ryuk | ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66

Analysis

max time kernel
1005s
max time network
1608s
platform
windows10_x64
resource
win10-20220414-en
submitted
06-05-2022 15:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
Size

118KB
MD5

a31089dc3cafe77c39268273d689193b
SHA1

032e0b9a0bf012401507be974ee6bdb3e6726fd7
SHA256

ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66
SHA512

d92748b34286c21f4781b147000be1b54cf57e14587517638647b8369ccd01b3ecb00545be0d87d44f9dde6b30a404db2740bf06275dea647efc33eafd65d2f4

Score

10^/10

ryuk discovery ransomware

Malware Config

Extracted

Path

C:\users\Public\RyukReadMe.html

Family

ryuk

Ransom Note

contact balance of shadow universe Ryuk $password = 'N2QvTsXamJ'; $torlink = 'http://zq6gyokyso6dgsxitjuk2tkq2rl4saq4tkz2idcf6z3tfondtvemshad.onion'; function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};

URLs

http://zq6gyokyso6dgsxitjuk2tkq2rl4saq4tkz2idcf6z3tfondtvemshad.onion

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk
Executes dropped EXE 3 IoCs

Processes:

oXcbxNGKQrep.exeHQaExQcFLlan.exeEKPLAGoznlan.exe

pid process

1316 oXcbxNGKQrep.exe
3624 HQaExQcFLlan.exe
1708 EKPLAGoznlan.exe

pid	process
1316	oXcbxNGKQrep.exe
3624	HQaExQcFLlan.exe
1708	EKPLAGoznlan.exe

Modifies extensions of user files 13 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\TestRegister.tiff.RYK	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File renamed	C:\Users\Admin\Pictures\FindUnblock.png => C:\Users\Admin\Pictures\FindUnblock.png.RYK	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File renamed	C:\Users\Admin\Pictures\LockDismount.png => C:\Users\Admin\Pictures\LockDismount.png.RYK	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File renamed	C:\Users\Admin\Pictures\PublishRestart.png => C:\Users\Admin\Pictures\PublishRestart.png.RYK	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Users\Admin\Pictures\LockDismount.png.RYK	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Users\Admin\Pictures\DisconnectInvoke.tif.RYK	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Users\Admin\Pictures\EditRequest.crw.RYK	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Users\Admin\Pictures\FindUnblock.png.RYK	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Users\Admin\Pictures\PublishRestart.png.RYK	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File renamed	C:\Users\Admin\Pictures\EditRequest.crw => C:\Users\Admin\Pictures\EditRequest.crw.RYK	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File renamed	C:\Users\Admin\Pictures\DisconnectInvoke.tif => C:\Users\Admin\Pictures\DisconnectInvoke.tif.RYK	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Users\Admin\Pictures\TestRegister.tiff	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File renamed	C:\Users\Admin\Pictures\TestRegister.tiff => C:\Users\Admin\Pictures\TestRegister.tiff.RYK	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe

Drops startup file 1 IoCs

Processes:

ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\RyukReadMe.html	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe

Modifies file permissions 1 TTPs 2 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exeicacls.exe

pid process

19640 icacls.exe
19652 icacls.exe

pid	process
19640	icacls.exe
19652	icacls.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe

description	ioc	process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe

Drops file in Program Files directory 64 IoCs

Processes:

ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe

description	ioc	process
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-text.xml.RYK	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\dot.cur.RYK	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\selector.js.RYK	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\1033\SFMESSAGES.XML	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\messages_ko.properties.RYK	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\RyukReadMe.html	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_OEM_Perp-pl.xrm-ms.RYK	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\sign-in-2x.png.RYK	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\adcjavas.inc	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\VERSION.txt	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Trial-pl.xrm-ms	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-coredump.xml.RYK	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE.RYK	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial5-ul-oob.xrm-ms	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime2019_eula.txt	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_ellipses-hover.svg	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\email\themes\RyukReadMe.html	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\BloodPressureTracker.xltx.RYK	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\added.txt.RYK	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Bibliography\RyukReadMe.html	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\notice.txt	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\BSSYM7.TTF	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\RyukReadMe.html	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\cs-cz\ui-strings.js	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ja-jp\ui-strings.js	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\ja-jp\ui-strings.js	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt.nl_ja_4.4.0.v20140623020002.jar	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.nl_zh_4.4.0.v20140623020002.jar	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp-pl.xrm-ms	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ja-jp\ui-strings.js.RYK	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ja-jp\ui-strings.js.RYK	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\server_lg.gif	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\sl-sl\RyukReadMe.html	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-fr\ui-strings.js	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\zh-cn\ui-strings.js	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\Training.potx.RYK	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail2-ul-oob.xrm-ms	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART12.BDR	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VISSHE.DLL	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\en-us\oregres.dll.mui.RYK	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-ui.xml.RYK	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\en_US.aff.RYK	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\System\RyukReadMe.html	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist_jstree.xml	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\about.html.RYK	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annots.api.RYK	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423496937509.profile.gz	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul-oob.xrm-ms	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\about.html.RYK	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\bin\setNetworkServerCP	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\AccessBridgePackages.h.RYK	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\fr-FR\TabTip32.exe.mui.RYK	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons2x.png.RYK	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\ro-ro\ui-strings.js.RYK	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\MicrosoftDataStreamerforExcel.dll.config.RYK	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OFFRHD.DLL.RYK	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\share.svg.RYK	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\es-ES\TabTip.exe.mui	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Consolas-Verdana.xml	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\RyukReadMe.html	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ru-ru\RyukReadMe.html	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

SCHTASKS.exe

pid process

192084 SCHTASKS.exe
Runs net.exe

pid	process
192084	SCHTASKS.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

Processes:

ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe

pid	process
2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 2064 wrote to memory of 1316	2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe	oXcbxNGKQrep.exe
PID 2064 wrote to memory of 1316	2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe	oXcbxNGKQrep.exe
PID 2064 wrote to memory of 1316	2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe	oXcbxNGKQrep.exe
PID 2064 wrote to memory of 3624	2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe	HQaExQcFLlan.exe
PID 2064 wrote to memory of 3624	2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe	HQaExQcFLlan.exe
PID 2064 wrote to memory of 3624	2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe	HQaExQcFLlan.exe
PID 2064 wrote to memory of 1708	2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe	EKPLAGoznlan.exe
PID 2064 wrote to memory of 1708	2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe	EKPLAGoznlan.exe
PID 2064 wrote to memory of 1708	2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe	EKPLAGoznlan.exe
PID 2064 wrote to memory of 19640	2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe	icacls.exe
PID 2064 wrote to memory of 19640	2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe	icacls.exe
PID 2064 wrote to memory of 19640	2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe	icacls.exe
PID 2064 wrote to memory of 19652	2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe	icacls.exe
PID 2064 wrote to memory of 19652	2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe	icacls.exe
PID 2064 wrote to memory of 19652	2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe	icacls.exe
PID 2064 wrote to memory of 24512	2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe	net.exe
PID 2064 wrote to memory of 24512	2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe	net.exe
PID 2064 wrote to memory of 24512	2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe	net.exe
PID 2064 wrote to memory of 40652	2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe	net.exe
PID 2064 wrote to memory of 40652	2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe	net.exe
PID 2064 wrote to memory of 40652	2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe	net.exe
PID 2064 wrote to memory of 40844	2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe	net.exe
PID 2064 wrote to memory of 40844	2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe	net.exe
PID 2064 wrote to memory of 40844	2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe	net.exe
PID 2064 wrote to memory of 24152	2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe	net.exe
PID 2064 wrote to memory of 24152	2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe	net.exe
PID 2064 wrote to memory of 24152	2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe	net.exe
PID 24152 wrote to memory of 46528	24152	net.exe	net1.exe
PID 24152 wrote to memory of 46528	24152	net.exe	net1.exe
PID 24152 wrote to memory of 46528	24152	net.exe	net1.exe
PID 40652 wrote to memory of 46540	40652	net.exe	net1.exe
PID 40652 wrote to memory of 46540	40652	net.exe	net1.exe
PID 40652 wrote to memory of 46540	40652	net.exe	net1.exe
PID 24512 wrote to memory of 45052	24512	net.exe	net1.exe
PID 24512 wrote to memory of 45052	24512	net.exe	net1.exe
PID 24512 wrote to memory of 45052	24512	net.exe	net1.exe
PID 40844 wrote to memory of 44744	40844	net.exe	net1.exe
PID 40844 wrote to memory of 44744	40844	net.exe	net1.exe
PID 40844 wrote to memory of 44744	40844	net.exe	net1.exe
PID 2064 wrote to memory of 182640	2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe	net.exe
PID 2064 wrote to memory of 182640	2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe	net.exe
PID 2064 wrote to memory of 182640	2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe	net.exe
PID 2064 wrote to memory of 182692	2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe	net.exe
PID 2064 wrote to memory of 182692	2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe	net.exe
PID 2064 wrote to memory of 182692	2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe	net.exe
PID 182640 wrote to memory of 183260	182640	net.exe	net1.exe
PID 182640 wrote to memory of 183260	182640	net.exe	net1.exe
PID 182640 wrote to memory of 183260	182640	net.exe	net1.exe
PID 182692 wrote to memory of 182700	182692	net.exe	net1.exe
PID 182692 wrote to memory of 182700	182692	net.exe	net1.exe
PID 182692 wrote to memory of 182700	182692	net.exe	net1.exe
PID 2064 wrote to memory of 192084	2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe	SCHTASKS.exe
PID 2064 wrote to memory of 192084	2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe	SCHTASKS.exe
PID 2064 wrote to memory of 192084	2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe	SCHTASKS.exe
PID 2064 wrote to memory of 267852	2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe	net.exe
PID 2064 wrote to memory of 267852	2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe	net.exe
PID 2064 wrote to memory of 267852	2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe	net.exe
PID 2064 wrote to memory of 267864	2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe	net.exe
PID 2064 wrote to memory of 267864	2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe	net.exe
PID 2064 wrote to memory of 267864	2064	ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe	net.exe
PID 267852 wrote to memory of 268928	267852	net.exe	net1.exe
PID 267852 wrote to memory of 268928	267852	net.exe	net1.exe
PID 267852 wrote to memory of 268928	267852	net.exe	net1.exe
PID 267864 wrote to memory of 268944	267864	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe
"C:\Users\Admin\AppData\Local\Temp\ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66.exe"
1⤵
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Users\Admin\AppData\Local\Temp\oXcbxNGKQrep.exe
  "C:\Users\Admin\AppData\Local\Temp\oXcbxNGKQrep.exe" 9 REP
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Users\Admin\AppData\Local\Temp\HQaExQcFLlan.exe
  "C:\Users\Admin\AppData\Local\Temp\HQaExQcFLlan.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  PID:3624
- C:\Users\Admin\AppData\Local\Temp\EKPLAGoznlan.exe
  "C:\Users\Admin\AppData\Local\Temp\EKPLAGoznlan.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  PID:1708
- C:\Windows\SysWOW64\icacls.exe
  icacls "C:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:19640
- C:\Windows\SysWOW64\icacls.exe
  icacls "D:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:19652
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:24512
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:45052
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:40652
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:46540
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:24152
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:46528
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:40844
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:44744
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:182692
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:182700
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:182640
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:183260
- C:\Windows\SysWOW64\SCHTASKS.exe
  SCHTASKS /CREATE /NP /SC DAILY /TN "PrintqK" /TR "C:\Windows\System32\cmd.exe /c for /l %x in (1,1,50) do start wordpad.exe /p C:\users\Public\6lqi2.dll" /ST 10:25 /SD 05/07/2022 /ED 05/14/2022
  2⤵
  - Creates scheduled task(s)
  PID:192084
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:267864
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:268944
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:267852
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:268928
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:336808
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:336732
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:336820
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:336740
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:337588
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:337872
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:337900
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:337720
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:337460
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:337652
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:337668
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:336840
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:336568
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:336824
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:337216
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:337460
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:336752
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:337432
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:337476
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:337496
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:525252
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:529388
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:525244
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:529400
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:642584
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:643640
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:642580
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:643624
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:713380
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:713544
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:713372
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:714740
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:778636
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:779852
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:778624
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:779840
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:799160
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:799008
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:799064
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:798632
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:798640
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:798676
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:798852
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:799480
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:798668
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:799012
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:798932
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:799648
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:799304
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:798572
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:799100
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:798860
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:798608
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:799632
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:798904
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:2148

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\RyukReadMe.html

Filesize
1KB

MD5
8398b1f229e0d80c65e262ae92085a90

SHA1
5142f7b7f9dc13ac8a07eac6e1240efa84e3bc8d

SHA256
4e374f86295c56c4c0d57b134d9035377b0d17b6fe418fd790cdfb3f7a9d03b5

SHA512
113b51cb8fcbc1c61161434948aa0297ce2ce889100ab1827d1a7d0a76e65d99e97d590b43911b450cc931ec4517affe26860af072e967294656d9e7e83ee687

Download Submit
C:\$Recycle.Bin\S-1-5-21-1804997378-2045782378-3882459628-1000\RyukReadMe.html

Filesize
1KB

MD5
8398b1f229e0d80c65e262ae92085a90

SHA1
5142f7b7f9dc13ac8a07eac6e1240efa84e3bc8d

SHA256
4e374f86295c56c4c0d57b134d9035377b0d17b6fe418fd790cdfb3f7a9d03b5

SHA512
113b51cb8fcbc1c61161434948aa0297ce2ce889100ab1827d1a7d0a76e65d99e97d590b43911b450cc931ec4517affe26860af072e967294656d9e7e83ee687

Download Submit
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\RyukReadMe.html

Filesize
1KB

MD5
8398b1f229e0d80c65e262ae92085a90

SHA1
5142f7b7f9dc13ac8a07eac6e1240efa84e3bc8d

SHA256
4e374f86295c56c4c0d57b134d9035377b0d17b6fe418fd790cdfb3f7a9d03b5

SHA512
113b51cb8fcbc1c61161434948aa0297ce2ce889100ab1827d1a7d0a76e65d99e97d590b43911b450cc931ec4517affe26860af072e967294656d9e7e83ee687

Download Submit
C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\RyukReadMe.html

Filesize
1KB

MD5
8398b1f229e0d80c65e262ae92085a90

SHA1
5142f7b7f9dc13ac8a07eac6e1240efa84e3bc8d

SHA256
4e374f86295c56c4c0d57b134d9035377b0d17b6fe418fd790cdfb3f7a9d03b5

SHA512
113b51cb8fcbc1c61161434948aa0297ce2ce889100ab1827d1a7d0a76e65d99e97d590b43911b450cc931ec4517affe26860af072e967294656d9e7e83ee687

Download Submit
C:\PerfLogs\RyukReadMe.html

Filesize
1KB

MD5
8398b1f229e0d80c65e262ae92085a90

SHA1
5142f7b7f9dc13ac8a07eac6e1240efa84e3bc8d

SHA256
4e374f86295c56c4c0d57b134d9035377b0d17b6fe418fd790cdfb3f7a9d03b5

SHA512
113b51cb8fcbc1c61161434948aa0297ce2ce889100ab1827d1a7d0a76e65d99e97d590b43911b450cc931ec4517affe26860af072e967294656d9e7e83ee687

Download Submit
C:\RyukReadMe.html

Filesize
1KB

MD5
8398b1f229e0d80c65e262ae92085a90

SHA1
5142f7b7f9dc13ac8a07eac6e1240efa84e3bc8d

SHA256
4e374f86295c56c4c0d57b134d9035377b0d17b6fe418fd790cdfb3f7a9d03b5

SHA512
113b51cb8fcbc1c61161434948aa0297ce2ce889100ab1827d1a7d0a76e65d99e97d590b43911b450cc931ec4517affe26860af072e967294656d9e7e83ee687

Download Submit
C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt19.lst.RYK

Filesize
1KB

MD5
cafc21c4b48e2add13897783bc9941cd

SHA1
1b58e01942e9d9e4452ebe847127089cc2328771

SHA256
ac4d04801e106738dbd805b1ac2a33c64c0a6667bc59b19d69b2d9db83a35b4d

SHA512
59933132e0b558bcaf266f4ea1552a6e631d361d5284154cc1f8a13700eea42b318f5a54e2398017ba56f773172dbb0aff6403816504e3ab6c0643f3cec8a471

Download Submit
C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt19.lst.RYK

Filesize
72KB

MD5
be1ff64c636f30ba9afa825f78dee653

SHA1
835bb2672c4cadb0013b35491c025de0db344bc7

SHA256
5d8825fc5a73580274762076b679a3389af9942629ab162354805e5f06415cc9

SHA512
0c137495e5031be81d2a60c5f1b086c049215c0d35518129fd9e83c17dfbf370bd18ce20a08151ceb9d8dd0ee00e9de2470de6d5355c9cbb4bef6eecb6f5e0a2

Download Submit
C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt19.lst.RYK

Filesize
9KB

MD5
8c89082ecc1c95a59eb76d28c63fccec

SHA1
94856a313052081ada54714ca8a93165ab4eb4ab

SHA256
e8234ddee9cf34e5d658575b18983cc4679ed60faf954574e370c47ead12812d

SHA512
99ae120f9921cf22a3186fb5f5b4ec2c19e69540d1cfb1f2d45bea99d1431604863c7edfa3fe8b5cd3e23c88d2d46cd6d2434cd46e3a3c199ead2e835e027655

Download Submit
C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\Cache\RyukReadMe.html

Filesize
1KB

MD5
8398b1f229e0d80c65e262ae92085a90

SHA1
5142f7b7f9dc13ac8a07eac6e1240efa84e3bc8d

SHA256
4e374f86295c56c4c0d57b134d9035377b0d17b6fe418fd790cdfb3f7a9d03b5

SHA512
113b51cb8fcbc1c61161434948aa0297ce2ce889100ab1827d1a7d0a76e65d99e97d590b43911b450cc931ec4517affe26860af072e967294656d9e7e83ee687

Download Submit
C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\IconCacheRdr65536.dat.RYK

Filesize
68KB

MD5
6c3dea99d602377b34ba9b68263040ce

SHA1
15a3dd7800f9de191c4923f3994ba4a40cbb7548

SHA256
d960fd26b6c2f53c97267b26614d454c5a59bb483832d17b352cb84bbc1f666f

SHA512
ea8d161b79a57ee2b472fd665fa493c3a738b8dfa46f6f79ef4c5a1db270a9a584f63bc3a7ac3cb082693f35cca34c9aa63af3999b4a2a991dd3405da480042e

Download Submit
C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\RyukReadMe.html

Filesize
1KB

MD5
8398b1f229e0d80c65e262ae92085a90

SHA1
5142f7b7f9dc13ac8a07eac6e1240efa84e3bc8d

SHA256
4e374f86295c56c4c0d57b134d9035377b0d17b6fe418fd790cdfb3f7a9d03b5

SHA512
113b51cb8fcbc1c61161434948aa0297ce2ce889100ab1827d1a7d0a76e65d99e97d590b43911b450cc931ec4517affe26860af072e967294656d9e7e83ee687

Download Submit
C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents.RYK

Filesize
12KB

MD5
ebf86ecbbff7f9d1a1cde982c129e55a

SHA1
384eaf60e03366721f471199378de735df2a93a8

SHA256
9515b30675d5320d4f0a3d8d2455b4d6da2c13e3e650a8a56b37eb6aaa106d8e

SHA512
baec6e1c4403676acfc44b323b4b991f070e10dc8af47e9235ae903fb575efb3def2e15989491045b9f66a73b2bb7e3ba4dd5e0b1142f18e6d2655ed424ee14e

Download Submit
C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\ToolsSearchCacheRdr\RyukReadMe.html

Filesize
1KB

MD5
8398b1f229e0d80c65e262ae92085a90

SHA1
5142f7b7f9dc13ac8a07eac6e1240efa84e3bc8d

SHA256
4e374f86295c56c4c0d57b134d9035377b0d17b6fe418fd790cdfb3f7a9d03b5

SHA512
113b51cb8fcbc1c61161434948aa0297ce2ce889100ab1827d1a7d0a76e65d99e97d590b43911b450cc931ec4517affe26860af072e967294656d9e7e83ee687

Download Submit
C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\UserCache.bin.RYK

Filesize
31KB

MD5
d7ffdb15c0cbe75500e305091e08551f

SHA1
8cf8dd0abca3702c5c1c6681792648fb6098d7f1

SHA256
c114f5a6bd486ed5733033fb4adf62e91ef20aa505a0392c22ed482a5dc8985b

SHA512
499712c6fb6f571b34333b204aeecd0fa8be4fe96a5540567a688b6b5aad0672252ea41b2b9dafa89dd88845203b7793de86769ee2ae4c37275785b5ad2cf98f

Download Submit
C:\Users\Admin\AppData\Local\Adobe\Acrobat\RyukReadMe.html

Filesize
1KB

MD5
8398b1f229e0d80c65e262ae92085a90

SHA1
5142f7b7f9dc13ac8a07eac6e1240efa84e3bc8d

SHA256
4e374f86295c56c4c0d57b134d9035377b0d17b6fe418fd790cdfb3f7a9d03b5

SHA512
113b51cb8fcbc1c61161434948aa0297ce2ce889100ab1827d1a7d0a76e65d99e97d590b43911b450cc931ec4517affe26860af072e967294656d9e7e83ee687

Download Submit
C:\Users\Admin\AppData\Local\Adobe\Color\ACECache11.lst.RYK

Filesize
1KB

MD5
14d8440805db9a9df3c72642a18702eb

SHA1
58317bc443d86b4acad550c5ae24026a4b81aea1

SHA256
4eb456c744db50d2cffe9837a8896ef331a5a122e6bdc64e76d937a77c74deb0

SHA512
30667bf93541f5943aec3983ada1851556dae26cc4d035b1623c1bc1aeccdfb8e32642ca72facfb597e1d75ce2088d3e1d1f30c693b164e4830394b422751065

Download Submit
C:\Users\Admin\AppData\Local\Adobe\Color\Profiles\RyukReadMe.html

Filesize
1KB

MD5
8398b1f229e0d80c65e262ae92085a90

SHA1
5142f7b7f9dc13ac8a07eac6e1240efa84e3bc8d

SHA256
4e374f86295c56c4c0d57b134d9035377b0d17b6fe418fd790cdfb3f7a9d03b5

SHA512
113b51cb8fcbc1c61161434948aa0297ce2ce889100ab1827d1a7d0a76e65d99e97d590b43911b450cc931ec4517affe26860af072e967294656d9e7e83ee687

Download Submit
C:\Users\Admin\AppData\Local\Adobe\Color\Profiles\wsRGB.icc.RYK

Filesize
2KB

MD5
e2a7e1f83a47869b8150f70fd5d17ea2

SHA1
151daf50fbc002fcfc0bf20c56ec96989417ec1a

SHA256
c4f1d13ca29d9a607e44340afeed4e1ac00f3b2a67f454e28b8de254134f00ee

SHA512
f7e775d7ea2b02882252135c7297399532a2e76ee3809730940487d3c93368a4584a036a983692efe978d4669f886636d717d4a7d8226bb3a33b68f13e59cc50

Download Submit
C:\Users\Admin\AppData\Local\Adobe\Color\Profiles\wscRGB.icc.RYK

Filesize
64KB

MD5
b23a3eef2edfd9cc6ddb0e92b6d81df2

SHA1
f6ffe5fb787e06b77fa55ce4ae7fc503995b0299

SHA256
c6c72dc233ce45ad7213bc87c9bd9bdffaddde543068b8d6dd30d051dcbe2194

SHA512
0ecc27cad1bfbc53cfa2e40982770046cddcc447a25251a1daee1c1a438d15876fb330035fc8216e2bfa1aa8eb3e405fad55c4e2beb7dd9054aa38b51ae63105

Download Submit
C:\Users\Admin\AppData\Local\Adobe\Color\RyukReadMe.html

Filesize
1KB

MD5
8398b1f229e0d80c65e262ae92085a90

SHA1
5142f7b7f9dc13ac8a07eac6e1240efa84e3bc8d

SHA256
4e374f86295c56c4c0d57b134d9035377b0d17b6fe418fd790cdfb3f7a9d03b5

SHA512
113b51cb8fcbc1c61161434948aa0297ce2ce889100ab1827d1a7d0a76e65d99e97d590b43911b450cc931ec4517affe26860af072e967294656d9e7e83ee687

Download Submit
C:\Users\Admin\AppData\Local\Comms\RyukReadMe.html

Filesize
1KB

MD5
8398b1f229e0d80c65e262ae92085a90

SHA1
5142f7b7f9dc13ac8a07eac6e1240efa84e3bc8d

SHA256
4e374f86295c56c4c0d57b134d9035377b0d17b6fe418fd790cdfb3f7a9d03b5

SHA512
113b51cb8fcbc1c61161434948aa0297ce2ce889100ab1827d1a7d0a76e65d99e97d590b43911b450cc931ec4517affe26860af072e967294656d9e7e83ee687

Download Submit
C:\Users\Admin\AppData\Local\Google\RyukReadMe.html

Filesize
1KB

MD5
8398b1f229e0d80c65e262ae92085a90

SHA1
5142f7b7f9dc13ac8a07eac6e1240efa84e3bc8d

SHA256
4e374f86295c56c4c0d57b134d9035377b0d17b6fe418fd790cdfb3f7a9d03b5

SHA512
113b51cb8fcbc1c61161434948aa0297ce2ce889100ab1827d1a7d0a76e65d99e97d590b43911b450cc931ec4517affe26860af072e967294656d9e7e83ee687

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\RyukReadMe.html

Filesize
1KB

MD5
8398b1f229e0d80c65e262ae92085a90

SHA1
5142f7b7f9dc13ac8a07eac6e1240efa84e3bc8d

SHA256
4e374f86295c56c4c0d57b134d9035377b0d17b6fe418fd790cdfb3f7a9d03b5

SHA512
113b51cb8fcbc1c61161434948aa0297ce2ce889100ab1827d1a7d0a76e65d99e97d590b43911b450cc931ec4517affe26860af072e967294656d9e7e83ee687

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\History\History.IE5\RyukReadMe.html

Filesize
1KB

MD5
8398b1f229e0d80c65e262ae92085a90

SHA1
5142f7b7f9dc13ac8a07eac6e1240efa84e3bc8d

SHA256
4e374f86295c56c4c0d57b134d9035377b0d17b6fe418fd790cdfb3f7a9d03b5

SHA512
113b51cb8fcbc1c61161434948aa0297ce2ce889100ab1827d1a7d0a76e65d99e97d590b43911b450cc931ec4517affe26860af072e967294656d9e7e83ee687

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\History\Low\RyukReadMe.html

Filesize
1KB

MD5
8398b1f229e0d80c65e262ae92085a90

SHA1
5142f7b7f9dc13ac8a07eac6e1240efa84e3bc8d

SHA256
4e374f86295c56c4c0d57b134d9035377b0d17b6fe418fd790cdfb3f7a9d03b5

SHA512
113b51cb8fcbc1c61161434948aa0297ce2ce889100ab1827d1a7d0a76e65d99e97d590b43911b450cc931ec4517affe26860af072e967294656d9e7e83ee687

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\History\RyukReadMe.html

Filesize
1KB

MD5
8398b1f229e0d80c65e262ae92085a90

SHA1
5142f7b7f9dc13ac8a07eac6e1240efa84e3bc8d

SHA256
4e374f86295c56c4c0d57b134d9035377b0d17b6fe418fd790cdfb3f7a9d03b5

SHA512
113b51cb8fcbc1c61161434948aa0297ce2ce889100ab1827d1a7d0a76e65d99e97d590b43911b450cc931ec4517affe26860af072e967294656d9e7e83ee687

Download Submit
C:\Users\Admin\AppData\Local\Packages\RyukReadMe.html

Filesize
1KB

MD5
8398b1f229e0d80c65e262ae92085a90

SHA1
5142f7b7f9dc13ac8a07eac6e1240efa84e3bc8d

SHA256
4e374f86295c56c4c0d57b134d9035377b0d17b6fe418fd790cdfb3f7a9d03b5

SHA512
113b51cb8fcbc1c61161434948aa0297ce2ce889100ab1827d1a7d0a76e65d99e97d590b43911b450cc931ec4517affe26860af072e967294656d9e7e83ee687

Download Submit
C:\Users\Admin\AppData\Local\Packages\windows_ie_ac_001\RyukReadMe.html

Filesize
1KB

MD5
8398b1f229e0d80c65e262ae92085a90

SHA1
5142f7b7f9dc13ac8a07eac6e1240efa84e3bc8d

SHA256
4e374f86295c56c4c0d57b134d9035377b0d17b6fe418fd790cdfb3f7a9d03b5

SHA512
113b51cb8fcbc1c61161434948aa0297ce2ce889100ab1827d1a7d0a76e65d99e97d590b43911b450cc931ec4517affe26860af072e967294656d9e7e83ee687

Download Submit
C:\Users\Admin\AppData\Local\PeerDistRepub\RyukReadMe.html

Filesize
1KB

MD5
8398b1f229e0d80c65e262ae92085a90

SHA1
5142f7b7f9dc13ac8a07eac6e1240efa84e3bc8d

SHA256
4e374f86295c56c4c0d57b134d9035377b0d17b6fe418fd790cdfb3f7a9d03b5

SHA512
113b51cb8fcbc1c61161434948aa0297ce2ce889100ab1827d1a7d0a76e65d99e97d590b43911b450cc931ec4517affe26860af072e967294656d9e7e83ee687

Download Submit
C:\Users\Admin\AppData\Local\Publishers\8wekyb3d8bbwe\RyukReadMe.html

Filesize
1KB

MD5
8398b1f229e0d80c65e262ae92085a90

SHA1
5142f7b7f9dc13ac8a07eac6e1240efa84e3bc8d

SHA256
4e374f86295c56c4c0d57b134d9035377b0d17b6fe418fd790cdfb3f7a9d03b5

SHA512
113b51cb8fcbc1c61161434948aa0297ce2ce889100ab1827d1a7d0a76e65d99e97d590b43911b450cc931ec4517affe26860af072e967294656d9e7e83ee687

Download Submit
C:\Users\Admin\AppData\Local\Publishers\RyukReadMe.html

Filesize
1KB

MD5
8398b1f229e0d80c65e262ae92085a90

SHA1
5142f7b7f9dc13ac8a07eac6e1240efa84e3bc8d

SHA256
4e374f86295c56c4c0d57b134d9035377b0d17b6fe418fd790cdfb3f7a9d03b5

SHA512
113b51cb8fcbc1c61161434948aa0297ce2ce889100ab1827d1a7d0a76e65d99e97d590b43911b450cc931ec4517affe26860af072e967294656d9e7e83ee687

Download Submit
C:\Users\Admin\AppData\Local\Temp\3949218439\RyukReadMe.html

Filesize
1KB

MD5
8398b1f229e0d80c65e262ae92085a90

SHA1
5142f7b7f9dc13ac8a07eac6e1240efa84e3bc8d

SHA256
4e374f86295c56c4c0d57b134d9035377b0d17b6fe418fd790cdfb3f7a9d03b5

SHA512
113b51cb8fcbc1c61161434948aa0297ce2ce889100ab1827d1a7d0a76e65d99e97d590b43911b450cc931ec4517affe26860af072e967294656d9e7e83ee687

Download Submit
C:\Users\Admin\AppData\Local\Temp\3949218439\zmstage.exe.orig.RYK

Filesize
3.7MB

MD5
2a6a30ddb65d15a747fc49241466aec4

SHA1
9496aa000df515f00fee0279d69ed77c1b255769

SHA256
b14c1b5f8c1629a8a6c25f243c6edaa185f914d6bfff3935285388a127fbd607

SHA512
f6349a99404d54f0247e011490e5ebbadb5d6c99a62045b05edc970eb1e932765c04b5e70f9decbf1422281c03f47f2950e1a7527cbfb2ed97cb538a3e45ee0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdobeSFX.log.RYK

Filesize
2KB

MD5
40c0caee1b21de0af89d7efe33d708d0

SHA1
4778f3440201267b91ede8450b037ee2137b87d8

SHA256
17f86f37f9f98f757b5493400e9b1b901fc72789726b6ac31e5d83ad856a73c4

SHA512
8693de70e39a8ffa5a711c55a50a07fd85dfea7911a31abd285455fb0925b9a844c5a02577d4e61ba08be6ac20286976a6a6da7446655454b430177f8be9263e

Download Submit
C:\Users\Admin\AppData\Local\Temp\EKPLAGoznlan.exe

Filesize
118KB

MD5
a31089dc3cafe77c39268273d689193b

SHA1
032e0b9a0bf012401507be974ee6bdb3e6726fd7

SHA256
ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66

SHA512
d92748b34286c21f4781b147000be1b54cf57e14587517638647b8369ccd01b3ecb00545be0d87d44f9dde6b30a404db2740bf06275dea647efc33eafd65d2f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\EKPLAGoznlan.exe

Filesize
118KB

MD5
a31089dc3cafe77c39268273d689193b

SHA1
032e0b9a0bf012401507be974ee6bdb3e6726fd7

SHA256
ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66

SHA512
d92748b34286c21f4781b147000be1b54cf57e14587517638647b8369ccd01b3ecb00545be0d87d44f9dde6b30a404db2740bf06275dea647efc33eafd65d2f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\HQaExQcFLlan.exe

Filesize
118KB

MD5
a31089dc3cafe77c39268273d689193b

SHA1
032e0b9a0bf012401507be974ee6bdb3e6726fd7

SHA256
ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66

SHA512
d92748b34286c21f4781b147000be1b54cf57e14587517638647b8369ccd01b3ecb00545be0d87d44f9dde6b30a404db2740bf06275dea647efc33eafd65d2f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\HQaExQcFLlan.exe

Filesize
118KB

MD5
a31089dc3cafe77c39268273d689193b

SHA1
032e0b9a0bf012401507be974ee6bdb3e6726fd7

SHA256
ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66

SHA512
d92748b34286c21f4781b147000be1b54cf57e14587517638647b8369ccd01b3ecb00545be0d87d44f9dde6b30a404db2740bf06275dea647efc33eafd65d2f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\JavaDeployReg.log.RYK

Filesize
25KB

MD5
03c4fcc5bad3f9ca8cdacc7cb8173901

SHA1
0db641534b550c48eec8fd8844e99b9a8be1e340

SHA256
9a1f726b208769ac1874eb619111a022ba3eb04ed04be6ffc4c162919de3c375

SHA512
26d7db28995d79e0f49917aeeab832495d3084d327fe943cf6d3d0f5dc3d66eb410bc7a4f9d0470530d43bd12a3afd490a0038b14af309b41653f5f0bcbd76b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Low\RyukReadMe.html

Filesize
1KB

MD5
8398b1f229e0d80c65e262ae92085a90

SHA1
5142f7b7f9dc13ac8a07eac6e1240efa84e3bc8d

SHA256
4e374f86295c56c4c0d57b134d9035377b0d17b6fe418fd790cdfb3f7a9d03b5

SHA512
113b51cb8fcbc1c61161434948aa0297ce2ce889100ab1827d1a7d0a76e65d99e97d590b43911b450cc931ec4517affe26860af072e967294656d9e7e83ee687

Download Submit
C:\Users\Admin\AppData\Local\Temp\NZMSJAPR-20220414-2119.log.RYK

Filesize
60KB

MD5
71e1a12593e0c9432d1c972cb4262dee

SHA1
df17e0d834bf44f5a17b049c854e6365ef5b534b

SHA256
8fd8c62ca4f40b5db47f247e7415aeb52545ede983b3c783251e7add82cbae75

SHA512
f80b51610d15d4881704da98702eace05129b2ff90e12266f8381be66bdb591e00c5580122153ce2bff7a26b152e211b025033fad54494e279af9d324e4d57d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\NZMSJAPR-20220414-2119a.log.RYK

Filesize
188KB

MD5
62ba90167917931856a2f5e84db9de99

SHA1
d13b1351401d774a5d17819f65f329fd94003762

SHA256
2eed7a5651873fe96a454c0da4cb28cb2a8b8ed690ec4630065432b6af704e90

SHA512
4233b04bfec81b964573f7b90557ff2117ac1bd65dc9342eb3ef1d6ae373e8a20a5d915562402bc76b4b3a22a592bd6c9c8a6f0aee1952522d8f9ff285a7a50a

Download Submit
C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

Filesize
1KB

MD5
8398b1f229e0d80c65e262ae92085a90

SHA1
5142f7b7f9dc13ac8a07eac6e1240efa84e3bc8d

SHA256
4e374f86295c56c4c0d57b134d9035377b0d17b6fe418fd790cdfb3f7a9d03b5

SHA512
113b51cb8fcbc1c61161434948aa0297ce2ce889100ab1827d1a7d0a76e65d99e97d590b43911b450cc931ec4517affe26860af072e967294656d9e7e83ee687

Download Submit
C:\Users\Admin\AppData\Local\Temp\acrocef_low\RyukReadMe.html

Filesize
1KB

MD5
8398b1f229e0d80c65e262ae92085a90

SHA1
5142f7b7f9dc13ac8a07eac6e1240efa84e3bc8d

SHA256
4e374f86295c56c4c0d57b134d9035377b0d17b6fe418fd790cdfb3f7a9d03b5

SHA512
113b51cb8fcbc1c61161434948aa0297ce2ce889100ab1827d1a7d0a76e65d99e97d590b43911b450cc931ec4517affe26860af072e967294656d9e7e83ee687

Download Submit
C:\Users\Admin\AppData\Local\Temp\aria-debug-3932.log.RYK

Filesize
754B

MD5
7000fcd0e99588cae28f3f52e085f6ae

SHA1
1285904c813b4bdd5cbee7e90e6bbbaafa6f0f90

SHA256
519110f85d17bd8b33e8c8f7ce13c0959409a7ea4feabb5ae7bbcc7af54c1b1a

SHA512
204ebade6daf4cf28f00abc832ef48cdfced234877943746aca3facc19a27043e94646de81e39957ee387685cdd7cb066fc2df2a768eb51d606063d7437db39e

Download Submit
C:\Users\Admin\AppData\Local\Temp\chrome_installer.log.RYK

Filesize
2KB

MD5
cb72f02803d31e91fc921be9f058ecd7

SHA1
1552c022d4ecee1f3b35db84ffdba53c02614904

SHA256
efecc3fc3470239fb588a4f8d1e06854d51c6597667942db7e36fd088f93a44b

SHA512
47b0d03d747b045e20abebc1cb5bc031998cf9f4b6c7d29a84fd87a60a0811497d09d49e590a62f127f3f46bebb26039c5620907e844f69f87ee3b6cfa20b184

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_SetupUtility.txt.RYK

Filesize
2KB

MD5
a77f8ea78c6cbba3f61ccce0645a848c

SHA1
5cff2837c7cb661e098311f6bb1c32b13ad13378

SHA256
2cd32c55f9b84104724f5a74174901377d20a6fb50094acdc373ffa0ca91f393

SHA512
87656ec0a0cc4e79bbf2c9399dcf12dcbcceae77a92574cd3e54bf10f04a8401f6f48ed97f371bf0e173d824f236385d0f84c2f94d66e625fca66cbbd60b638e

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI0665.txt.RYK

Filesize
425KB

MD5
e84c2c9b50eeb6f3b9e11974383fe770

SHA1
0f9584194ba19ae7e3570b6f3033db03e90814c7

SHA256
3c35a545ee1b10a902304fa2f9a4112b22214598a14b0ebb6c17627c83721b34

SHA512
af7a864b9fe58e522793ec8553a611ab34d8d458fdf03756792b7766aecede15cc57a1432039ba20deddd32ec77d635e2892f422843eb27bc8a8a1d17ebfc0d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI0692.txt.RYK

Filesize
414KB

MD5
84fac4d66452474b9d5bbdeaaccd79a3

SHA1
ba401085c243022c96e27adf5195dbe389369bbe

SHA256
9428f1a188e0a17d57859c32d5726ac7b163e9ff800c7c20698d647ecaef88a2

SHA512
c5a4126ed7127d9dd73c1c6ffbd548a6201dad28cd770e27d413ea103992054d4822b8cc0dbca8539e84a20f073074a29fa5ef100453c9338d9b412a51d9516a

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI0665.txt.RYK

Filesize
11KB

MD5
228224a8fb16e2fc3d2bcbcf3deb3d62

SHA1
ab927e69f7e6b1ad2c40614423f074d42daca958

SHA256
a4c5b435b7c76697e7becef40742b3d945ea02aa849ef1230c5bb3a8fdeec3a6

SHA512
be2fe59d8444e388d45c5504d5626ae0b367e6da026374b7e0adce6a60e071256ae4e442ae1788a2a9a6f4102b1e3beee2e0fe24fd724d87b27c2795a748b41b

Download Submit
C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI0692.txt.RYK

Filesize
11KB

MD5
ff16a1e8f24b1918a95c771151093075

SHA1
96415c1ca723494ecd00a284be29d2a49b427c85

SHA256
53aa4f3dc48c4fa1eb7d2e0f74d9b157f79c332529a961419a3280b189ce917a

SHA512
27529d2ed29bd77c7ed3d4b2ccfa1a7c85bc048bd7cea1390853872447ed0315f75ab372b23628f7efe4a1ee284a1773e735aafc12ba15c79f05458d4b1169fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\jusched.log.RYK

Filesize
266KB

MD5
3b9846b138fb379ba14a814ab3985bcc

SHA1
ba9f152c9bc8a213158b54b7bff38b7480bdfd28

SHA256
5b825e04418824725fb8ed170cab0606a87381f4a058f2378eb9fe95c1c833ce

SHA512
1fde7dea4c6fbd70df2de3d12c42773a0c2f21e09adb02d2ae6187f296b899be5e5484c0328638810671a2e38317fd0e753c383c408ebebb713d405cdf12f885

Download Submit
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\RyukReadMe.html

Filesize
1KB

MD5
8398b1f229e0d80c65e262ae92085a90

SHA1
5142f7b7f9dc13ac8a07eac6e1240efa84e3bc8d

SHA256
4e374f86295c56c4c0d57b134d9035377b0d17b6fe418fd790cdfb3f7a9d03b5

SHA512
113b51cb8fcbc1c61161434948aa0297ce2ce889100ab1827d1a7d0a76e65d99e97d590b43911b450cc931ec4517affe26860af072e967294656d9e7e83ee687

Download Submit
C:\Users\Admin\AppData\Local\Temp\oXcbxNGKQrep.exe

Filesize
118KB

MD5
a31089dc3cafe77c39268273d689193b

SHA1
032e0b9a0bf012401507be974ee6bdb3e6726fd7

SHA256
ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66

SHA512
d92748b34286c21f4781b147000be1b54cf57e14587517638647b8369ccd01b3ecb00545be0d87d44f9dde6b30a404db2740bf06275dea647efc33eafd65d2f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\oXcbxNGKQrep.exe

Filesize
118KB

MD5
a31089dc3cafe77c39268273d689193b

SHA1
032e0b9a0bf012401507be974ee6bdb3e6726fd7

SHA256
ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66

SHA512
d92748b34286c21f4781b147000be1b54cf57e14587517638647b8369ccd01b3ecb00545be0d87d44f9dde6b30a404db2740bf06275dea647efc33eafd65d2f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp605F.tmp.RYK

Filesize
17.0MB

MD5
3c4324eece49f6c5d6c7e1bbe78c4fee

SHA1
12185fe0ce24ccfb600e2fa4338958413b490725

SHA256
9e4c2bc79ed8a6f93aaa8be9f198c237be4053ab679974bc22a353fad89c36f6

SHA512
c96134c48e39b0e1b4c6fa99cf3e6ed22c57df90b8fd071b81ff5376f76430185091db64d9ed4d60a5ef3d7cf28a6393459bf0fee59151d16d3bc6d26628d5e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp62E0.tmp.RYK

Filesize
17.0MB

MD5
c2cdf8651378e6616f473972c1d61ba1

SHA1
ede692f971ff256a48db8efca4c2917970cbc744

SHA256
7ed5f5347490898a344c38bf9363141c8d915c96d60d6dd66408b08d7c3127eb

SHA512
5dc38a2a9b36080f55982b3dc60ff74537bc71da61e15ace9efb812dde07194b07dfae5b5e1ee22bfd98df4638d57f92e3ad102f0c0497143f280a066f5912d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp646D.tmp.RYK

Filesize
17.0MB

MD5
9066e2c7cc1986df54949c8a9ea03c91

SHA1
c2307a74a6d3734e751b8f86925893cc56d7555a

SHA256
66e2380b688891f3f0492f4c3079e64697863e519d5cc39e9fc623224d053e82

SHA512
398b630e21c266962195534b6787fb1afaa148432768d2e620a4caf013da52f61daf863de6145395881c6072dd0aaa146231d52d268ab1da11e8bbc015e36015

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp66DE.tmp.RYK

Filesize
17.0MB

MD5
598dc832f870f4483bcb561ad70ad6da

SHA1
a671eaf35ca9e8b6c0d87f4ae286bfd87b5eff3b

SHA256
8c98f344dc70d4f7277edc4a95acf802ca758cebcbe5d8ae46cda45f88baa3d7

SHA512
ab6402c95f685b742b5a58086a38a227714683f51a9e82fa47d6041dcf508fc6355995882d38979c365185db7b3ee36aab759fb9be8896ee92d6c481040f9205

Download Submit
C:\Users\RyukReadMe.html

Filesize
1KB

MD5
8398b1f229e0d80c65e262ae92085a90

SHA1
5142f7b7f9dc13ac8a07eac6e1240efa84e3bc8d

SHA256
4e374f86295c56c4c0d57b134d9035377b0d17b6fe418fd790cdfb3f7a9d03b5

SHA512
113b51cb8fcbc1c61161434948aa0297ce2ce889100ab1827d1a7d0a76e65d99e97d590b43911b450cc931ec4517affe26860af072e967294656d9e7e83ee687

Download Submit
C:\odt\RyukReadMe.html

Filesize
1KB

MD5
8398b1f229e0d80c65e262ae92085a90

SHA1
5142f7b7f9dc13ac8a07eac6e1240efa84e3bc8d

SHA256
4e374f86295c56c4c0d57b134d9035377b0d17b6fe418fd790cdfb3f7a9d03b5

SHA512
113b51cb8fcbc1c61161434948aa0297ce2ce889100ab1827d1a7d0a76e65d99e97d590b43911b450cc931ec4517affe26860af072e967294656d9e7e83ee687

Download Submit
C:\odt\config.xml.RYK

Filesize
978B

MD5
b4bd7763108f129ad9c0e4a35b5976b2

SHA1
9bac7561623a2084966e802f95edb0c1346f8f13

SHA256
9be78d1222c2d7fc2a5358a119c5bb3195c516a7613cf902d68397b6cd653b83

SHA512
91a9dcdcfc142c02516b4f914b135ee15a81ee36529c13aa7c031048299de931efb03b25e3a46015785750a6b4cf030368b1feb41f1ad52aeedd58a6aeb64c86

Download Submit
C:\users\Public\RyukReadMe.html

Filesize
1KB

MD5
8398b1f229e0d80c65e262ae92085a90

SHA1
5142f7b7f9dc13ac8a07eac6e1240efa84e3bc8d

SHA256
4e374f86295c56c4c0d57b134d9035377b0d17b6fe418fd790cdfb3f7a9d03b5

SHA512
113b51cb8fcbc1c61161434948aa0297ce2ce889100ab1827d1a7d0a76e65d99e97d590b43911b450cc931ec4517affe26860af072e967294656d9e7e83ee687

Download Submit
memory/1316-166-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/1316-170-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/1316-164-0x0000000000000000-mapping.dmp

Download
memory/1316-167-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/1316-168-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/1316-169-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/1316-175-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/1316-174-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/1316-179-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/1316-178-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/1316-171-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/1316-172-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/1316-177-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/1316-176-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/1708-223-0x0000000000000000-mapping.dmp

Download
memory/2064-132-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/2064-122-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/2064-119-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/2064-120-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/2064-121-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/2064-145-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/2064-156-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/2064-125-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/2064-126-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/2064-127-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/2064-128-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/2064-129-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/2064-130-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/2064-131-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/2064-133-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/2064-118-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/2064-134-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/2064-163-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/2064-162-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/2064-161-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/2064-160-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/2064-159-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/2064-158-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/2064-157-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/2064-124-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/2064-155-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/2064-154-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/2064-153-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/2064-152-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/2064-151-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/2064-150-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/2064-149-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/2064-148-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/2064-147-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/2064-146-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/2064-123-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/2064-144-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/2064-143-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/2064-142-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/2064-141-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/2064-140-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/2064-139-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/2064-138-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/2064-137-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/2064-136-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/2064-135-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/3624-185-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/3624-183-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/3624-186-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/3624-180-0x0000000000000000-mapping.dmp

Download
memory/3624-182-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/3624-184-0x0000000077D40000-0x0000000077ECE000-memory.dmp

Filesize
1.6MB

Download
memory/19640-274-0x0000000000000000-mapping.dmp

Download
memory/19652-275-0x0000000000000000-mapping.dmp

Download
memory/24152-351-0x0000000000000000-mapping.dmp

Download
memory/24512-338-0x0000000000000000-mapping.dmp

Download
memory/40652-339-0x0000000000000000-mapping.dmp

Download
memory/40844-349-0x0000000000000000-mapping.dmp

Download
memory/44744-424-0x0000000000000000-mapping.dmp

Download
memory/45052-423-0x0000000000000000-mapping.dmp

Download
memory/46528-421-0x0000000000000000-mapping.dmp

Download
memory/46540-422-0x0000000000000000-mapping.dmp

Download
memory/182640-553-0x0000000000000000-mapping.dmp

Download
memory/182692-554-0x0000000000000000-mapping.dmp

Download
memory/182700-595-0x0000000000000000-mapping.dmp

Download
memory/183260-594-0x0000000000000000-mapping.dmp

Download
memory/192084-632-0x0000000000000000-mapping.dmp

Download
memory/267852-656-0x0000000000000000-mapping.dmp

Download
memory/267864-657-0x0000000000000000-mapping.dmp

Download
memory/268928-697-0x0000000000000000-mapping.dmp

Download
memory/268944-699-0x0000000000000000-mapping.dmp

Download
memory/336568-978-0x0000000000000000-mapping.dmp

Download
memory/336732-779-0x0000000000000000-mapping.dmp

Download
memory/336740-781-0x0000000000000000-mapping.dmp

Download
memory/336752-1061-0x0000000000000000-mapping.dmp

Download
memory/336808-736-0x0000000000000000-mapping.dmp

Download
memory/336820-742-0x0000000000000000-mapping.dmp

Download
memory/336824-1020-0x0000000000000000-mapping.dmp

Download
memory/336840-940-0x0000000000000000-mapping.dmp

Download
memory/337216-985-0x0000000000000000-mapping.dmp

Download
memory/337432-1101-0x0000000000000000-mapping.dmp

Download
memory/337460-899-0x0000000000000000-mapping.dmp

Download
memory/337460-1024-0x0000000000000000-mapping.dmp

Download
memory/337476-1060-0x0000000000000000-mapping.dmp

Download
memory/337496-1102-0x0000000000000000-mapping.dmp

Download
memory/337588-819-0x0000000000000000-mapping.dmp

Download
memory/337652-939-0x0000000000000000-mapping.dmp

Download
memory/337668-898-0x0000000000000000-mapping.dmp

Download
memory/337720-861-0x0000000000000000-mapping.dmp

Download
memory/337872-859-0x0000000000000000-mapping.dmp

Download
memory/337900-818-0x0000000000000000-mapping.dmp

Download
memory/525244-1140-0x0000000000000000-mapping.dmp

Download
memory/525252-1141-0x0000000000000000-mapping.dmp

Download
memory/529388-1181-0x0000000000000000-mapping.dmp

Download
memory/529400-1183-0x0000000000000000-mapping.dmp

Download
memory/642580-1221-0x0000000000000000-mapping.dmp

Download
memory/642584-1220-0x0000000000000000-mapping.dmp

Download
memory/643624-1261-0x0000000000000000-mapping.dmp

Download
memory/643640-1262-0x0000000000000000-mapping.dmp

Download
memory/713372-1300-0x0000000000000000-mapping.dmp

Download
memory/713380-1301-0x0000000000000000-mapping.dmp

Download
memory/713544-1342-0x0000000000000000-mapping.dmp

Download
memory/714740-1341-0x0000000000000000-mapping.dmp

Download
memory/778624-1380-0x0000000000000000-mapping.dmp

Download
memory/778636-1381-0x0000000000000000-mapping.dmp

Download
memory/779840-1421-0x0000000000000000-mapping.dmp

Download
memory/779852-1422-0x0000000000000000-mapping.dmp

Download
memory/798632-1501-0x0000000000000000-mapping.dmp

Download
memory/798640-1540-0x0000000000000000-mapping.dmp

Download
memory/798852-1541-0x0000000000000000-mapping.dmp

Download
memory/799008-1502-0x0000000000000000-mapping.dmp

Download
memory/799064-1461-0x0000000000000000-mapping.dmp

Download
memory/799160-1460-0x0000000000000000-mapping.dmp

Download