buran | e416fe29a9007d96f7f268aa01d37382ce4581b55d9fae2947df79df34a7e440

Analysis

max time kernel
86s
max time network
44s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-09-2022 15:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1.exe
Size

211KB
MD5

19111728bd752688482ffb91eba51913
SHA1

d3f742f64a6d419b2e96651c9993d60f93bdafa9
SHA256

e416fe29a9007d96f7f268aa01d37382ce4581b55d9fae2947df79df34a7e440
SHA512

a9cb2e7c98a4847e15b1a0dcd675df9b407c46f82fe623e3cdbdc99d7b9d3af2dd76c9b51541da9ea024acd95efcd74c0be8e37584b91d17b8a97f97e24dce2f
SSDEEP

6144:hia1gMHOPDWIhID8X/4DQFu/U3buRKlemZ9DnGAetTsB+g0+:hIMH06cID84DQFu/U3buRKlemZ9DnGAI

Score

10^/10

buran zeppelin persistence ransomware

Malware Config

Extracted

Path

C:\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

Family

buran

Ransom Note

!!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] Your personal ID: 8BC-7AA-942 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Emails

[email protected]

Signatures

Buran
Ransomware-as-a-service based on the VegaLocker family first identified in 2019.
ransomware buran

Detects Zeppelin payload 5 IoCs

resource	yara_rule
behavioral1/files/0x000d0000000054a8-56.dat	family_zeppelin
behavioral1/files/0x000d0000000054a8-55.dat	family_zeppelin
behavioral1/files/0x000d0000000054a8-58.dat	family_zeppelin
behavioral1/files/0x000d0000000054a8-62.dat	family_zeppelin
behavioral1/files/0x000d0000000054a8-64.dat	family_zeppelin

Zeppelin Ransomware
Ransomware-as-a-service (RaaS) written in Delphi and first seen in 2019.
ransomware zeppelin

Executes dropped EXE 2 IoCs

pid	Process
860	lsass.exe
1828	lsass.exe

Modifies extensions of user files 1 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\SkipRename.tiff	lsass.exe

Deletes itself 1 IoCs

pid	Process
1320	notepad.exe

Loads dropped DLL 2 IoCs

pid	Process
1044	1.exe
1044	1.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\lsass.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\lsass.exe\" -start"	1.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run	1.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	lsass.exe
File opened (read-only)	\??\M:	lsass.exe
File opened (read-only)	\??\B:	lsass.exe
File opened (read-only)	\??\W:	lsass.exe
File opened (read-only)	\??\V:	lsass.exe
File opened (read-only)	\??\S:	lsass.exe
File opened (read-only)	\??\N:	lsass.exe
File opened (read-only)	\??\H:	lsass.exe
File opened (read-only)	\??\A:	lsass.exe
File opened (read-only)	\??\X:	lsass.exe
File opened (read-only)	\??\U:	lsass.exe
File opened (read-only)	\??\R:	lsass.exe
File opened (read-only)	\??\E:	lsass.exe
File opened (read-only)	\??\Y:	lsass.exe
File opened (read-only)	\??\P:	lsass.exe
File opened (read-only)	\??\J:	lsass.exe
File opened (read-only)	\??\L:	lsass.exe
File opened (read-only)	\??\K:	lsass.exe
File opened (read-only)	\??\I:	lsass.exe
File opened (read-only)	\??\G:	lsass.exe
File opened (read-only)	\??\F:	lsass.exe
File opened (read-only)	\??\Z:	lsass.exe
File opened (read-only)	\??\T:	lsass.exe
File opened (read-only)	\??\Q:	lsass.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\Vevay.8BC-7AA-942	lsass.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-dialogs.jar	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0281638.WMF	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01361_.WMF	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\PersonalMonthlyBudget.xltx.8BC-7AA-942	lsass.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0197979.WMF	lsass.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-back-static.png	lsass.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Uzhgorod	lsass.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0199609.WMF.8BC-7AA-942	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Horizon.eftx.8BC-7AA-942	lsass.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\es-ES\bckgzm.exe.mui	lsass.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ps\LC_MESSAGES\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT	lsass.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer.8BC-7AA-942	lsass.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\engphon.env	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00165_.GIF.8BC-7AA-942	lsass.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_SelectionSubpicture.png	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00090_.WMF	lsass.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe.8BC-7AA-942	lsass.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-uihandler_ja.jar	lsass.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host.xml	lsass.exe
File created	C:\Program Files\Microsoft Games\FreeCell\fr-FR\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382948.JPG.8BC-7AA-942	lsass.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sampler_ja.jar	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00040_.GIF	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\LOOKUP.DAT.8BC-7AA-942	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\mscss7wre_fr.dub	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_mid.gif	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\COUPON.POC.8BC-7AA-942	lsass.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_performance_Thumbnail.bmp	lsass.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jvmstat.xml.8BC-7AA-942	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0200289.WMF.8BC-7AA-942	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\Priority.accft.8BC-7AA-942	lsass.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP.8BC-7AA-942	lsass.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Boa_Vista	lsass.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder_5.5.0.165303.jar	lsass.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-execution_zh_CN.jar.8BC-7AA-942	lsass.exe
File opened for modification	C:\Program Files\Java\jre7\lib\security\cacerts	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Thatch.thmx	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Concourse.eftx.8BC-7AA-942	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0292982.WMF.8BC-7AA-942	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\WPULQT98.POC	lsass.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-host.jar	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0151581.WMF	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0239057.WMF.8BC-7AA-942	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\OUTGOING.ICO.8BC-7AA-942	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\AIR98.POC.8BC-7AA-942	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\STORYBB.POC	lsass.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Riyadh89	lsass.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\New_York.8BC-7AA-942	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21503_.GIF	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\MSACCESS.HXS	lsass.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-favorites_ja.jar	lsass.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\acro20.lng	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00603_.WMF	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0240695.WMF.8BC-7AA-942	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\MSOSEC.XML	lsass.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT	lsass.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\ja-JP\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\CLIP.WMF.8BC-7AA-942	lsass.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\SketchPadTestSchema.xml.8BC-7AA-942	lsass.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	lsass.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar.8BC-7AA-942	lsass.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1044	1.exe
Token: SeDebugPrivilege	1044	1.exe
Token: SeDebugPrivilege	860	lsass.exe
Token: SeDebugPrivilege	860	lsass.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 860	1044	1.exe	27
PID 1044 wrote to memory of 860	1044	1.exe	27
PID 1044 wrote to memory of 860	1044	1.exe	27
PID 1044 wrote to memory of 860	1044	1.exe	27
PID 1044 wrote to memory of 1320	1044	1.exe	28
PID 1044 wrote to memory of 1320	1044	1.exe	28
PID 1044 wrote to memory of 1320	1044	1.exe	28
PID 1044 wrote to memory of 1320	1044	1.exe	28
PID 1044 wrote to memory of 1320	1044	1.exe	28
PID 1044 wrote to memory of 1320	1044	1.exe	28
PID 1044 wrote to memory of 1320	1044	1.exe	28
PID 860 wrote to memory of 1828	860	lsass.exe	29
PID 860 wrote to memory of 1828	860	lsass.exe	29
PID 860 wrote to memory of 1828	860	lsass.exe	29
PID 860 wrote to memory of 1828	860	lsass.exe	29
PID 860 wrote to memory of 1112	860	lsass.exe	31
PID 860 wrote to memory of 1112	860	lsass.exe	31
PID 860 wrote to memory of 1112	860	lsass.exe	31
PID 860 wrote to memory of 1112	860	lsass.exe	31
PID 860 wrote to memory of 1112	860	lsass.exe	31
PID 860 wrote to memory of 1112	860	lsass.exe	31
PID 860 wrote to memory of 1112	860	lsass.exe	31

C:\Users\Admin\AppData\Local\Temp\1.exe
"C:\Users\Admin\AppData\Local\Temp\1.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe" -start
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:860
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe" -agent 0
    3⤵
    - Executes dropped EXE
    - Modifies extensions of user files
    - Drops file in Program Files directory
    PID:1828
- - C:\Windows\SysWOW64\notepad.exe
    notepad.exe
    3⤵
    PID:1112
- C:\Windows\SysWOW64\notepad.exe
  notepad.exe
  2⤵
  - Deletes itself
  PID:1320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe

Filesize
211KB

MD5
19111728bd752688482ffb91eba51913

SHA1
d3f742f64a6d419b2e96651c9993d60f93bdafa9

SHA256
e416fe29a9007d96f7f268aa01d37382ce4581b55d9fae2947df79df34a7e440

SHA512
a9cb2e7c98a4847e15b1a0dcd675df9b407c46f82fe623e3cdbdc99d7b9d3af2dd76c9b51541da9ea024acd95efcd74c0be8e37584b91d17b8a97f97e24dce2f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe

Filesize
211KB

MD5
19111728bd752688482ffb91eba51913

SHA1
d3f742f64a6d419b2e96651c9993d60f93bdafa9

SHA256
e416fe29a9007d96f7f268aa01d37382ce4581b55d9fae2947df79df34a7e440

SHA512
a9cb2e7c98a4847e15b1a0dcd675df9b407c46f82fe623e3cdbdc99d7b9d3af2dd76c9b51541da9ea024acd95efcd74c0be8e37584b91d17b8a97f97e24dce2f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe

Filesize
211KB

MD5
19111728bd752688482ffb91eba51913

SHA1
d3f742f64a6d419b2e96651c9993d60f93bdafa9

SHA256
e416fe29a9007d96f7f268aa01d37382ce4581b55d9fae2947df79df34a7e440

SHA512
a9cb2e7c98a4847e15b1a0dcd675df9b407c46f82fe623e3cdbdc99d7b9d3af2dd76c9b51541da9ea024acd95efcd74c0be8e37584b91d17b8a97f97e24dce2f

Download Submit
C:\Users\Admin\Desktop\CompareUndo.rtf.8BC-7AA-942

Filesize
528KB

MD5
56f99adf905014e6418e3dcef16adede

SHA1
958a83ae699c9d373a574604137cf08f3b73e0a0

SHA256
b75186879a4a51a93c326e1a58d837e081091cc17cd87a4686b9e6ddb7d09b07

SHA512
3b4942ae0da14d870336c861f94dfd9acb8843a7aba692df849459f4f584bf72a2357430c71acc4348b29d88299d92c9120f79bcef7a36a68dddd0ae9e5571e1

Download Submit
C:\Users\Admin\Desktop\CompleteBackup.avi.8BC-7AA-942

Filesize
256KB

MD5
ec265db8b17a47cfc0843cb0ff6fe2a4

SHA1
f9704ae756b683107811cefe69eb8b16ca544a58

SHA256
59970b887398ba0e846fe0ac2b5dbb1f573b461cdc14b7c32c60bfab27ae2b0a

SHA512
ec701bb6e7aec70b90eec084f0006c2e5e411d387cd2f345f50839d1ce3dd86ae8779ea7eae4cc4af07bd9b2148151490381fad4d0b1bb136746cdc53c796bcd

Download Submit
C:\Users\Admin\Desktop\ConvertEnable.wav.8BC-7AA-942

Filesize
477KB

MD5
64d42cdcc89d5a18bcd2096d4d14817d

SHA1
6e08bffd8844b0c029622c796649100f7c70ca52

SHA256
5c7c265d96361cc8f42ca7aeb9e55d18ec619422acf16b2c326d1c7d8515029a

SHA512
5357cc5558b9cbcf4e5f2f71c2c205d8b84cff1221a9fb38fe7de6ae1f29e5efab90d6231c201d41cbd5be6f0400883c79f516529870ef350413189371518941

Download Submit
C:\Users\Admin\Desktop\ConvertGrant.vbe.8BC-7AA-942

Filesize
239KB

MD5
6340e8970bdbc6c3519dced03a7903c6

SHA1
26a5a670bc102002d9dd2096fe97157b57a9e46c

SHA256
477ee8df2717aeb0ac835c4ca6297cefab4dc808197be38d919e5612e3bf5c9b

SHA512
c59819b8a5a2a16deff8c5ba4b3b2a0b72e808cfbc9aafdd43c672da04736f4ab65f21f39c4f00922b132284268c0d14008714780126b93deaa9fd6c55a73f46

Download Submit
C:\Users\Admin\Desktop\DebugInstall.wav.8BC-7AA-942

Filesize
561KB

MD5
42d4d259f02ddf10847d26aba28af46f

SHA1
3b361ed6b9a938ca5222de7fed22bbebac00b12f

SHA256
9d27ad78e2433512db69af3e8655bf22de6f054f47a4f26e6c133cdad4bfde96

SHA512
e3e66b5f24acd6d3c1baea863510830d51fb1f7c88709de4933e505476fba5bad315ac4c37280d178edaaa275405f8de2fe55d12fcde322a4bbffc35724e80ae

Download Submit
C:\Users\Admin\Desktop\DenyCopy.vdx.8BC-7AA-942

Filesize
629KB

MD5
62459436cec0e8035dd05a9bebd949ae

SHA1
ed7f90992290af1a84cb9c416e24c6d57cd945bb

SHA256
858d091d067a200ac3178172f93795226b8c183c52cffcaf3c5ad84158dc45bd

SHA512
a671ff79cc6ce7f46ace09eb7eb848142645799b2fd4ad20653042c2cd2237ea8adbed4e66fc534c45dfca86612c7e986421555c8a12143c24e5d7d7ca041419

Download Submit
C:\Users\Admin\Desktop\EditWatch.html.8BC-7AA-942

Filesize
663KB

MD5
f6b3089a0bbe0a25aced002cb84c18c9

SHA1
01a11d8b0e54dde08b8b6adbddef0cdbb9ea229c

SHA256
3902377556268dc5029e813076f1d8639ed8d37790ffb6d3ac6ad0a0b4e382d0

SHA512
cf935fbaa170e6a4ab08f93dec9afecc0e0c5be6b7e4e489814c9373989d5cc69962ec13d0c81a0c38a55d1d9ef6dd4bc4bed7d5125018f1612aeb08a1f4c4d1

Download Submit
C:\Users\Admin\Desktop\EnterMount.mov.8BC-7AA-942

Filesize
680KB

MD5
c32b9ab0bc7fc4d97a1b45caae0595b7

SHA1
e3a0ed2e3bbde2d3bba5f4062aee3412e95271fa

SHA256
14d47e8380f2ebe292e231ee49d829f2671d616606f28021d58af88285136fa3

SHA512
5b0c27172256d8c0eb3de3236cd92b0d0c485495af254fe15ed42964dc4d33645b01760a2a96d8d18b5cb98fea1b8b1a476eedebc69cdfd1f8198257031fdeb7

Download Submit
C:\Users\Admin\Desktop\ExitRestart.mp2.8BC-7AA-942

Filesize
307KB

MD5
8c7a2236e589d756deb5a8cbb89375ab

SHA1
dbe8c4143211b122affdde41773a5d28e3271997

SHA256
eb12ae1f5f0d48d65f6b9c10ca2b9adaadb2f1932720a295dab1fbe6be88cec7

SHA512
fd20960d47219a8db33fecc555a656373a2f5d7e600dd976353a4cc3ad9e6465057cbfed4c63a98317dcc52a1bc36fe48c845afd8738b850207ed3f709d96462

Download Submit
C:\Users\Admin\Desktop\FormatMerge.dib.8BC-7AA-942

Filesize
375KB

MD5
15bd1df051088d481f466f092d4da6c3

SHA1
65eb65ed47cae56b0fb0a5ce8f03d23bb4a04d13

SHA256
4d9b8ac6e11037cabbf19549960af6ea2c3d2961e6b01f171f93abef2b701472

SHA512
c54aa54e8267cf0c48bc3d55c3a863b80d4d370e8bc2a2644dec05ba067cec9679e56825ae8bb5c9f174b653bf1aeb5241e6404c5bdb594db17a6031540c8939

Download Submit
C:\Users\Admin\Desktop\FormatUpdate.mpa.8BC-7AA-942

Filesize
392KB

MD5
301192e7f468633ad02e66da4dbe0271

SHA1
98f5d11b2e5b0d40f830c302c5fae12578b61a3b

SHA256
2eb118db16195c85666f31c4f342f0da2910dbac5932f760e837d02c3e902ca1

SHA512
dfc88e50044f3f994a7e2623d9f7ecb74e458acdd7925b5a4629472da9ac247a4469a45bd0df94dbcd8d94df9907dc91561acedb8ee853f42377afcdee4be000

Download Submit
C:\Users\Admin\Desktop\InitializeSplit.odt.8BC-7AA-942

Filesize
341KB

MD5
a5411dd7d6b57cfe7c18657cd698e349

SHA1
f1e66612e5bc0f65596b61d7c44a0e1d0f2d3968

SHA256
e612c48efd0188782b55b9d8e37a957ce6edce93ae55255878b92b5e61f522da

SHA512
fb3350f73a6ee27f3c8c6d3337c1e66c95c1d1d476952a740a059565889ac01241f7662e1ce802cfe9e6c55c347cfe4820d4070b2b328818259939e196c991dd

Download Submit
C:\Users\Admin\Desktop\MeasureRegister.js.8BC-7AA-942

Filesize
511KB

MD5
ea8c81595db4c8cfcf510e2eb79a413a

SHA1
f163a361fcad7a8fa9b58297194d589bfe07c762

SHA256
380f06c1499059cb74655d8603cfd98ef4efa98b8a6fa24ed074595086cd799b

SHA512
4f675611276bcd79a40e165e7ed536215c87f23e4f51d904bd9ef4da4c6a7b04afc49bd58bf951f8511837087c869611092636aecb17ebdd942b9681b0f5fbc5

Download Submit
C:\Users\Admin\Desktop\MergeRequest.wdp.8BC-7AA-942

Filesize
935KB

MD5
f7909504a78e8f242cd8b0c7d71a996d

SHA1
9198bc6e19184d88d7566d0a09838fa3729c1006

SHA256
38ab4a826301a22bcd5859c5573d9a09f0aebae2861236aa74be1134f173fd66

SHA512
6278fa6e9a8ad6fc175628ba1142edca21a05e72b201deb723a4cd40aff641779167de707c951fa0628c7c7ec63eecf99dc6988b58a258a9c03f5ec1395f7572

Download Submit
C:\Users\Admin\Desktop\MoveCompare.wdp.8BC-7AA-942

Filesize
595KB

MD5
7293e01364c346732b4848f257b2807c

SHA1
f64dbf7257b489ed01f9d64593e13be1a3273edf

SHA256
5c951e33a9eb58bb8ac67763ed169c063521a73c016334089b6d5b195943ac90

SHA512
733aff42e1bd80cf48ad64646a800af02dad24096b2d1aaaa70ac9e998f5a19d0be124078b01b97a837e175e9ec3ab668bffbfa6ce955564b295a69fa4b302b2

Download Submit
C:\Users\Admin\Desktop\NewSuspend.tiff.8BC-7AA-942

Filesize
545KB

MD5
5a12ed0cd0a722ece11f8f8ee92357d9

SHA1
11414d0c76fb0bef3ac944b84d9493937b0fe86f

SHA256
73c36c305a12def3010fa31475f19a91b5285ff9e48e724662a8fabcbf653fa7

SHA512
545a2e7956cbfe2d00221ae29295166f320fa1a1b5a568920ae03165039dee31ba010a9a0c8f87cbdce0f3d476d0d8fc9b50624cd9b5cca2606b6dd315017e0a

Download Submit
C:\Users\Admin\Desktop\ProtectDisconnect.mpeg3.8BC-7AA-942

Filesize
578KB

MD5
480cbc23340424a37229c269688c7aac

SHA1
5079a89393647d87dbb1b97e6f01363516d73946

SHA256
ae80bc8b930eb25917ac95ecac187f0de1cc9eaa27e215ac015de37ee90e8257

SHA512
6e897bf19deaab2493fa8922756bdecce390de44c403d926eb229b69ae4e4aa0f0a9f68dc10cf30e405836bea53cd45cb7380c5ba0dfff610e3591853c62526d

Download Submit
C:\Users\Admin\Desktop\RegisterUnlock.xhtml.8BC-7AA-942

Filesize
460KB

MD5
48bb58290cc8cd24fe8e1cbecaacbce8

SHA1
d9cf7af8bcb4b47681791ed5eacab4e11fd29d16

SHA256
05617957d5c8f08a0fb97010e1a5bb85a7360f2b5785ac115fefddfd02e62ac0

SHA512
c3824a80c504a2a77dfd8dab3c2613335ef53be4517d89256bcbe8c33a75559b683350851f4484139be922b37abe91e36f956a37fb29d96449caba27e628c0f2

Download Submit
C:\Users\Admin\Desktop\ResetInstall.cr2.8BC-7AA-942

Filesize
646KB

MD5
d1bab1cd9f7c299bfec3d4bfb726d86c

SHA1
1abc791eacd873efb0b5231c089a9a7f14c3ec2b

SHA256
0ca5f8e56c10d768c84c22d4f464c392b22c286084b67f560bece2f916db7e45

SHA512
4756bcd21222f7ab1620355cb9b392e2f10e41376289f87081fd977dee294c1fc236ae854c75c968dc0177b8fb22fbbe7c65e7e8b2608f3cb7ab2308061f3140

Download Submit
C:\Users\Admin\Desktop\ResumeConnect.asf.8BC-7AA-942

Filesize
612KB

MD5
0f54d627f4284d3f9a1a7d913e0a55f4

SHA1
fb1b637538f10deb00805399f138bbdc43856c4a

SHA256
b1d58480703a97049b32abc66d736ff59b405c25e0981e1ba2057350136d8ffd

SHA512
f8fb3ac96b090be22c6191d4c0c3207a1abd3d7dcdd580f1755eaaea575045b8b0c1bb81c62fa009b1768d6295a93ce0c64557384574cb62e744a7a1ec0d5ae5

Download Submit
C:\Users\Admin\Desktop\RevokeUse.wma.8BC-7AA-942

Filesize
324KB

MD5
ac75cc8b0c7eb75370c3ad53d1d81842

SHA1
c40a05b0d409812caedb1f47daff91f84b9f0d77

SHA256
a83a3e82f4741014d14ed0836bd465b17e9f2331a723e18d0b1abb42e0dd41bc

SHA512
e4234c69e2025a7b9abd7a1d85eeb4cbfbeba4891d7075feaa1867cf4374a4abd1754332c721ab73facedeb218acaf735c7fbd87f8dd00ee595cfadbef2521d0

Download Submit
C:\Users\Admin\Desktop\SearchRequest.raw.8BC-7AA-942

Filesize
358KB

MD5
8403e652270c5d18caa7025bd9f7a97a

SHA1
9f5f6c8e101ada4e4fe1287dd791951e1ea5669f

SHA256
806b73c9ca113d649f2ba6bff410be6cfcc12765645588a1ab0a7a00bddeced8

SHA512
a25475e6c5b9f1f76579f4d809a291aec983a17c6abcf2c2a1811208963e17d7cc3fdc0a6ee853b80a950d4d1e16c94ef302edff56ff427d15abe6574ea99f9b

Download Submit
C:\Users\Admin\Desktop\TraceUpdate.mp3.8BC-7AA-942

Filesize
409KB

MD5
abca8a577754c551ca687c87ab99f217

SHA1
f8e82411b2551a123059fe6b0981b8f6f4fabc3e

SHA256
109dffacb9fdf80031963030d644d3ce99264e74b8388e490992c82745fef2d9

SHA512
f468b2dd586e39da66a673a28ca51b737dfd2ac0336d523202011ca22198236850246eb7bb782486c25cbe8d5bc5efcc8465e8bcedde1445c866f0fa4bbb0e62

Download Submit
C:\Users\Admin\Desktop\UnregisterClose.temp.8BC-7AA-942

Filesize
426KB

MD5
07d978c59aeec4a826a7229c0ef10bfe

SHA1
3707f9d755f68d9a6d9746b6d5e73b99589ccec5

SHA256
1ed52a1369f226159e69cafcabc416d207793a930efb7756530fbf690e8b24fb

SHA512
c17ef171c89b554ca2f29c15e8d82fbc302ceeb082567fdcf1b1afa218b402843b4eb5cd1ec9817255b6a1f52bd3148ab4b5e13b33a3f99ac5e3bb1adff32a6d

Download Submit
C:\Users\Admin\Desktop\UnregisterCompare.3gp.8BC-7AA-942

Filesize
273KB

MD5
61d696910440cc2b433e6225e7e85e00

SHA1
d88964002fd905c4e20aa0f102bdf01ac75a58f7

SHA256
fa169ce0f7ae08d52d8401a5a99f37cadebe3acba3b4f5d04e98b6c6c3c413ed

SHA512
8d87f5909b1bdc07b311260894041ffdff1009317e2ab2391812faa5f5f5829e880c525f6fdd6cf7fcbf2822eb5ba74d8d8f0c9929b387430b377a3268ca2b30

Download Submit
C:\Users\Admin\Desktop\UseWatch.TTS.8BC-7AA-942

Filesize
494KB

MD5
fbf2a7b87115303f98026aed56c395a3

SHA1
074989a6e8ff436925f0515eb87e0a41d1f75aff

SHA256
498a69617a8b7dbbee0c4c65cfcc79e7390ee1ee972ff7b9573d17a15091baa4

SHA512
363a4af551d24f4f35475a5bafddbf68bd66514915ee5063c15e6354a34da04d9e856e2674e50d3676d1f85bb65d3f1df4f9ab3803cd068c397563b4acd9b769

Download Submit
C:\Users\Admin\Desktop\WriteFind.DVR-MS.8BC-7AA-942

Filesize
443KB

MD5
8725f7bac6352b33ddea90930ec59e06

SHA1
943732c80f095c7e6eeaa665c57d189fb6fbaebf

SHA256
90054be5998c23c116876472fc3bba6ce897270a21fb1eaa4bbff525b8d04f34

SHA512
8d034d5d42217710f7e530803f1fd59108e0b744c21ca1c579287a0f6e63d204b1a58f201ea2fa61f2324aaf60fb70bac75930eb61f3ff6593824163ce700d0b

Download Submit
C:\Users\Admin\Desktop\WriteReset.bmp.8BC-7AA-942

Filesize
290KB

MD5
5c153a21c30e8b5885c46fe0c6e5ca1a

SHA1
1dfc537e66e7ade9ed6ef647bafefd9cb4a064c3

SHA256
7f66421312dda7cc98541e7da9a4fcc8f210d0bf71b437a5af83a94fc5908235

SHA512
ac20eb5278a10e0828e3c6a771253f783fb1bb32ecb4bd0ba75a7c741d8fcb4408a425f64b87c2bc8f52ad0bddea49f75bee03dbb26d00ed0aedda1f7fa03322

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe

Filesize
211KB

MD5
19111728bd752688482ffb91eba51913

SHA1
d3f742f64a6d419b2e96651c9993d60f93bdafa9

SHA256
e416fe29a9007d96f7f268aa01d37382ce4581b55d9fae2947df79df34a7e440

SHA512
a9cb2e7c98a4847e15b1a0dcd675df9b407c46f82fe623e3cdbdc99d7b9d3af2dd76c9b51541da9ea024acd95efcd74c0be8e37584b91d17b8a97f97e24dce2f

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\lsass.exe

Filesize
211KB

MD5
19111728bd752688482ffb91eba51913

SHA1
d3f742f64a6d419b2e96651c9993d60f93bdafa9

SHA256
e416fe29a9007d96f7f268aa01d37382ce4581b55d9fae2947df79df34a7e440

SHA512
a9cb2e7c98a4847e15b1a0dcd675df9b407c46f82fe623e3cdbdc99d7b9d3af2dd76c9b51541da9ea024acd95efcd74c0be8e37584b91d17b8a97f97e24dce2f

Download Submit
memory/1044-54-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download