Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

b15624e44e...99.exe

windows7-x64

10

b15624e44e...99.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    45s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    04/10/2022, 06:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b15624e44e6de7f3b360623fef5adf40859226c81cb1ddc2540b4e54461cfa99.exe

  • Size

    70KB

  • MD5

    54d2368d604ac5852507b39ade0941f2

  • SHA1

    6d9e4c37a6c6f9d893e3e8778122a1d466c5954e

  • SHA256

    b15624e44e6de7f3b360623fef5adf40859226c81cb1ddc2540b4e54461cfa99

  • SHA512

    2a0ca14b52aa10f252be724b065154a823aec86b16310d69bdce7e63052edd8c7e4aa510da19e8510a3f1ea08592b65a8471efd44b280401c54c72bc27a8c54e

  • SSDEEP

    768:1iCHI1nffAkGisSQ6KRcJZOYoBudWaDyqzlL49FLdS5yA+jz+CEt+R5nOwekfZUW:1LHIlfH7Q6qRBwWa2qxQFZA+j6wWw+9

Score
10/10
evasionpersistencetrojan

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 16 IoCs
    persistence
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 8 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 8 IoCs
    evasion
  • Windows security bypass 2 TTPs 24 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 16 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 19 IoCs
  • Loads dropped DLL 25 IoCs
  • Windows security modification 2 TTPs 32 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 56 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 36 IoCs
  • Drops file in Windows directory 35 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Control Panel 48 IoCs
    evasion
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Suspicious use of SetWindowsHookEx 20 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\b15624e44e6de7f3b360623fef5adf40859226c81cb1ddc2540b4e54461cfa99.exe
    "C:\Users\Admin\AppData\Local\Temp\b15624e44e6de7f3b360623fef5adf40859226c81cb1ddc2540b4e54461cfa99.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies system executable filetype association
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Windows security bypass
    • Disables RegEdit via registry modification
    • Loads dropped DLL
    • Windows security modification
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1788
    • C:\WINDOWS\SysWOW64\shutdown.exe
      C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1712
    • C:\Windows\Black Hole.exe
      "C:\Windows\Black Hole.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies system executable filetype association
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Adds Run key to start application
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1360
      • C:\WINDOWS\SysWOW64\shutdown.exe
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1076
    • C:\Windows\SysWOW64\Lubang Hitam.exe
      "C:\Windows\system32\Lubang Hitam.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies system executable filetype association
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:320
      • C:\WINDOWS\SysWOW64\shutdown.exe
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:316
      • C:\Windows\Black Hole.exe
        "C:\Windows\Black Hole.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        PID:1692
      • C:\Windows\SysWOW64\Lubang Hitam.exe
        "C:\Windows\system32\Lubang Hitam.exe"
        3⤵
          PID:1936
          • C:\WINDOWS\SysWOW64\shutdown.exe
            C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
            4⤵
              PID:784
          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
            3⤵
              PID:1140
              • C:\WINDOWS\SysWOW64\shutdown.exe
                C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                4⤵
                  PID:1592
              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
                "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
                3⤵
                  PID:1124
                  • C:\WINDOWS\SysWOW64\shutdown.exe
                    C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                    4⤵
                      PID:1428
                  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
                    3⤵
                      PID:1492
                      • C:\WINDOWS\SysWOW64\shutdown.exe
                        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                        4⤵
                          PID:988
                      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
                        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
                        3⤵
                          PID:556
                          • C:\WINDOWS\SysWOW64\shutdown.exe
                            C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                            4⤵
                              PID:1844
                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
                            3⤵
                              PID:472
                              • C:\WINDOWS\SysWOW64\shutdown.exe
                                C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                4⤵
                                  PID:1756
                            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
                              2⤵
                              • Modifies WinLogon for persistence
                              • Modifies system executable filetype association
                              • Modifies visibility of file extensions in Explorer
                              • Modifies visiblity of hidden/system files in Explorer
                              • Windows security bypass
                              • Disables RegEdit via registry modification
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Windows security modification
                              • Adds Run key to start application
                              • Enumerates connected drives
                              • Drops file in System32 directory
                              • Drops file in Windows directory
                              • Modifies Control Panel
                              • Modifies registry class
                              • Suspicious use of SetWindowsHookEx
                              • Suspicious use of WriteProcessMemory
                              • System policy modification
                              PID:848
                              • C:\WINDOWS\SysWOW64\shutdown.exe
                                C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                3⤵
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1296
                              • C:\Windows\Black Hole.exe
                                "C:\Windows\Black Hole.exe"
                                3⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                • Suspicious use of WriteProcessMemory
                                PID:1404
                                • C:\WINDOWS\SysWOW64\shutdown.exe
                                  C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                  4⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1744
                              • C:\Windows\SysWOW64\Lubang Hitam.exe
                                "C:\Windows\system32\Lubang Hitam.exe"
                                3⤵
                                • Executes dropped EXE
                                • Drops file in System32 directory
                                • Drops file in Windows directory
                                • Suspicious use of SetWindowsHookEx
                                • Suspicious use of WriteProcessMemory
                                PID:1952
                                • C:\WINDOWS\SysWOW64\shutdown.exe
                                  C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                  4⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1508
                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                                "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
                                3⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:592
                                • C:\WINDOWS\SysWOW64\shutdown.exe
                                  C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                  4⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:840
                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
                                "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
                                3⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:1268
                                • C:\WINDOWS\SysWOW64\shutdown.exe
                                  C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                  4⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:524
                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                                "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
                                3⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:300
                                • C:\WINDOWS\SysWOW64\shutdown.exe
                                  C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                  4⤵
                                    PID:1764
                                • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
                                  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
                                  3⤵
                                    PID:1620
                                    • C:\WINDOWS\SysWOW64\shutdown.exe
                                      C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                      4⤵
                                        PID:1360
                                    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
                                      3⤵
                                        PID:1180
                                    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
                                      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
                                      2⤵
                                      • Modifies WinLogon for persistence
                                      • Modifies system executable filetype association
                                      • Modifies visibility of file extensions in Explorer
                                      • Modifies visiblity of hidden/system files in Explorer
                                      • Windows security bypass
                                      • Disables RegEdit via registry modification
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Windows security modification
                                      • Adds Run key to start application
                                      • Enumerates connected drives
                                      • Drops file in System32 directory
                                      • Drops file in Windows directory
                                      • Modifies Control Panel
                                      • Modifies registry class
                                      • Suspicious use of SetWindowsHookEx
                                      • Suspicious use of WriteProcessMemory
                                      • System policy modification
                                      PID:672
                                      • C:\WINDOWS\SysWOW64\shutdown.exe
                                        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                        3⤵
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1488
                                      • C:\Windows\Black Hole.exe
                                        "C:\Windows\Black Hole.exe"
                                        3⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        PID:616
                                        • C:\WINDOWS\SysWOW64\shutdown.exe
                                          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                          4⤵
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:564
                                      • C:\Windows\SysWOW64\Lubang Hitam.exe
                                        "C:\Windows\system32\Lubang Hitam.exe"
                                        3⤵
                                        • Executes dropped EXE
                                        • Drops file in System32 directory
                                        • Drops file in Windows directory
                                        • Suspicious use of SetWindowsHookEx
                                        PID:1208
                                        • C:\WINDOWS\SysWOW64\shutdown.exe
                                          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                          4⤵
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1736
                                      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                                        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
                                        3⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        PID:1472
                                        • C:\WINDOWS\SysWOW64\shutdown.exe
                                          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                          4⤵
                                            PID:1584
                                        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
                                          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
                                          3⤵
                                            PID:1492
                                            • C:\WINDOWS\SysWOW64\shutdown.exe
                                              C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                              4⤵
                                                PID:2012
                                            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                                              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
                                              3⤵
                                                PID:1784
                                                • C:\WINDOWS\SysWOW64\shutdown.exe
                                                  C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                  4⤵
                                                    PID:1456
                                                • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
                                                  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
                                                  3⤵
                                                    PID:1268
                                                    • C:\WINDOWS\SysWOW64\shutdown.exe
                                                      C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                      4⤵
                                                        PID:472
                                                    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                                      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
                                                      3⤵
                                                        PID:1556
                                                        • C:\WINDOWS\SysWOW64\shutdown.exe
                                                          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                          4⤵
                                                            PID:1736
                                                      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                                                        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
                                                        2⤵
                                                        • Modifies WinLogon for persistence
                                                        • Modifies system executable filetype association
                                                        • Modifies visibility of file extensions in Explorer
                                                        • Modifies visiblity of hidden/system files in Explorer
                                                        • Windows security bypass
                                                        • Disables RegEdit via registry modification
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Windows security modification
                                                        • Adds Run key to start application
                                                        • Enumerates connected drives
                                                        • Drops file in System32 directory
                                                        • Drops file in Windows directory
                                                        • Modifies Control Panel
                                                        • Modifies registry class
                                                        • Suspicious use of SetWindowsHookEx
                                                        • Suspicious use of WriteProcessMemory
                                                        • System policy modification
                                                        PID:1644
                                                        • C:\WINDOWS\SysWOW64\shutdown.exe
                                                          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                          3⤵
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:1748
                                                        • C:\Windows\Black Hole.exe
                                                          "C:\Windows\Black Hole.exe"
                                                          3⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:1892
                                                          • C:\WINDOWS\SysWOW64\shutdown.exe
                                                            C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                            4⤵
                                                              PID:1792
                                                          • C:\Windows\SysWOW64\Lubang Hitam.exe
                                                            "C:\Windows\system32\Lubang Hitam.exe"
                                                            3⤵
                                                              PID:616
                                                              • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                4⤵
                                                                  PID:1672
                                                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                                                                "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
                                                                3⤵
                                                                  PID:1440
                                                                  • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                    C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                    4⤵
                                                                      PID:840
                                                                  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
                                                                    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
                                                                    3⤵
                                                                      PID:1620
                                                                    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                                                                      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
                                                                      3⤵
                                                                        PID:1504
                                                                        • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                          4⤵
                                                                            PID:1896
                                                                        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
                                                                          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
                                                                          3⤵
                                                                            PID:1848
                                                                            • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                              C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                              4⤵
                                                                                PID:1300
                                                                            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                                                              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
                                                                              3⤵
                                                                                PID:1440
                                                                                • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                  C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                  4⤵
                                                                                    PID:1328
                                                                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
                                                                                "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
                                                                                2⤵
                                                                                • Modifies WinLogon for persistence
                                                                                • Modifies system executable filetype association
                                                                                • Modifies visibility of file extensions in Explorer
                                                                                • Modifies visiblity of hidden/system files in Explorer
                                                                                • Windows security bypass
                                                                                • Disables RegEdit via registry modification
                                                                                • Executes dropped EXE
                                                                                • Loads dropped DLL
                                                                                • Windows security modification
                                                                                • Adds Run key to start application
                                                                                • Enumerates connected drives
                                                                                • Drops file in System32 directory
                                                                                • Drops file in Windows directory
                                                                                • Modifies Control Panel
                                                                                • Modifies registry class
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                • System policy modification
                                                                                PID:1028
                                                                                • C:\Windows\Black Hole.exe
                                                                                  "C:\Windows\Black Hole.exe"
                                                                                  3⤵
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:1184
                                                                                  • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                    C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                    4⤵
                                                                                      PID:432
                                                                                  • C:\Windows\SysWOW64\Lubang Hitam.exe
                                                                                    "C:\Windows\system32\Lubang Hitam.exe"
                                                                                    3⤵
                                                                                      PID:1668
                                                                                      • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                        4⤵
                                                                                          PID:1712
                                                                                      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                                                                                        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
                                                                                        3⤵
                                                                                          PID:1508
                                                                                          • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                            C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                            4⤵
                                                                                              PID:1752
                                                                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
                                                                                            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
                                                                                            3⤵
                                                                                              PID:316
                                                                                              • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                4⤵
                                                                                                  PID:1844
                                                                                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                                                                                                "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
                                                                                                3⤵
                                                                                                  PID:268
                                                                                                  • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                    C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                    4⤵
                                                                                                      PID:1676
                                                                                                  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
                                                                                                    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
                                                                                                    3⤵
                                                                                                      PID:1040
                                                                                                      • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                        4⤵
                                                                                                          PID:1712
                                                                                                      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                                                                                        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
                                                                                                        3⤵
                                                                                                          PID:1428
                                                                                                          • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                            C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                            4⤵
                                                                                                              PID:1456
                                                                                                        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                                                                                          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
                                                                                                          2⤵
                                                                                                          • Modifies WinLogon for persistence
                                                                                                          • Modifies system executable filetype association
                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                          • Modifies visiblity of hidden/system files in Explorer
                                                                                                          • Windows security bypass
                                                                                                          • Disables RegEdit via registry modification
                                                                                                          • Executes dropped EXE
                                                                                                          • Windows security modification
                                                                                                          • Adds Run key to start application
                                                                                                          • Enumerates connected drives
                                                                                                          • Drops file in System32 directory
                                                                                                          • Drops file in Windows directory
                                                                                                          • Modifies Control Panel
                                                                                                          • Modifies registry class
                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                          • System policy modification
                                                                                                          PID:1964
                                                                                                          • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                            C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                            3⤵
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:1648
                                                                                                          • C:\Windows\Black Hole.exe
                                                                                                            "C:\Windows\Black Hole.exe"
                                                                                                            3⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                            PID:1448
                                                                                                            • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                              C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                              4⤵
                                                                                                                PID:776
                                                                                                            • C:\Windows\SysWOW64\Lubang Hitam.exe
                                                                                                              "C:\Windows\system32\Lubang Hitam.exe"
                                                                                                              3⤵
                                                                                                                PID:1488
                                                                                                                • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                  C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                  4⤵
                                                                                                                    PID:1504
                                                                                                                • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                                                                                                                  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
                                                                                                                  3⤵
                                                                                                                    PID:2028
                                                                                                                    • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                      C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                      4⤵
                                                                                                                        PID:1972
                                                                                                                    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
                                                                                                                      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
                                                                                                                      3⤵
                                                                                                                        PID:2008
                                                                                                                      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                                                                                                                        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
                                                                                                                        3⤵
                                                                                                                          PID:1360
                                                                                                                          • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                            C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                            4⤵
                                                                                                                              PID:1448
                                                                                                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
                                                                                                                            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
                                                                                                                            3⤵
                                                                                                                              PID:1516
                                                                                                                              • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                4⤵
                                                                                                                                  PID:1404
                                                                                                                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                                                                                                                "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
                                                                                                                                3⤵
                                                                                                                                  PID:1712
                                                                                                                                  • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                    C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                    4⤵
                                                                                                                                      PID:912
                                                                                                                              • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                1⤵
                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                PID:1900
                                                                                                                              • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                                                                                C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                                                                                1⤵
                                                                                                                                  PID:700

                                                                                                                                Network

                                                                                                                                MITRE ATT&CK Enterprise v6

                                                                                                                                Replay Monitor

                                                                                                                                Loading Replay Monitor...

                                                                                                                                Downloads

                                                                                                                                • C:\Black Hole.exe
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  9c276663e05f575b2b283b3a53c3f0b3

                                                                                                                                  SHA1

                                                                                                                                  b352e903c63372309787d155d1495bf49fdcd90c

                                                                                                                                  SHA256

                                                                                                                                  f1cb6044203e12fa8ede58bc8e63f78aca752f30cdeac6f7da0a8da793ed9761

                                                                                                                                  SHA512

                                                                                                                                  17229bd7917ed267daf6dfca07715b31209815832ef0cbd279e935000f4c6ba885429f7ffe9ca12470c5cac5104141b32c36cb022c7be4f3623c0549757be1ce

                                                                                                                                  Download Submit

                                                                                                                                • C:\Black Hole.exe
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  d03037ca998df2b7bdc59fd14e7644f1

                                                                                                                                  SHA1

                                                                                                                                  973649762754d6c440e522bfe35be773aef56f3a

                                                                                                                                  SHA256

                                                                                                                                  96362b09b5484a5a04efa554b19dad1654e43ce7d9ddf2a5c06256634ff591fe

                                                                                                                                  SHA512

                                                                                                                                  6c73cfa3b199cafd1e00f163d04f65ed6d5dcb9ce5ae2ae81cfc1e122515c05acb7c9e3f8e20cd11bf75226b810c693414d2907b1881ef8cf62eb55f7b32809b

                                                                                                                                  Download Submit

                                                                                                                                • C:\Black Hole.exe
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  eeda622f2487b4c53bd95d7d7b6c9f9a

                                                                                                                                  SHA1

                                                                                                                                  8a4c64c84a82d8200f33e48a6cc647bc2a4bc947

                                                                                                                                  SHA256

                                                                                                                                  ca895fd4f41bd73429e642a18f0458d8042b5ea6b9a4174d67a26a55c11cb015

                                                                                                                                  SHA512

                                                                                                                                  56f885664e91fe65c2b2f79e4d0fd46ff0a4cc775b8d313c0e740e2ba4d9b86577b9a3089ba0c7debdf669b33630e8a2b3fa31aab28601e6b97888dc38c420e2

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  2c98faa8e9cf83cf720a234b966e2f1c

                                                                                                                                  SHA1

                                                                                                                                  3085ce90e810723301a7676401d22636244d79dd

                                                                                                                                  SHA256

                                                                                                                                  4356a338f636cb6a376e1ced9db4d1dd069b0808839f6556e7d61f99d6c6899e

                                                                                                                                  SHA512

                                                                                                                                  e6ccb501f8d1f4f09dfa4203678ae7e96f261c3e642a6ac9d2d3ab02d54b4605b57bf4015df2e8af12aaec6c47f727949b5d3ad00b3b19cb8fedba4793731bf8

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  aecb5c344fce556c4a7c670029573454

                                                                                                                                  SHA1

                                                                                                                                  ff8099934401ec68ca0cdd6d3e2d3dded7b27944

                                                                                                                                  SHA256

                                                                                                                                  bcf8669772aefc5221e1a9def9b7791e8ef4c116222f2d1baf89ad50274b53b4

                                                                                                                                  SHA512

                                                                                                                                  4b10c09f99937c0eb92a9c7ea459a2184a7f8db7f934fca95aa4cd5692e0a907a6516a3d8614612741e4a21c505df859c21c3b2593cb53e435530eedf2d242c1

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  23efd19888ef845ad42fb443ffb1c3df

                                                                                                                                  SHA1

                                                                                                                                  fc7d51852efee493c1c2ce43d81091bbad46ebd8

                                                                                                                                  SHA256

                                                                                                                                  187e4f1a50b32d3248896b2eacc13f774e3e0233880d1b600b1f6bc1337be7f2

                                                                                                                                  SHA512

                                                                                                                                  fec97d04987e23fc4d61fdaafdfbfc3943843879eec2e608aef15033016c8585223066f53031cd6306e3689252eaf1fd0b9d054ee846e3bb550e8c0ce05aa660

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  36a9b4aa1b13e264b3977fa843e27d1c

                                                                                                                                  SHA1

                                                                                                                                  aee82661a7816add1425b5ec78ea6c30064362a0

                                                                                                                                  SHA256

                                                                                                                                  2b846eb4321ef5294836b902e1cdfd6ad53dc6d9a214d2f9b759e6928f5e77d2

                                                                                                                                  SHA512

                                                                                                                                  c159a4f9a61802fd315dfe7917bb0b250a2a087d8d659d6f945ed014fe4baa030ad97323195cfc672ab04de47caab4319efe4a4f2c1b1ad375ed5bc6f872fb6a

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  61a4ddac7035eda039a1d7a74fc748e8

                                                                                                                                  SHA1

                                                                                                                                  cd79fcdeb431447bb01421d5527234f528d3354c

                                                                                                                                  SHA256

                                                                                                                                  354623078c107d60f484d37a9dbfa66eaec6b895b8093667ac8e63c9b47a0307

                                                                                                                                  SHA512

                                                                                                                                  cc635e7598670bea9e37fc9a8d92d217152dffcf752aa51b71a776e409cb0a4086b43ec2a19c30916b970626862131936f4aaa86a18f0efb80fa4d8841af8f93

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  61a4ddac7035eda039a1d7a74fc748e8

                                                                                                                                  SHA1

                                                                                                                                  cd79fcdeb431447bb01421d5527234f528d3354c

                                                                                                                                  SHA256

                                                                                                                                  354623078c107d60f484d37a9dbfa66eaec6b895b8093667ac8e63c9b47a0307

                                                                                                                                  SHA512

                                                                                                                                  cc635e7598670bea9e37fc9a8d92d217152dffcf752aa51b71a776e409cb0a4086b43ec2a19c30916b970626862131936f4aaa86a18f0efb80fa4d8841af8f93

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  2c98faa8e9cf83cf720a234b966e2f1c

                                                                                                                                  SHA1

                                                                                                                                  3085ce90e810723301a7676401d22636244d79dd

                                                                                                                                  SHA256

                                                                                                                                  4356a338f636cb6a376e1ced9db4d1dd069b0808839f6556e7d61f99d6c6899e

                                                                                                                                  SHA512

                                                                                                                                  e6ccb501f8d1f4f09dfa4203678ae7e96f261c3e642a6ac9d2d3ab02d54b4605b57bf4015df2e8af12aaec6c47f727949b5d3ad00b3b19cb8fedba4793731bf8

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.exe
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  aecb5c344fce556c4a7c670029573454

                                                                                                                                  SHA1

                                                                                                                                  ff8099934401ec68ca0cdd6d3e2d3dded7b27944

                                                                                                                                  SHA256

                                                                                                                                  bcf8669772aefc5221e1a9def9b7791e8ef4c116222f2d1baf89ad50274b53b4

                                                                                                                                  SHA512

                                                                                                                                  4b10c09f99937c0eb92a9c7ea459a2184a7f8db7f934fca95aa4cd5692e0a907a6516a3d8614612741e4a21c505df859c21c3b2593cb53e435530eedf2d242c1

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.exe
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  aecb5c344fce556c4a7c670029573454

                                                                                                                                  SHA1

                                                                                                                                  ff8099934401ec68ca0cdd6d3e2d3dded7b27944

                                                                                                                                  SHA256

                                                                                                                                  bcf8669772aefc5221e1a9def9b7791e8ef4c116222f2d1baf89ad50274b53b4

                                                                                                                                  SHA512

                                                                                                                                  4b10c09f99937c0eb92a9c7ea459a2184a7f8db7f934fca95aa4cd5692e0a907a6516a3d8614612741e4a21c505df859c21c3b2593cb53e435530eedf2d242c1

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.exe
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  f1113926030edf4fa417b3d5e489f2f3

                                                                                                                                  SHA1

                                                                                                                                  c75edc1551060e0949286924808483feeda1aaac

                                                                                                                                  SHA256

                                                                                                                                  a3f8672ac91bc3848cfd6f387d1fe8b786c35c2821318b2e56b2b74356fcd3d6

                                                                                                                                  SHA512

                                                                                                                                  d8ddd109c4d05116615df7533fecc317fe811bc4fcfffad661b3a5ad9fb9324c1d829ca2014b902beff6d002a548df56ac9769243997bdcbdd45b2c1a9a6b9a9

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  23efd19888ef845ad42fb443ffb1c3df

                                                                                                                                  SHA1

                                                                                                                                  fc7d51852efee493c1c2ce43d81091bbad46ebd8

                                                                                                                                  SHA256

                                                                                                                                  187e4f1a50b32d3248896b2eacc13f774e3e0233880d1b600b1f6bc1337be7f2

                                                                                                                                  SHA512

                                                                                                                                  fec97d04987e23fc4d61fdaafdfbfc3943843879eec2e608aef15033016c8585223066f53031cd6306e3689252eaf1fd0b9d054ee846e3bb550e8c0ce05aa660

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  23efd19888ef845ad42fb443ffb1c3df

                                                                                                                                  SHA1

                                                                                                                                  fc7d51852efee493c1c2ce43d81091bbad46ebd8

                                                                                                                                  SHA256

                                                                                                                                  187e4f1a50b32d3248896b2eacc13f774e3e0233880d1b600b1f6bc1337be7f2

                                                                                                                                  SHA512

                                                                                                                                  fec97d04987e23fc4d61fdaafdfbfc3943843879eec2e608aef15033016c8585223066f53031cd6306e3689252eaf1fd0b9d054ee846e3bb550e8c0ce05aa660

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  1b3d33d0a5b30db167b3043c8a2d46d7

                                                                                                                                  SHA1

                                                                                                                                  fe0f8add96daa2a488569d28e72a48a9ad486231

                                                                                                                                  SHA256

                                                                                                                                  a0e5d73c4db13457d38b2872b9c1af0c9d54e6d0130c9ce868fc746347fec763

                                                                                                                                  SHA512

                                                                                                                                  861902f6019bdead917cf8ba40adab52792513ee5671331df81832f51aa93d11c5c7a5e435a5ebf2809ec0d9b4d067a2d684d27942ec70a1a50764862b2843b0

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  c93e87e5de11d6250a6e36d846ab2906

                                                                                                                                  SHA1

                                                                                                                                  daea3e722aefb0192da726ed1bea11d21796c7a5

                                                                                                                                  SHA256

                                                                                                                                  1c60bab3fca131a1126fe439c10e1134650c48f10b323a4e0a8e4d23e01d7627

                                                                                                                                  SHA512

                                                                                                                                  78c15183a6f07e79784956fc6eb577a825d4212b7af30ba1970c0b08f51f4a7bca73e2506008564b2ca20338e18e903749da294d38e90273adb255fc652b297a

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  36a9b4aa1b13e264b3977fa843e27d1c

                                                                                                                                  SHA1

                                                                                                                                  aee82661a7816add1425b5ec78ea6c30064362a0

                                                                                                                                  SHA256

                                                                                                                                  2b846eb4321ef5294836b902e1cdfd6ad53dc6d9a214d2f9b759e6928f5e77d2

                                                                                                                                  SHA512

                                                                                                                                  c159a4f9a61802fd315dfe7917bb0b250a2a087d8d659d6f945ed014fe4baa030ad97323195cfc672ab04de47caab4319efe4a4f2c1b1ad375ed5bc6f872fb6a

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  36a9b4aa1b13e264b3977fa843e27d1c

                                                                                                                                  SHA1

                                                                                                                                  aee82661a7816add1425b5ec78ea6c30064362a0

                                                                                                                                  SHA256

                                                                                                                                  2b846eb4321ef5294836b902e1cdfd6ad53dc6d9a214d2f9b759e6928f5e77d2

                                                                                                                                  SHA512

                                                                                                                                  c159a4f9a61802fd315dfe7917bb0b250a2a087d8d659d6f945ed014fe4baa030ad97323195cfc672ab04de47caab4319efe4a4f2c1b1ad375ed5bc6f872fb6a

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  cc92ff10b27107021f6e6376f929b0cf

                                                                                                                                  SHA1

                                                                                                                                  d994b985956c69b676c90a9e4079deb6c2a360e5

                                                                                                                                  SHA256

                                                                                                                                  55719544b1cedd11733c5b9e043f0432866a630be94d67f4b7049bb43a0f87ef

                                                                                                                                  SHA512

                                                                                                                                  332c0aac177dfd627bd6743d8b572300a6ee3c94c37c2f9454bc1b4277657d0227bed3f44f0e9cb32ede6648c9567e789e45ff2e660840b734026178f17b7351

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  61a4ddac7035eda039a1d7a74fc748e8

                                                                                                                                  SHA1

                                                                                                                                  cd79fcdeb431447bb01421d5527234f528d3354c

                                                                                                                                  SHA256

                                                                                                                                  354623078c107d60f484d37a9dbfa66eaec6b895b8093667ac8e63c9b47a0307

                                                                                                                                  SHA512

                                                                                                                                  cc635e7598670bea9e37fc9a8d92d217152dffcf752aa51b71a776e409cb0a4086b43ec2a19c30916b970626862131936f4aaa86a18f0efb80fa4d8841af8f93

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\All Users\Start Menu\Programs\Startup\Zero Code.pif
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  7363a0fec13135979d923ecccab38c68

                                                                                                                                  SHA1

                                                                                                                                  97f642342dc048a9a59c9c988fbc8625a7ff8f94

                                                                                                                                  SHA256

                                                                                                                                  32510923ccbbf0d5075682a4fdc56c89a2bc26c32840f2727212defa86d4f643

                                                                                                                                  SHA512

                                                                                                                                  50da531e9e127bda0d18a5682e6f3ba38593b927bf196438e2d15713eb2349da83b057ee80ab351063f2426059768a089e9bb092f7722972d35d9355c661c19c

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\All Users\Start Menu\Programs\Startup\Zero Code.pif
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  d0e6ac775b10d7f70798734a86aa941e

                                                                                                                                  SHA1

                                                                                                                                  70cf60edb5b5b43ee535a2ed95b10e60eef27c53

                                                                                                                                  SHA256

                                                                                                                                  a5139def5e7fa299199f93e1d000633851e2f8d40a33bfa136fb61183834c0ae

                                                                                                                                  SHA512

                                                                                                                                  76ce9c1ea27f3947a54e2c1ad7fe3265c6c9bcfb73ebdba363c8399369f1111e35e8390be0ea08b582de0dc41ad9f52ee927cc9f3ea07b4d99a4ae1ac7923f29

                                                                                                                                  Download Submit

                                                                                                                                • C:\Users\All Users\Start Menu\Programs\Startup\Zero Code.pif
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  df50d1321dcdf363ef5ab29ff75bdf13

                                                                                                                                  SHA1

                                                                                                                                  696b18ca8cc5cfc202cbe252a21a3be3e6847ce3

                                                                                                                                  SHA256

                                                                                                                                  059f509594c2d1d8e3925231cb79c4fffdc30693a6076dae81fdd99ee393e4e0

                                                                                                                                  SHA512

                                                                                                                                  3bf5f992a1ec1ef505fbe4c78d14b8ab5bd7838258effb50e5c22d0a24498e554a62008729dcb9c448c05e16625489bd151f4b0528e889fe27df1343b27a3304

                                                                                                                                  Download Submit

                                                                                                                                • C:\WINDOWS\Black Hole.txt
                                                                                                                                  Filesize

                                                                                                                                  1KB

                                                                                                                                  MD5

                                                                                                                                  6635e047c242e6d64b2716d81095bf5f

                                                                                                                                  SHA1

                                                                                                                                  5def5300f894e58bbb0caaa94680f7735ccd248d

                                                                                                                                  SHA256

                                                                                                                                  9757b4f406657c44fcbd40757d1ae06e833a8e1542ca976e6ae63578031b32bf

                                                                                                                                  SHA512

                                                                                                                                  c9bae9bf090e7c67fac53d061bb43c2091e991c8f568889463d0c1af8f48652c79c51785c0906705098b418b2d7a4b200580fb44091ecf8bf24d8b1b45a258c0

                                                                                                                                  Download Submit

                                                                                                                                • C:\WINDOWS\Black Hole.txt
                                                                                                                                  Filesize

                                                                                                                                  1KB

                                                                                                                                  MD5

                                                                                                                                  6635e047c242e6d64b2716d81095bf5f

                                                                                                                                  SHA1

                                                                                                                                  5def5300f894e58bbb0caaa94680f7735ccd248d

                                                                                                                                  SHA256

                                                                                                                                  9757b4f406657c44fcbd40757d1ae06e833a8e1542ca976e6ae63578031b32bf

                                                                                                                                  SHA512

                                                                                                                                  c9bae9bf090e7c67fac53d061bb43c2091e991c8f568889463d0c1af8f48652c79c51785c0906705098b418b2d7a4b200580fb44091ecf8bf24d8b1b45a258c0

                                                                                                                                  Download Submit

                                                                                                                                • C:\WINDOWS\Black Hole.txt
                                                                                                                                  Filesize

                                                                                                                                  1KB

                                                                                                                                  MD5

                                                                                                                                  6635e047c242e6d64b2716d81095bf5f

                                                                                                                                  SHA1

                                                                                                                                  5def5300f894e58bbb0caaa94680f7735ccd248d

                                                                                                                                  SHA256

                                                                                                                                  9757b4f406657c44fcbd40757d1ae06e833a8e1542ca976e6ae63578031b32bf

                                                                                                                                  SHA512

                                                                                                                                  c9bae9bf090e7c67fac53d061bb43c2091e991c8f568889463d0c1af8f48652c79c51785c0906705098b418b2d7a4b200580fb44091ecf8bf24d8b1b45a258c0

                                                                                                                                  Download Submit

                                                                                                                                • C:\WINDOWS\Hacked By Gerry.txt
                                                                                                                                  Filesize

                                                                                                                                  1KB

                                                                                                                                  MD5

                                                                                                                                  e067dafcbe64a95f5045a281397732db

                                                                                                                                  SHA1

                                                                                                                                  1af7095f98c486ca247449980000d06b04ffc50c

                                                                                                                                  SHA256

                                                                                                                                  b6085ee8c1f2de574973b9f3a7417257e25573c2b5228b5a8f87e3788e2733b6

                                                                                                                                  SHA512

                                                                                                                                  1b575d62fee219538f8d624ab833cbce0aee431559a0adfa1e3ce9cd4f5ab8a2887b394843ebf164c884ccbed5687d644474328471b23c28edba8f99ccf08b58

                                                                                                                                  Download Submit

                                                                                                                                • C:\WINDOWS\Hacked By Gerry.txt
                                                                                                                                  Filesize

                                                                                                                                  1KB

                                                                                                                                  MD5

                                                                                                                                  e067dafcbe64a95f5045a281397732db

                                                                                                                                  SHA1

                                                                                                                                  1af7095f98c486ca247449980000d06b04ffc50c

                                                                                                                                  SHA256

                                                                                                                                  b6085ee8c1f2de574973b9f3a7417257e25573c2b5228b5a8f87e3788e2733b6

                                                                                                                                  SHA512

                                                                                                                                  1b575d62fee219538f8d624ab833cbce0aee431559a0adfa1e3ce9cd4f5ab8a2887b394843ebf164c884ccbed5687d644474328471b23c28edba8f99ccf08b58

                                                                                                                                  Download Submit

                                                                                                                                • C:\WINDOWS\Hacked By Gerry.txt
                                                                                                                                  Filesize

                                                                                                                                  1KB

                                                                                                                                  MD5

                                                                                                                                  e067dafcbe64a95f5045a281397732db

                                                                                                                                  SHA1

                                                                                                                                  1af7095f98c486ca247449980000d06b04ffc50c

                                                                                                                                  SHA256

                                                                                                                                  b6085ee8c1f2de574973b9f3a7417257e25573c2b5228b5a8f87e3788e2733b6

                                                                                                                                  SHA512

                                                                                                                                  1b575d62fee219538f8d624ab833cbce0aee431559a0adfa1e3ce9cd4f5ab8a2887b394843ebf164c884ccbed5687d644474328471b23c28edba8f99ccf08b58

                                                                                                                                  Download Submit

                                                                                                                                • C:\Windows\Black Hole.exe
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  f0b54e59014ab5b53dc5a683520545e4

                                                                                                                                  SHA1

                                                                                                                                  854581e4b37a0d382cac0797fbfa57252b2e86ee

                                                                                                                                  SHA256

                                                                                                                                  35b6f53ed2d57c0da5666d44f53c3b85074632c1115df51ea77a63945aa27225

                                                                                                                                  SHA512

                                                                                                                                  f0c2a9b1642775782e7c2880cc8bc0a8584c9753a7865905c9d3f187cd76e6a55d4a34a223408ea88b67ac2ee9d9b6e41b8dcc24285ac3c2f7aa34190eba2af9

                                                                                                                                  Download Submit

                                                                                                                                • C:\Windows\Black Hole.exe
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  f0b54e59014ab5b53dc5a683520545e4

                                                                                                                                  SHA1

                                                                                                                                  854581e4b37a0d382cac0797fbfa57252b2e86ee

                                                                                                                                  SHA256

                                                                                                                                  35b6f53ed2d57c0da5666d44f53c3b85074632c1115df51ea77a63945aa27225

                                                                                                                                  SHA512

                                                                                                                                  f0c2a9b1642775782e7c2880cc8bc0a8584c9753a7865905c9d3f187cd76e6a55d4a34a223408ea88b67ac2ee9d9b6e41b8dcc24285ac3c2f7aa34190eba2af9

                                                                                                                                  Download Submit

                                                                                                                                • C:\Windows\Black Hole.exe
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  f0b54e59014ab5b53dc5a683520545e4

                                                                                                                                  SHA1

                                                                                                                                  854581e4b37a0d382cac0797fbfa57252b2e86ee

                                                                                                                                  SHA256

                                                                                                                                  35b6f53ed2d57c0da5666d44f53c3b85074632c1115df51ea77a63945aa27225

                                                                                                                                  SHA512

                                                                                                                                  f0c2a9b1642775782e7c2880cc8bc0a8584c9753a7865905c9d3f187cd76e6a55d4a34a223408ea88b67ac2ee9d9b6e41b8dcc24285ac3c2f7aa34190eba2af9

                                                                                                                                  Download Submit

                                                                                                                                • C:\Windows\Black Hole.exe
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  f0b54e59014ab5b53dc5a683520545e4

                                                                                                                                  SHA1

                                                                                                                                  854581e4b37a0d382cac0797fbfa57252b2e86ee

                                                                                                                                  SHA256

                                                                                                                                  35b6f53ed2d57c0da5666d44f53c3b85074632c1115df51ea77a63945aa27225

                                                                                                                                  SHA512

                                                                                                                                  f0c2a9b1642775782e7c2880cc8bc0a8584c9753a7865905c9d3f187cd76e6a55d4a34a223408ea88b67ac2ee9d9b6e41b8dcc24285ac3c2f7aa34190eba2af9

                                                                                                                                  Download Submit

                                                                                                                                • C:\Windows\Black Hole.exe
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  1df24b70e33d0da987992ca512192623

                                                                                                                                  SHA1

                                                                                                                                  a3ddfef06c4ff66cde86ac78a1d33b3be91f4474

                                                                                                                                  SHA256

                                                                                                                                  96f5bdb155217af2cc97e4b11fcca31356fff3b4ba8cb059ca5e8b6c7e343653

                                                                                                                                  SHA512

                                                                                                                                  626d9d363e1bafdede468d7e8c98766ffb3a94aea5b31ab4a50347f5b938c94683d3012888532620968532ae1c63040d1bf72eff894b2dac31bf4fbad3c326b6

                                                                                                                                  Download Submit

                                                                                                                                • C:\Windows\Black Hole.exe
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  1df24b70e33d0da987992ca512192623

                                                                                                                                  SHA1

                                                                                                                                  a3ddfef06c4ff66cde86ac78a1d33b3be91f4474

                                                                                                                                  SHA256

                                                                                                                                  96f5bdb155217af2cc97e4b11fcca31356fff3b4ba8cb059ca5e8b6c7e343653

                                                                                                                                  SHA512

                                                                                                                                  626d9d363e1bafdede468d7e8c98766ffb3a94aea5b31ab4a50347f5b938c94683d3012888532620968532ae1c63040d1bf72eff894b2dac31bf4fbad3c326b6

                                                                                                                                  Download Submit

                                                                                                                                • C:\Windows\MSVBVM60.DLL
                                                                                                                                  Filesize

                                                                                                                                  1.3MB

                                                                                                                                  MD5

                                                                                                                                  5343a19c618bc515ceb1695586c6c137

                                                                                                                                  SHA1

                                                                                                                                  4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                                                                                                                                  SHA256

                                                                                                                                  2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                                                                                                                                  SHA512

                                                                                                                                  708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                                                                                                                                  Download Submit

                                                                                                                                • C:\Windows\SysWOW64\Destruction.scr
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  e7dee02a3ca7ee21c70d91cb7b134fcc

                                                                                                                                  SHA1

                                                                                                                                  f0caa8595a6415ba46898120cf81cf598c4a35c6

                                                                                                                                  SHA256

                                                                                                                                  47ee4b6444b360e306612e6495c47859fe7aca756c76da067564229f2c598274

                                                                                                                                  SHA512

                                                                                                                                  691a81937760232c1c954c95a12cfec99bc1ab9aae0ec661e2a045f67e2e53a735bf0c5dfe571f87875451a188808bd8a97b381eb362ebbe86d4cfc8808c5ed4

                                                                                                                                  Download Submit

                                                                                                                                • C:\Windows\SysWOW64\Destruction.scr
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  d177bc82a34ffe5d5c8efc8512e2f2ae

                                                                                                                                  SHA1

                                                                                                                                  8700134f1b6275f24cad0fc57c90f5da86e65c74

                                                                                                                                  SHA256

                                                                                                                                  21d7da35e8c526aa295ef0d913e47cad1c635e7922f711619a079a7736909710

                                                                                                                                  SHA512

                                                                                                                                  4d7d2b750d3c8768ac25aa1b5b68dea15eda544be3a9113f8483b9b11142983adaa646f3dc665e87e86deb94be4e0176dcd01d961d8dcb96cb3237e605eac403

                                                                                                                                  Download Submit

                                                                                                                                • C:\Windows\SysWOW64\Destruction.scr
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  4d1df807fbdea1da495f4671b83c5939

                                                                                                                                  SHA1

                                                                                                                                  77bc33a848fd1a332d98022e5dfbf5052519fc1a

                                                                                                                                  SHA256

                                                                                                                                  51e42f07339c0fbee95d9cde005b742dc13b5dfbb9edf4a363f24c6a0b1a33e1

                                                                                                                                  SHA512

                                                                                                                                  791326d49e79dc477ce57f1c9578c4ff862dffa70375c1c6be1a99bc12fb4fb3f6e603ac2d15cdae953d90b8b62ccf37f4b662bd48f2acbf46faa8e03ae82587

                                                                                                                                  Download Submit

                                                                                                                                • C:\Windows\SysWOW64\Lubang Hitam.exe
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  a8a9e6e98d3ef86aaaf3167b2db6bb21

                                                                                                                                  SHA1

                                                                                                                                  7241b210fdbd65241fe2241b6452aec500f36c44

                                                                                                                                  SHA256

                                                                                                                                  11098d6536c2b1b5f21c6415a853cd933d9d59690e121adb803ec116a3628ff1

                                                                                                                                  SHA512

                                                                                                                                  39b14b23a2e5069155f69cfa920b2302db794f5a0f628d527a7012e82e7fe87f47a09b94db6f808c6245d9f86a644a5566dc4317412c20b5608be013404e3f16

                                                                                                                                  Download Submit

                                                                                                                                • C:\Windows\SysWOW64\Lubang Hitam.exe
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  a8a9e6e98d3ef86aaaf3167b2db6bb21

                                                                                                                                  SHA1

                                                                                                                                  7241b210fdbd65241fe2241b6452aec500f36c44

                                                                                                                                  SHA256

                                                                                                                                  11098d6536c2b1b5f21c6415a853cd933d9d59690e121adb803ec116a3628ff1

                                                                                                                                  SHA512

                                                                                                                                  39b14b23a2e5069155f69cfa920b2302db794f5a0f628d527a7012e82e7fe87f47a09b94db6f808c6245d9f86a644a5566dc4317412c20b5608be013404e3f16

                                                                                                                                  Download Submit

                                                                                                                                • C:\Windows\SysWOW64\Lubang Hitam.exe
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  a8a9e6e98d3ef86aaaf3167b2db6bb21

                                                                                                                                  SHA1

                                                                                                                                  7241b210fdbd65241fe2241b6452aec500f36c44

                                                                                                                                  SHA256

                                                                                                                                  11098d6536c2b1b5f21c6415a853cd933d9d59690e121adb803ec116a3628ff1

                                                                                                                                  SHA512

                                                                                                                                  39b14b23a2e5069155f69cfa920b2302db794f5a0f628d527a7012e82e7fe87f47a09b94db6f808c6245d9f86a644a5566dc4317412c20b5608be013404e3f16

                                                                                                                                  Download Submit

                                                                                                                                • C:\Windows\SysWOW64\Lubang Hitam.exe
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  a8a9e6e98d3ef86aaaf3167b2db6bb21

                                                                                                                                  SHA1

                                                                                                                                  7241b210fdbd65241fe2241b6452aec500f36c44

                                                                                                                                  SHA256

                                                                                                                                  11098d6536c2b1b5f21c6415a853cd933d9d59690e121adb803ec116a3628ff1

                                                                                                                                  SHA512

                                                                                                                                  39b14b23a2e5069155f69cfa920b2302db794f5a0f628d527a7012e82e7fe87f47a09b94db6f808c6245d9f86a644a5566dc4317412c20b5608be013404e3f16

                                                                                                                                  Download Submit

                                                                                                                                • C:\Windows\SysWOW64\Shell.exe
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  c5471ebc6d7e889fab871118f4f3fc42

                                                                                                                                  SHA1

                                                                                                                                  d636d046fece3097421f125aac306439abee86b6

                                                                                                                                  SHA256

                                                                                                                                  249d66a9b67c5d7b093bc4a79d241d85ce6eb33d296457f86d0f30d6d78e9aa7

                                                                                                                                  SHA512

                                                                                                                                  3247a1a8942cb420e3e246a4ca4920c5f4df168a1583e15cc0612712699edc05aaa8a41a04a6416e077a9c9cd3c7aa76603a312336a845c3bda6adb1228df1da

                                                                                                                                  Download Submit

                                                                                                                                • C:\Windows\SysWOW64\Shell.exe
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  c9f385944a7a123b0e20520feaf71f4e

                                                                                                                                  SHA1

                                                                                                                                  3581dea2b1e0ff9888e79a056f74b0b4d8d98bea

                                                                                                                                  SHA256

                                                                                                                                  2f88d309fe192dccb0f3c28e000f625423f9df865c7f19d21688bedb96291787

                                                                                                                                  SHA512

                                                                                                                                  cc75406810cdbe6de92b2a6c789e2e60aa6c7ff556437d363b7152da3a86921772808ad41c93bdf225104f77a384b18d3e97d1fcd910f2632b67627fa8234292

                                                                                                                                  Download Submit

                                                                                                                                • C:\Windows\SysWOW64\Shell.exe
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  4e0ab9774f471a498dd59b6dfd00278c

                                                                                                                                  SHA1

                                                                                                                                  272c3c7c24b6d9fee3a732de4783326c283bbfe9

                                                                                                                                  SHA256

                                                                                                                                  3dbc76f415e149c44acf3d2977916f92b96face745caa8f5ef6177131860a645

                                                                                                                                  SHA512

                                                                                                                                  2e96d7c7cc05d8da6652c982dd930c74ddf22eb46968a7f7a4aea1d22fa8d4548d3b5b19f95c323fa5c6af1f2192a355f2d9fc682c95e53de7301ea775229ebf

                                                                                                                                  Download Submit

                                                                                                                                • \Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  2c98faa8e9cf83cf720a234b966e2f1c

                                                                                                                                  SHA1

                                                                                                                                  3085ce90e810723301a7676401d22636244d79dd

                                                                                                                                  SHA256

                                                                                                                                  4356a338f636cb6a376e1ced9db4d1dd069b0808839f6556e7d61f99d6c6899e

                                                                                                                                  SHA512

                                                                                                                                  e6ccb501f8d1f4f09dfa4203678ae7e96f261c3e642a6ac9d2d3ab02d54b4605b57bf4015df2e8af12aaec6c47f727949b5d3ad00b3b19cb8fedba4793731bf8

                                                                                                                                  Download Submit

                                                                                                                                • \Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  2c98faa8e9cf83cf720a234b966e2f1c

                                                                                                                                  SHA1

                                                                                                                                  3085ce90e810723301a7676401d22636244d79dd

                                                                                                                                  SHA256

                                                                                                                                  4356a338f636cb6a376e1ced9db4d1dd069b0808839f6556e7d61f99d6c6899e

                                                                                                                                  SHA512

                                                                                                                                  e6ccb501f8d1f4f09dfa4203678ae7e96f261c3e642a6ac9d2d3ab02d54b4605b57bf4015df2e8af12aaec6c47f727949b5d3ad00b3b19cb8fedba4793731bf8

                                                                                                                                  Download Submit

                                                                                                                                • \Users\Admin\AppData\Local\WINDOWS\LSASS.EXE
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  aecb5c344fce556c4a7c670029573454

                                                                                                                                  SHA1

                                                                                                                                  ff8099934401ec68ca0cdd6d3e2d3dded7b27944

                                                                                                                                  SHA256

                                                                                                                                  bcf8669772aefc5221e1a9def9b7791e8ef4c116222f2d1baf89ad50274b53b4

                                                                                                                                  SHA512

                                                                                                                                  4b10c09f99937c0eb92a9c7ea459a2184a7f8db7f934fca95aa4cd5692e0a907a6516a3d8614612741e4a21c505df859c21c3b2593cb53e435530eedf2d242c1

                                                                                                                                  Download Submit

                                                                                                                                • \Users\Admin\AppData\Local\WINDOWS\LSASS.EXE
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  aecb5c344fce556c4a7c670029573454

                                                                                                                                  SHA1

                                                                                                                                  ff8099934401ec68ca0cdd6d3e2d3dded7b27944

                                                                                                                                  SHA256

                                                                                                                                  bcf8669772aefc5221e1a9def9b7791e8ef4c116222f2d1baf89ad50274b53b4

                                                                                                                                  SHA512

                                                                                                                                  4b10c09f99937c0eb92a9c7ea459a2184a7f8db7f934fca95aa4cd5692e0a907a6516a3d8614612741e4a21c505df859c21c3b2593cb53e435530eedf2d242c1

                                                                                                                                  Download Submit

                                                                                                                                • \Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  23efd19888ef845ad42fb443ffb1c3df

                                                                                                                                  SHA1

                                                                                                                                  fc7d51852efee493c1c2ce43d81091bbad46ebd8

                                                                                                                                  SHA256

                                                                                                                                  187e4f1a50b32d3248896b2eacc13f774e3e0233880d1b600b1f6bc1337be7f2

                                                                                                                                  SHA512

                                                                                                                                  fec97d04987e23fc4d61fdaafdfbfc3943843879eec2e608aef15033016c8585223066f53031cd6306e3689252eaf1fd0b9d054ee846e3bb550e8c0ce05aa660

                                                                                                                                  Download Submit

                                                                                                                                • \Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  23efd19888ef845ad42fb443ffb1c3df

                                                                                                                                  SHA1

                                                                                                                                  fc7d51852efee493c1c2ce43d81091bbad46ebd8

                                                                                                                                  SHA256

                                                                                                                                  187e4f1a50b32d3248896b2eacc13f774e3e0233880d1b600b1f6bc1337be7f2

                                                                                                                                  SHA512

                                                                                                                                  fec97d04987e23fc4d61fdaafdfbfc3943843879eec2e608aef15033016c8585223066f53031cd6306e3689252eaf1fd0b9d054ee846e3bb550e8c0ce05aa660

                                                                                                                                  Download Submit

                                                                                                                                • \Users\Admin\AppData\Local\WINDOWS\SMSS.EXE
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  36a9b4aa1b13e264b3977fa843e27d1c

                                                                                                                                  SHA1

                                                                                                                                  aee82661a7816add1425b5ec78ea6c30064362a0

                                                                                                                                  SHA256

                                                                                                                                  2b846eb4321ef5294836b902e1cdfd6ad53dc6d9a214d2f9b759e6928f5e77d2

                                                                                                                                  SHA512

                                                                                                                                  c159a4f9a61802fd315dfe7917bb0b250a2a087d8d659d6f945ed014fe4baa030ad97323195cfc672ab04de47caab4319efe4a4f2c1b1ad375ed5bc6f872fb6a

                                                                                                                                  Download Submit

                                                                                                                                • \Users\Admin\AppData\Local\WINDOWS\SMSS.EXE
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  36a9b4aa1b13e264b3977fa843e27d1c

                                                                                                                                  SHA1

                                                                                                                                  aee82661a7816add1425b5ec78ea6c30064362a0

                                                                                                                                  SHA256

                                                                                                                                  2b846eb4321ef5294836b902e1cdfd6ad53dc6d9a214d2f9b759e6928f5e77d2

                                                                                                                                  SHA512

                                                                                                                                  c159a4f9a61802fd315dfe7917bb0b250a2a087d8d659d6f945ed014fe4baa030ad97323195cfc672ab04de47caab4319efe4a4f2c1b1ad375ed5bc6f872fb6a

                                                                                                                                  Download Submit

                                                                                                                                • \Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  61a4ddac7035eda039a1d7a74fc748e8

                                                                                                                                  SHA1

                                                                                                                                  cd79fcdeb431447bb01421d5527234f528d3354c

                                                                                                                                  SHA256

                                                                                                                                  354623078c107d60f484d37a9dbfa66eaec6b895b8093667ac8e63c9b47a0307

                                                                                                                                  SHA512

                                                                                                                                  cc635e7598670bea9e37fc9a8d92d217152dffcf752aa51b71a776e409cb0a4086b43ec2a19c30916b970626862131936f4aaa86a18f0efb80fa4d8841af8f93

                                                                                                                                  Download Submit

                                                                                                                                • \Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  61a4ddac7035eda039a1d7a74fc748e8

                                                                                                                                  SHA1

                                                                                                                                  cd79fcdeb431447bb01421d5527234f528d3354c

                                                                                                                                  SHA256

                                                                                                                                  354623078c107d60f484d37a9dbfa66eaec6b895b8093667ac8e63c9b47a0307

                                                                                                                                  SHA512

                                                                                                                                  cc635e7598670bea9e37fc9a8d92d217152dffcf752aa51b71a776e409cb0a4086b43ec2a19c30916b970626862131936f4aaa86a18f0efb80fa4d8841af8f93

                                                                                                                                  Download Submit

                                                                                                                                • \Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  61a4ddac7035eda039a1d7a74fc748e8

                                                                                                                                  SHA1

                                                                                                                                  cd79fcdeb431447bb01421d5527234f528d3354c

                                                                                                                                  SHA256

                                                                                                                                  354623078c107d60f484d37a9dbfa66eaec6b895b8093667ac8e63c9b47a0307

                                                                                                                                  SHA512

                                                                                                                                  cc635e7598670bea9e37fc9a8d92d217152dffcf752aa51b71a776e409cb0a4086b43ec2a19c30916b970626862131936f4aaa86a18f0efb80fa4d8841af8f93

                                                                                                                                  Download Submit

                                                                                                                                • \Windows\SysWOW64\Lubang Hitam.exe
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  a8a9e6e98d3ef86aaaf3167b2db6bb21

                                                                                                                                  SHA1

                                                                                                                                  7241b210fdbd65241fe2241b6452aec500f36c44

                                                                                                                                  SHA256

                                                                                                                                  11098d6536c2b1b5f21c6415a853cd933d9d59690e121adb803ec116a3628ff1

                                                                                                                                  SHA512

                                                                                                                                  39b14b23a2e5069155f69cfa920b2302db794f5a0f628d527a7012e82e7fe87f47a09b94db6f808c6245d9f86a644a5566dc4317412c20b5608be013404e3f16

                                                                                                                                  Download Submit

                                                                                                                                • \Windows\SysWOW64\Lubang Hitam.exe
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  a8a9e6e98d3ef86aaaf3167b2db6bb21

                                                                                                                                  SHA1

                                                                                                                                  7241b210fdbd65241fe2241b6452aec500f36c44

                                                                                                                                  SHA256

                                                                                                                                  11098d6536c2b1b5f21c6415a853cd933d9d59690e121adb803ec116a3628ff1

                                                                                                                                  SHA512

                                                                                                                                  39b14b23a2e5069155f69cfa920b2302db794f5a0f628d527a7012e82e7fe87f47a09b94db6f808c6245d9f86a644a5566dc4317412c20b5608be013404e3f16

                                                                                                                                  Download Submit

                                                                                                                                • \Windows\SysWOW64\Lubang Hitam.exe
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  a8a9e6e98d3ef86aaaf3167b2db6bb21

                                                                                                                                  SHA1

                                                                                                                                  7241b210fdbd65241fe2241b6452aec500f36c44

                                                                                                                                  SHA256

                                                                                                                                  11098d6536c2b1b5f21c6415a853cd933d9d59690e121adb803ec116a3628ff1

                                                                                                                                  SHA512

                                                                                                                                  39b14b23a2e5069155f69cfa920b2302db794f5a0f628d527a7012e82e7fe87f47a09b94db6f808c6245d9f86a644a5566dc4317412c20b5608be013404e3f16

                                                                                                                                  Download Submit

                                                                                                                                • \Windows\SysWOW64\Lubang Hitam.exe
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  a8a9e6e98d3ef86aaaf3167b2db6bb21

                                                                                                                                  SHA1

                                                                                                                                  7241b210fdbd65241fe2241b6452aec500f36c44

                                                                                                                                  SHA256

                                                                                                                                  11098d6536c2b1b5f21c6415a853cd933d9d59690e121adb803ec116a3628ff1

                                                                                                                                  SHA512

                                                                                                                                  39b14b23a2e5069155f69cfa920b2302db794f5a0f628d527a7012e82e7fe87f47a09b94db6f808c6245d9f86a644a5566dc4317412c20b5608be013404e3f16

                                                                                                                                  Download Submit

                                                                                                                                • \Windows\SysWOW64\Lubang Hitam.exe
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  a8a9e6e98d3ef86aaaf3167b2db6bb21

                                                                                                                                  SHA1

                                                                                                                                  7241b210fdbd65241fe2241b6452aec500f36c44

                                                                                                                                  SHA256

                                                                                                                                  11098d6536c2b1b5f21c6415a853cd933d9d59690e121adb803ec116a3628ff1

                                                                                                                                  SHA512

                                                                                                                                  39b14b23a2e5069155f69cfa920b2302db794f5a0f628d527a7012e82e7fe87f47a09b94db6f808c6245d9f86a644a5566dc4317412c20b5608be013404e3f16

                                                                                                                                  Download Submit

                                                                                                                                • \Windows\SysWOW64\Lubang Hitam.exe
                                                                                                                                  Filesize

                                                                                                                                  70KB

                                                                                                                                  MD5

                                                                                                                                  a8a9e6e98d3ef86aaaf3167b2db6bb21

                                                                                                                                  SHA1

                                                                                                                                  7241b210fdbd65241fe2241b6452aec500f36c44

                                                                                                                                  SHA256

                                                                                                                                  11098d6536c2b1b5f21c6415a853cd933d9d59690e121adb803ec116a3628ff1

                                                                                                                                  SHA512

                                                                                                                                  39b14b23a2e5069155f69cfa920b2302db794f5a0f628d527a7012e82e7fe87f47a09b94db6f808c6245d9f86a644a5566dc4317412c20b5608be013404e3f16

                                                                                                                                  Download Submit

                                                                                                                                • memory/300-234-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/300-241-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/316-300-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/320-120-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/592-196-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/616-182-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/616-257-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/672-222-0x0000000002550000-0x00000000025BC000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/672-226-0x0000000002550000-0x00000000025BC000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/672-269-0x0000000002550000-0x00000000025BC000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/672-320-0x0000000002550000-0x00000000025BC000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/672-122-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/672-311-0x0000000002550000-0x00000000025BC000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/672-312-0x0000000002550000-0x00000000025BC000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/848-232-0x0000000002BC0000-0x0000000002C2C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/848-121-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/848-274-0x0000000002BC0000-0x0000000002C2C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/848-273-0x0000000002BC0000-0x0000000002C2C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/848-313-0x0000000002BC0000-0x0000000002C2C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/848-309-0x0000000002BC0000-0x0000000002C2C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/848-192-0x0000000002BC0000-0x0000000002C2C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/848-230-0x0000000002BC0000-0x0000000002C2C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/1028-272-0x0000000002760000-0x00000000027CC000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/1028-318-0x0000000002760000-0x00000000027CC000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/1028-266-0x00000000025B0000-0x000000000261C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/1028-268-0x0000000002760000-0x00000000027CC000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/1028-270-0x00000000025B0000-0x000000000261C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/1028-194-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/1028-315-0x0000000002760000-0x00000000027CC000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/1180-308-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/1184-229-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/1184-225-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/1208-202-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/1208-195-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/1268-199-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/1268-215-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/1360-70-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/1404-125-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/1404-137-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/1448-235-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/1472-231-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/1472-228-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/1488-259-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/1492-263-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/1508-283-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/1508-275-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/1620-265-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/1644-193-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/1644-314-0x0000000002760000-0x00000000027CC000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/1644-224-0x0000000002760000-0x00000000027CC000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/1644-319-0x0000000002760000-0x00000000027CC000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/1668-255-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/1692-123-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/1784-295-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/1788-54-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/1788-58-0x0000000075B11000-0x0000000075B13000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  8KB

                                                                                                                                  Download

                                                                                                                                • memory/1788-119-0x0000000002C90000-0x0000000002CFC000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/1788-118-0x0000000002C90000-0x0000000002CFC000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/1892-227-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/1952-147-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/1964-198-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/1964-316-0x00000000024F0000-0x000000000255C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/1964-267-0x00000000024F0000-0x000000000255C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/1964-233-0x00000000024F0000-0x000000000255C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download

                                                                                                                                • memory/2028-317-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  432KB

                                                                                                                                  Download