interacts with shadow copies
              PID:4208
            • C:\Windows\system32\vssadmin.exe
              vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB
              3⤵
              • Interacts with shadow copies
              PID:1552
            • C:\Windows\system32\vssadmin.exe
              vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded
              3⤵
                PID:844
              • C:\Windows\system32\vssadmin.exe
                vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB
                3⤵
                • Enumerates connected drives
                • Interacts with shadow copies
                PID:2876
              • C:\Windows\system32\vssadmin.exe
                vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded
                3⤵
                • Enumerates connected drives
                • Interacts with shadow copies
                PID:3964
              • C:\Windows\system32\vssadmin.exe
                vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB
                3⤵
                • Enumerates connected drives
                • Interacts with shadow copies
                PID:3724
              • C:\Windows\system32\vssadmin.exe
                vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded
                3⤵
                • Enumerates connected drives
                PID:3632
              • C:\Windows\system32\vssadmin.exe
                vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB
                3⤵
                • Enumerates connected drives
                • Interacts with shadow copies
                PID:14376
              • C:\Windows\system32\vssadmin.exe
                vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded
                3⤵
                • Enumerates connected drives
                • Interacts with shadow copies
                PID:18912
              • C:\Windows\system32\vssadmin.exe
                vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB
                3⤵
                • Enumerates connected drives
                • Interacts with shadow copies
                PID:22228
              • C:\Windows\system32\vssadmin.exe
                vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded
                3⤵
                • Enumerates connected drives
                • Interacts with shadow copies
                PID:35240
          • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
            1⤵
              PID:3272
            • C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
              "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
              1⤵
                PID:3252
              • c:\windows\system32\taskhostw.exe
                taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                1⤵
                • Drops startup file
                • Drops file in Program Files directory
                PID:2892
                • C:\Windows\System32\cmd.exe
                  "C:\Windows\System32\cmd.exe" /C "C:\users\Public\window.bat"
                  2⤵
                    PID:79532
                    • C:\Windows\system32\vssadmin.exe
                      vssadmin Delete Shadows /all /quiet
                      3⤵
                      • Interacts with shadow copies
                      PID:79584
                    • C:\Windows\system32\vssadmin.exe
                      vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB
                      3⤵
                      • Interacts with shadow copies
                      PID:79620
                    • C:\Windows\system32\vssadmin.exe
                      vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded
                      3⤵
                      • Interacts with shadow copies
                      PID:79656
                    • C:\Windows\system32\vssadmin.exe
                      vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB
                      3⤵
                      • Interacts with shadow copies
                      PID:79688
                    • C:\Windows\system32\vssadmin.exe
                      vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded
                      3⤵
                      • Interacts with shadow copies
                      PID:79720
                    • C:\Windows\system32\vssadmin.exe
                      vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB
                      3⤵
                      • Interacts with shadow copies
                      PID:79752
                    • C:\Windows\system32\vssadmin.exe
                      vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded
                      3⤵
                      • Interacts with shadow copies
                      PID:79784
                    • C:\Windows\system32\vssadmin.exe
                      vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB
                      3⤵
                      • Interacts with shadow copies
                      PID:79836
                    • C:\Windows\system32\vssadmin.exe
                      vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded
                      3⤵
                      • Interacts with shadow copies
                      PID:39496
                    • C:\Windows\system32\vssadmin.exe
                      vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB
                      3⤵
                      • Interacts with shadow copies
                      PID:6932
                    • C:\Windows\system32\vssadmin.exe
                      vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded
                      3⤵
                      • Interacts with shadow copies
                      PID:11328
                    • C:\Windows\system32\vssadmin.exe
                      vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB
                      3⤵
                      • Interacts with shadow copies
                      PID:5580
                    • C:\Windows\system32\vssadmin.exe
                      vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded
                      3⤵
                      • Interacts with shadow copies
                      PID:78552
                    • C:\Windows\system32\vssadmin.exe
                      vssadmin Delete Shadows /all /quiet
                      3⤵
                      • Interacts with shadow copies
                      PID:55704
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
                  1⤵
                    PID:2696
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C "C:\users\Public\window.bat"
                      2⤵
                        PID:31620
                        • C:\Windows\system32\vssadmin.exe
                          vssadmin Delete Shadows /all /quiet
                          3⤵
                          • Interacts with shadow copies
                          PID:78740
                        • C:\Windows\system32\vssadmin.exe
                          vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB
                          3⤵
                          • Interacts with shadow copies
                          PID:44020
                        • C:\Windows\system32\vssadmin.exe
                          vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded
                          3⤵
                          • Interacts with shadow copies
                          PID:3236
                        • C:\Windows\system32\vssadmin.exe
                          vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB
                          3⤵
                          • Interacts with shadow copies
                          PID:52148
                        • C:\Windows\system32\vssadmin.exe
                          vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded
                          3⤵
                          • Interacts with shadow copies
                          PID:57752
                        • C:\Windows\system32\vssadmin.exe
                          vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB
                          3⤵
                          • Interacts with shadow copies
                          PID:35600
                        • C:\Windows\system32\vssadmin.exe
                          vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded
                          3⤵
                          • Interacts with shadow copies
                          PID:78856
                        • C:\Windows\system32\vssadmin.exe
                          vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB
                          3⤵
                          • Interacts with shadow copies
                          PID:78892
                        • C:\Windows\system32\vssadmin.exe
                          vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded
                          3⤵
                          • Interacts with shadow copies
                          PID:78944
                        • C:\Windows\system32\vssadmin.exe
                          vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB
                          3⤵
                          • Interacts with shadow copies
                          PID:78960
                        • C:\Windows\system32\vssadmin.exe
                          vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded
                          3⤵
                          • Interacts with shadow copies
                          PID:78992
                        • C:\Windows\system32\vssadmin.exe
                          vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB
                          3⤵
                          • Interacts with shadow copies
                          PID:3936
                        • C:\Windows\system32\vssadmin.exe
                          vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded
                          3⤵
                          • Interacts with shadow copies
                          PID:79644
                        • C:\Windows\system32\vssadmin.exe
                          vssadmin Delete Shadows /all /quiet
                          3⤵
                          • Interacts with shadow copies
                          PID:79656
                    • c:\windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Drops startup file
                      • Drops file in Program Files directory
                      • Modifies registry class
                      • Suspicious use of UnmapMainImage
                      • Suspicious use of WriteProcessMemory
                      PID:2640
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C "C:\users\Public\window.bat"
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:78716
                        • C:\Windows\system32\vssadmin.exe
                          vssadmin Delete Shadows /all /quiet
                          3⤵
                          • Interacts with shadow copies
                          PID:78776
                        • C:\Windows\system32\vssadmin.exe
                          vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB
                          3⤵
                          • Interacts with shadow copies
                          PID:78480
                        • C:\Windows\system32\vssadmin.exe
                          vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded
                          3⤵
                          • Interacts with shadow copies
                          PID:40852
                        • C:\Windows\system32\vssadmin.exe
                          vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB
                          3⤵
                          • Enumerates connected drives
                          • Interacts with shadow copies
                          PID:78528
                        • C:\Windows\system32\vssadmin.exe
                          vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded
                          3⤵
                          • Enumerates connected drives
                          • Interacts with shadow copies
                          PID:78516
                        • C:\Windows\system32\vssadmin.exe
                          vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB
                          3⤵
                          • Enumerates connected drives
                          • Interacts with shadow copies
                          PID:78596
                        • C:\Windows\system32\vssadmin.exe
                          vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded
                          3⤵
                          • Enumerates connected drives
                          • Interacts with shadow copies
                          PID:78844
                        • C:\Windows\system32\vssadmin.exe
                          vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB
                          3⤵
                          • Enumerates connected drives
                          • Interacts with shadow copies
                          PID:2464
                        • C:\Windows\system32\vssadmin.exe
                          vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded
                          3⤵
                          • Enumerates connected drives
                          • Interacts with shadow copies
                          PID:2056
                        • C:\Windows\system32\vssadmin.exe
                          vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB
                          3⤵
                          • Enumerates connected drives
                          • Interacts with shadow copies
                          PID:2428
                        • C:\Windows\system32\vssadmin.exe
                          vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded
                          3⤵
                          • Enumerates connected drives
                          • Interacts with shadow copies
                          PID:1832
                        • C:\Windows\system32\vssadmin.exe
                          vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB
                          3⤵
                          • Enumerates connected drives
                          • Interacts with shadow copies
                          PID:1724
                        • C:\Windows\system32\vssadmin.exe
                          vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded
                          3⤵
                          • Enumerates connected drives
                          • Interacts with shadow copies
                          PID:1524
                        • C:\Windows\system32\vssadmin.exe
                          vssadmin Delete Shadows /all /quiet
                          3⤵
                          • Interacts with shadow copies
                          PID:1984
                    • C:\Users\Admin\AppData\Local\Temp\23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exe
                      "C:\Users\Admin\AppData\Local\Temp\23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exe"
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3772
                      • C:\users\Public\igdYM.exe
                        "C:\users\Public\igdYM.exe" C:\Users\Admin\AppData\Local\Temp\23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exe
                        2⤵
                        • Executes dropped EXE
                        • Deletes itself
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:1088
                        • C:\Windows\System32\cmd.exe
                          "C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\users\Public\igdYM.exe" /f
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3976
                          • C:\Windows\system32\reg.exe
                            REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\users\Public\igdYM.exe" /f
                            4⤵
                            • Adds Run key to start application
                            PID:1664
                    • C:\Windows\system32\NOTEPAD.EXE
                      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\RyukReadMe.txt
                      1⤵
                      • Opens file in notepad (likely ransom note)
                      PID:78592
                    • C:\Windows\system32\vssvc.exe
                      C:\Windows\system32\vssvc.exe
                      1⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:78808
                    • \??\c:\windows\system32\sihost.exe
                      sihost.exe
                      1⤵
                      • Modifies registry class
                      • Suspicious use of WriteProcessMemory
                      PID:1100
                      • C:\Windows\explorer.exe
                        explorer.exe /LOADSAVEDWINDOWS
                        2⤵
                        • Enumerates connected drives
                        • Drops file in Windows directory
                        • Checks SCSI registry key(s)
                        • Modifies Internet Explorer settings
                        • Modifies registry class
                        • Suspicious behavior: AddClipboardFormatListener
                        • Suspicious behavior: GetForegroundWindowSpam
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of SetWindowsHookEx
                        PID:3616
                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Documents\ClearComplete.pdf"
                          3⤵
                            PID:79300
                          • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
                            "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Documents\Opened.docx" /o ""
                            3⤵
                              PID:79408
                              • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe
                                OfficeC2RClient.exe /error PID=79408 ProcessName="Microsoft Word" UIType=3 ErrorSource=0x8b10082a ErrorCode=0x80004005 ShowUI=1
                                4⤵
                                • Process spawned unexpected child process
                                PID:79432
                        • C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
                          1⤵
                          • Drops file in Windows directory
                          • Enumerates system info in registry
                          • Modifies registry class
                          • Suspicious use of SetWindowsHookEx
                          PID:4260
                        • C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
                          "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
                          1⤵
                          • Drops file in Windows directory
                          • Suspicious use of SetWindowsHookEx
                          PID:5380
                        • C:\Windows\System32\RuntimeBroker.exe
                          C:\Windows\System32\RuntimeBroker.exe -Embedding
                          1⤵
                            PID:8072
                          • C:\Windows\System32\rundll32.exe
                            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                            1⤵
                              PID:79260
                            • \??\c:\windows\system32\taskhostw.exe
                              taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                              1⤵
                                PID:79816
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
                                1⤵
                                  PID:79688
                                • C:\Windows\system32\LogonUI.exe
                                  "LogonUI.exe" /flags:0x0 /state0:0xa3a92855 /state1:0x41c64e6d
                                  1⤵
                                    PID:4196

                                  Network

                                  MITRE ATT&CK Matrix ATT&CK v6

                                  Initial Access

                                  Execution

                                  Persistence

                                  Registry Run Keys / Startup Folder

                                  2
                                  T1060

                                  Privilege Escalation

                                  Defense Evasion

                                  File Deletion

                                  2
                                  T1107

                                  Modify Registry

                                  3
                                  T1112

                                  Credential Access

                                  Credentials in Files

                                  1
                                  T1081

                                  Discovery

                                  Query Registry

                                  3
                                  T1012

                                  Peripheral Device Discovery

                                  2
                                  T1120

                                  System Information Discovery

                                  4
                                  T1082

                                  Lateral Movement

                                  Collection

                                  Data from Local System

                                  1
                                  T1005

                                  Exfiltration

                                  Command and Control

                                  Impact

                                  Inhibit System Recovery

                                  2
                                  T1490

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Boot\Fonts\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Boot\Resources\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Boot\Resources\en-US\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Boot\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Boot\bg-BG\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Boot\cs-CZ\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Boot\da-DK\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Boot\de-DE\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Boot\el-GR\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Boot\en-GB\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Boot\en-US\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Boot\es-ES\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Boot\es-MX\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Boot\et-EE\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Boot\fi-FI\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Boot\fr-CA\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Boot\fr-FR\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Boot\hr-HR\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Boot\hu-HU\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Boot\it-IT\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Boot\ja-JP\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Boot\ko-KR\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Boot\lt-LT\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Boot\lv-LV\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Boot\nb-NO\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Boot\nl-NL\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Boot\pl-PL\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Boot\pt-BR\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Boot\pt-PT\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Boot\qps-ploc\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Boot\ro-RO\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Boot\ru-RU\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Boot\sk-SK\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Boot\sl-SI\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Boot\sr-Latn-RS\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Boot\sv-SE\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Boot\tr-TR\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Boot\uk-UA\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Boot\zh-CN\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Boot\zh-TW\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Documents and Settings\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\PerfLogs\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Program Files\7-Zip\Lang\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Program Files\7-Zip\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Program Files\Common Files\DESIGNER\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Program Files\Common Files\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Program Files\Common Files\microsoft shared\ClickToRun\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Program Files\Common Files\microsoft shared\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Program Files\Common Files\microsoft shared\ink\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Program Files\Common Files\microsoft shared\ink\da-DK\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Program Files\Common Files\microsoft shared\ink\de-DE\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Program Files\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_820f872d-98d3-48ae-bed7-778ac98992bc
                                    MD5

                                    1975f0421684541b228f62162b1bd63d

                                    SHA1

                                    282383d618e0702ad30c534a0c5cd85bd3f94315

                                    SHA256

                                    09e740a95a8950d38b61972205babea51275470bfd3746bd480d482ab32c95e7

                                    SHA512

                                    e7646d786a54b88af913461501b35ef2693b6526ee14eb603f28b35f5598d002c4403daa1a5f1ce8a459e5599b388fee11778059f385f031dc1b0ca188308c13

                                    Download Submit
                                  • C:\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Users\Public\Desktop\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\Users\Public\igdYM.exe
                                    MD5

                                    31bd0f224e7e74eee2847f43aae23974

                                    SHA1

                                    92e331e1e8ad30538f38dd7ba31386afafa14a58

                                    SHA256

                                    8b0a5fb13309623c3518473551cb1f55d38d8450129d4a3c16b476f7b2867d7d

                                    SHA512

                                    a13f05a12b084ef425f542ff4be824bbccb5dbdfe085af8b7e19d81a6bcba4b8c1debcc38f6b57bc9265a4db21eed70852ece8cc62b3ef14c47fca3035a55249

                                    Download Submit
                                  • C:\odt\RyukReadMe.txt
                                    MD5

                                    cd99cba6153cbc0b14b7a849e4d0180f

                                    SHA1

                                    375961866404a705916cbc6cd4915de7d9778923

                                    SHA256

                                    74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

                                    SHA512

                                    0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

                                    Download Submit
                                  • C:\users\Public\igdYM.exe
                                    MD5

                                    31bd0f224e7e74eee2847f43aae23974

                                    SHA1

                                    92e331e1e8ad30538f38dd7ba31386afafa14a58

                                    SHA256

                                    8b0a5fb13309623c3518473551cb1f55d38d8450129d4a3c16b476f7b2867d7d

                                    SHA512

                                    a13f05a12b084ef425f542ff4be824bbccb5dbdfe085af8b7e19d81a6bcba4b8c1debcc38f6b57bc9265a4db21eed70852ece8cc62b3ef14c47fca3035a55249

                                    Download Submit
                                  • C:\users\Public\window.bat
                                    MD5

                                    d2aba3e1af80edd77e206cd43cfd3129

                                    SHA1

                                    3116da65d097708fad63a3b73d1c39bffa94cb01

                                    SHA256

                                    8940135a58d28338ce4ea9b9933e6780507c56ab37a2f2e3a1a98c6564548a12

                                    SHA512

                                    0059bd4cc02c52a219a0a2e1836bf04c11e2693446648dd4d92a2f38ed060ecd6c0f835e542ff8cfef8903873c01b8de2b38ed6ed2131a131bdd17887c11d0ec

                                    Download Submit
                                  • \??\c:\BOOTSECT.BAK
                                    MD5

                                    437caa1075d0dabb6e60d7d335e68fcf

                                    SHA1

                                    5071a908b473bea724a872d3d3410b0432f3a504

                                    SHA256

                                    4aee3a5ced4454d572f3bfc671557e3ee057303df5fc82fc09507d72e11642f5

                                    SHA512

                                    150b2b236b29c9d205ca24061ff12e209b4d610bf50da45d823cfeee909bfadcfacf3f726d2d52d3bde912bf74d9cac67415890b597531207fb413ab150936ff

                                    Download Submit
                                  • \??\c:\Program Files\BackupDisconnect.fon
                                    MD5

                                    05f5ff5b43950f56c0362d341b5cb773

                                    SHA1

                                    f455b2ba139360be4ae9c1fc97b673912c330432

                                    SHA256

                                    721af14dfc62473c7c7db4923abf945a0879140d1b07ac1c9243be323c832e78

                                    SHA512

                                    5615cb5d21c03082ccb008b031f518b8ef84517667cefe31b4f2adee600f82b9c41836e695d54accdf90321f68a4118a1fa5146945af1e7a1b4f393a3fe2d0be

                                    Download Submit
                                  • memory/844-201-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/1088-115-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/1524-137-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/1552-200-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/1664-119-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/1724-136-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/1832-135-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/1984-138-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/2056-133-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/2428-134-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/2464-132-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/2640-120-0x00007FF66FBF0000-0x00007FF66FF7E000-memory.dmp
                                    Filesize

                                    3.6MB

                                    Download
                                  • memory/2876-202-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/3236-233-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/3616-204-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/3616-210-0x00000000040D0000-0x00000000040D1000-memory.dmp
                                    Filesize

                                    4KB

                                    Download
                                  • memory/3632-206-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/3724-205-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/3936-242-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/3964-203-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/3976-118-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/4204-198-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/4208-199-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/5580-227-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/6932-225-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/11328-226-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/14376-207-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/18912-208-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/22228-209-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/31620-230-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/35240-211-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/35600-236-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/39496-224-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/40852-127-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/44020-232-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/52148-234-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/55704-229-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/57752-235-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/78480-126-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/78516-129-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/78528-128-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/78552-228-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/78596-130-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/78716-122-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/78740-231-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/78776-124-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/78844-131-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/78856-237-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/78892-238-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/78944-239-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/78960-240-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/78992-241-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/79300-212-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/79408-213-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/79432-214-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/79532-215-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/79584-216-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/79620-217-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/79644-243-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/79656-218-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/79656-244-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/79688-219-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/79720-220-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/79752-221-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/79784-222-0x0000000000000000-mapping.dmp
                                    Download
                                  • memory/79836-223-0x0000000000000000-mapping.dmp
                                    Download