Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

b15624e44e...99.exe

windows7-x64

10

b15624e44e...99.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    162s
  • max time network
    182s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/10/2022, 06:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b15624e44e6de7f3b360623fef5adf40859226c81cb1ddc2540b4e54461cfa99.exe

  • Size

    70KB

  • MD5

    54d2368d604ac5852507b39ade0941f2

  • SHA1

    6d9e4c37a6c6f9d893e3e8778122a1d466c5954e

  • SHA256

    b15624e44e6de7f3b360623fef5adf40859226c81cb1ddc2540b4e54461cfa99

  • SHA512

    2a0ca14b52aa10f252be724b065154a823aec86b16310d69bdce7e63052edd8c7e4aa510da19e8510a3f1ea08592b65a8471efd44b280401c54c72bc27a8c54e

  • SSDEEP

    768:1iCHI1nffAkGisSQ6KRcJZOYoBudWaDyqzlL49FLdS5yA+jz+CEt+R5nOwekfZUW:1LHIlfH7Q6qRBwWa2qxQFZA+j6wWw+9

Score
10/10
evasionpersistencetrojan

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 20 IoCs
    persistence
  • Modifies system executable filetype association 2 TTPs 64 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 10 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 10 IoCs
    evasion
  • Windows security bypass 2 TTPs 30 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 20 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Executes dropped EXE 62 IoCs
  • Loads dropped DLL 8 IoCs
  • Windows security modification 2 TTPs 40 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 64 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 2 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Windows directory 55 IoCs
  • Modifies Control Panel 60 IoCs
    evasion
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\b15624e44e6de7f3b360623fef5adf40859226c81cb1ddc2540b4e54461cfa99.exe
    "C:\Users\Admin\AppData\Local\Temp\b15624e44e6de7f3b360623fef5adf40859226c81cb1ddc2540b4e54461cfa99.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies system executable filetype association
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Windows security bypass
    • Disables RegEdit via registry modification
    • Windows security modification
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1696
    • C:\WINDOWS\SysWOW64\shutdown.exe
      C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1904
    • C:\Windows\Black Hole.exe
      "C:\Windows\Black Hole.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies system executable filetype association
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Adds Run key to start application
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:216
      • C:\WINDOWS\SysWOW64\shutdown.exe
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4304
    • C:\Windows\SysWOW64\Lubang Hitam.exe
      "C:\Windows\system32\Lubang Hitam.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies system executable filetype association
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Windows security modification
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies Control Panel
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:5072
      • C:\WINDOWS\SysWOW64\shutdown.exe
        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:724
      • C:\Windows\Black Hole.exe
        "C:\Windows\Black Hole.exe"
        3⤵
        • Modifies WinLogon for persistence
        • Modifies system executable filetype association
        • Modifies visibility of file extensions in Explorer
        • Modifies visiblity of hidden/system files in Explorer
        • Windows security bypass
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Windows security modification
        • Adds Run key to start application
        • Enumerates connected drives
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Modifies Control Panel
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:5016
        • C:\WINDOWS\SysWOW64\shutdown.exe
          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4100
        • C:\Windows\Black Hole.exe
          "C:\Windows\Black Hole.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          PID:8
          • C:\WINDOWS\SysWOW64\shutdown.exe
            C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
            5⤵
              PID:3088
          • C:\Windows\SysWOW64\Lubang Hitam.exe
            "C:\Windows\system32\Lubang Hitam.exe"
            4⤵
            • Executes dropped EXE
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:216
            • C:\WINDOWS\SysWOW64\shutdown.exe
              C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
              5⤵
                PID:2156
            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
              4⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:3780
              • C:\WINDOWS\SysWOW64\shutdown.exe
                C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                5⤵
                  PID:456
              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
                "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
                4⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:2208
                • C:\WINDOWS\SysWOW64\shutdown.exe
                  C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                  5⤵
                    PID:800
                • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
                  4⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1824
                  • C:\WINDOWS\SysWOW64\shutdown.exe
                    C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                    5⤵
                      PID:1248
                  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
                    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
                    4⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:5036
                    • C:\WINDOWS\SysWOW64\shutdown.exe
                      C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                      5⤵
                        PID:2476
                    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
                      4⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:4944
                      • C:\WINDOWS\SysWOW64\shutdown.exe
                        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                        5⤵
                          PID:1492
                    • C:\Windows\SysWOW64\Lubang Hitam.exe
                      "C:\Windows\system32\Lubang Hitam.exe"
                      3⤵
                        PID:4808
                        • C:\WINDOWS\SysWOW64\shutdown.exe
                          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                          4⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3516
                      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
                        3⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:3604
                        • C:\WINDOWS\SysWOW64\shutdown.exe
                          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                          4⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3176
                      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
                        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
                        3⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:2296
                        • C:\WINDOWS\SysWOW64\shutdown.exe
                          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                          4⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1908
                      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
                        3⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:4072
                        • C:\WINDOWS\SysWOW64\shutdown.exe
                          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                          4⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2516
                      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
                        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
                        3⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:1452
                        • C:\WINDOWS\SysWOW64\shutdown.exe
                          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                          4⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1660
                    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
                      2⤵
                      • Modifies WinLogon for persistence
                      • Modifies system executable filetype association
                      • Modifies visibility of file extensions in Explorer
                      • Modifies visiblity of hidden/system files in Explorer
                      • Windows security bypass
                      • Disables RegEdit via registry modification
                      • Executes dropped EXE
                      • Windows security modification
                      • Adds Run key to start application
                      • Enumerates connected drives
                      • Drops file in System32 directory
                      • Drops file in Windows directory
                      • Modifies Control Panel
                      • Modifies registry class
                      • Suspicious use of SetWindowsHookEx
                      • Suspicious use of WriteProcessMemory
                      • System policy modification
                      PID:4840
                      • C:\WINDOWS\SysWOW64\shutdown.exe
                        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                        3⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4928
                      • C:\Windows\Black Hole.exe
                        "C:\Windows\Black Hole.exe"
                        3⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Suspicious use of SetWindowsHookEx
                        PID:1168
                        • C:\WINDOWS\SysWOW64\shutdown.exe
                          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                          4⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4728
                      • C:\Windows\SysWOW64\Lubang Hitam.exe
                        "C:\Windows\system32\Lubang Hitam.exe"
                        3⤵
                        • Modifies WinLogon for persistence
                        • Modifies system executable filetype association
                        • Modifies visibility of file extensions in Explorer
                        • Modifies visiblity of hidden/system files in Explorer
                        • Windows security bypass
                        • Disables RegEdit via registry modification
                        • Executes dropped EXE
                        • Windows security modification
                        • Adds Run key to start application
                        • Enumerates connected drives
                        • Drops file in System32 directory
                        • Drops file in Windows directory
                        • Modifies Control Panel
                        • Modifies registry class
                        • Suspicious behavior: GetForegroundWindowSpam
                        • Suspicious use of SetWindowsHookEx
                        • System policy modification
                        PID:4552
                        • C:\WINDOWS\SysWOW64\shutdown.exe
                          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                          4⤵
                            PID:216
                          • C:\Windows\Black Hole.exe
                            "C:\Windows\Black Hole.exe"
                            4⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Suspicious use of SetWindowsHookEx
                            PID:3416
                            • C:\WINDOWS\SysWOW64\shutdown.exe
                              C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                              5⤵
                                PID:2164
                            • C:\Windows\SysWOW64\Lubang Hitam.exe
                              "C:\Windows\system32\Lubang Hitam.exe"
                              4⤵
                              • Executes dropped EXE
                              • Drops file in System32 directory
                              • Drops file in Windows directory
                              • Suspicious use of SetWindowsHookEx
                              PID:3940
                              • C:\WINDOWS\SysWOW64\shutdown.exe
                                C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                5⤵
                                  PID:4020
                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                                "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
                                4⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:4480
                                • C:\WINDOWS\SysWOW64\shutdown.exe
                                  C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                  5⤵
                                    PID:332
                                • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
                                  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
                                  4⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4240
                                  • C:\WINDOWS\SysWOW64\shutdown.exe
                                    C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                    5⤵
                                      PID:1528
                                  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                                    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
                                    4⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:3552
                                    • C:\WINDOWS\SysWOW64\shutdown.exe
                                      C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                      5⤵
                                        PID:4036
                                    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
                                      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
                                      4⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:1556
                                      • C:\WINDOWS\SysWOW64\shutdown.exe
                                        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                        5⤵
                                          PID:3684
                                      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
                                        4⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        PID:2376
                                        • C:\WINDOWS\SysWOW64\shutdown.exe
                                          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                          5⤵
                                            PID:4540
                                      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                                        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
                                        3⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        PID:3896
                                      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
                                        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
                                        3⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        PID:3440
                                        • C:\WINDOWS\SysWOW64\shutdown.exe
                                          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                          4⤵
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1456
                                      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                                        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
                                        3⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        PID:2348
                                        • C:\WINDOWS\SysWOW64\shutdown.exe
                                          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                          4⤵
                                            PID:3976
                                        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
                                          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
                                          3⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetWindowsHookEx
                                          PID:1756
                                          • C:\WINDOWS\SysWOW64\shutdown.exe
                                            C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                            4⤵
                                              PID:5012
                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
                                            3⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            PID:4996
                                            • C:\WINDOWS\SysWOW64\shutdown.exe
                                              C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                              4⤵
                                                PID:3224
                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
                                            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
                                            2⤵
                                            • Modifies WinLogon for persistence
                                            • Modifies system executable filetype association
                                            • Modifies visibility of file extensions in Explorer
                                            • Modifies visiblity of hidden/system files in Explorer
                                            • Windows security bypass
                                            • Disables RegEdit via registry modification
                                            • Executes dropped EXE
                                            • Windows security modification
                                            • Adds Run key to start application
                                            • Enumerates connected drives
                                            • Drops file in System32 directory
                                            • Drops file in Windows directory
                                            • Modifies Control Panel
                                            • Modifies registry class
                                            • Suspicious use of SetWindowsHookEx
                                            • Suspicious use of WriteProcessMemory
                                            • System policy modification
                                            PID:2072
                                            • C:\WINDOWS\SysWOW64\shutdown.exe
                                              C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                              3⤵
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:2212
                                            • C:\Windows\Black Hole.exe
                                              "C:\Windows\Black Hole.exe"
                                              3⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Suspicious use of SetWindowsHookEx
                                              PID:3648
                                              • C:\WINDOWS\SysWOW64\shutdown.exe
                                                C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                4⤵
                                                  PID:2572
                                              • C:\Windows\SysWOW64\Lubang Hitam.exe
                                                "C:\Windows\system32\Lubang Hitam.exe"
                                                3⤵
                                                • Executes dropped EXE
                                                • Drops file in System32 directory
                                                • Drops file in Windows directory
                                                • Suspicious use of SetWindowsHookEx
                                                PID:3156
                                                • C:\WINDOWS\SysWOW64\shutdown.exe
                                                  C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                  4⤵
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:1808
                                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                                                "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
                                                3⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                PID:2320
                                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
                                                "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
                                                3⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                PID:4568
                                                • C:\WINDOWS\SysWOW64\shutdown.exe
                                                  C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                  4⤵
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:764
                                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                                                "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
                                                3⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                PID:3188
                                                • C:\WINDOWS\SysWOW64\shutdown.exe
                                                  C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                  4⤵
                                                    PID:384
                                                • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
                                                  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
                                                  3⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:4220
                                                  • C:\WINDOWS\SysWOW64\shutdown.exe
                                                    C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                    4⤵
                                                      PID:5044
                                                  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                                    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
                                                    3⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:3520
                                                    • C:\WINDOWS\SysWOW64\shutdown.exe
                                                      C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                      4⤵
                                                        PID:3600
                                                  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                                                    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
                                                    2⤵
                                                    • Modifies WinLogon for persistence
                                                    • Modifies system executable filetype association
                                                    • Modifies visibility of file extensions in Explorer
                                                    • Modifies visiblity of hidden/system files in Explorer
                                                    • Windows security bypass
                                                    • Disables RegEdit via registry modification
                                                    • Executes dropped EXE
                                                    • Windows security modification
                                                    • Adds Run key to start application
                                                    • Enumerates connected drives
                                                    • Drops file in System32 directory
                                                    • Drops file in Windows directory
                                                    • Modifies Control Panel
                                                    • Modifies registry class
                                                    • Suspicious use of SetWindowsHookEx
                                                    • Suspicious use of WriteProcessMemory
                                                    • System policy modification
                                                    PID:2724
                                                    • C:\WINDOWS\SysWOW64\shutdown.exe
                                                      C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                      3⤵
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:3632
                                                    • C:\Windows\Black Hole.exe
                                                      "C:\Windows\Black Hole.exe"
                                                      3⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:4144
                                                      • C:\WINDOWS\SysWOW64\shutdown.exe
                                                        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                        4⤵
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:224
                                                    • C:\Windows\SysWOW64\Lubang Hitam.exe
                                                      "C:\Windows\system32\Lubang Hitam.exe"
                                                      3⤵
                                                        PID:2332
                                                        • C:\WINDOWS\SysWOW64\shutdown.exe
                                                          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                          4⤵
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:4512
                                                      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                                                        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
                                                        3⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:4672
                                                        • C:\WINDOWS\SysWOW64\shutdown.exe
                                                          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                          4⤵
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:1972
                                                      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
                                                        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
                                                        3⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:4352
                                                        • C:\WINDOWS\SysWOW64\shutdown.exe
                                                          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                          4⤵
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:2804
                                                      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                                                        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
                                                        3⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:4872
                                                        • C:\WINDOWS\SysWOW64\shutdown.exe
                                                          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                          4⤵
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:2572
                                                      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
                                                        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
                                                        3⤵
                                                        • Executes dropped EXE
                                                        • Drops file in System32 directory
                                                        • Drops file in Windows directory
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:2332
                                                        • C:\WINDOWS\SysWOW64\shutdown.exe
                                                          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                          4⤵
                                                            PID:448
                                                        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                                          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
                                                          3⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:3176
                                                          • C:\WINDOWS\SysWOW64\shutdown.exe
                                                            C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                            4⤵
                                                              PID:3440
                                                        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
                                                          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
                                                          2⤵
                                                          • Modifies WinLogon for persistence
                                                          • Modifies system executable filetype association
                                                          • Modifies visibility of file extensions in Explorer
                                                          • Modifies visiblity of hidden/system files in Explorer
                                                          • Windows security bypass
                                                          • Disables RegEdit via registry modification
                                                          • Executes dropped EXE
                                                          • Windows security modification
                                                          • Adds Run key to start application
                                                          • Enumerates connected drives
                                                          • Drops file in System32 directory
                                                          • Drops file in Windows directory
                                                          • Modifies Control Panel
                                                          • Modifies registry class
                                                          • Suspicious use of SetWindowsHookEx
                                                          • Suspicious use of WriteProcessMemory
                                                          • System policy modification
                                                          PID:1500
                                                          • C:\WINDOWS\SysWOW64\shutdown.exe
                                                            C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                            3⤵
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:3800
                                                          • C:\Windows\Black Hole.exe
                                                            "C:\Windows\Black Hole.exe"
                                                            3⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            PID:4860
                                                            • C:\WINDOWS\SysWOW64\shutdown.exe
                                                              C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                              4⤵
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:480
                                                          • C:\Windows\SysWOW64\Lubang Hitam.exe
                                                            "C:\Windows\system32\Lubang Hitam.exe"
                                                            3⤵
                                                            • Executes dropped EXE
                                                            • Drops file in System32 directory
                                                            • Drops file in Windows directory
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:220
                                                            • C:\WINDOWS\SysWOW64\shutdown.exe
                                                              C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                              4⤵
                                                                PID:3788
                                                            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                                                              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
                                                              3⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:2004
                                                              • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                4⤵
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:4948
                                                                • C:\Windows\System32\Conhost.exe
                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                  5⤵
                                                                  • Executes dropped EXE
                                                                  • Drops file in Windows directory
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:4808
                                                            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
                                                              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
                                                              3⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:2052
                                                              • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                4⤵
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:3680
                                                            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
                                                              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
                                                              3⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:3924
                                                              • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                4⤵
                                                                  PID:5060
                                                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                                                                "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
                                                                3⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:1768
                                                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                                                "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
                                                                3⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:3788
                                                                • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                  C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                  4⤵
                                                                    PID:4820
                                                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                                                "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
                                                                2⤵
                                                                • Modifies WinLogon for persistence
                                                                • Modifies system executable filetype association
                                                                • Modifies visibility of file extensions in Explorer
                                                                • Modifies visiblity of hidden/system files in Explorer
                                                                • Windows security bypass
                                                                • Disables RegEdit via registry modification
                                                                • Executes dropped EXE
                                                                • Windows security modification
                                                                • Adds Run key to start application
                                                                • Enumerates connected drives
                                                                • Drops file in System32 directory
                                                                • Drops file in Windows directory
                                                                • Modifies Control Panel
                                                                • Modifies registry class
                                                                • Suspicious use of SetWindowsHookEx
                                                                • Suspicious use of WriteProcessMemory
                                                                • System policy modification
                                                                PID:3444
                                                                • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                  C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                  3⤵
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:1892
                                                                • C:\Windows\Black Hole.exe
                                                                  "C:\Windows\Black Hole.exe"
                                                                  3⤵
                                                                  • Executes dropped EXE
                                                                  • Loads dropped DLL
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:4916
                                                                  • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                    C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                    4⤵
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:876
                                                                • C:\Windows\SysWOW64\Lubang Hitam.exe
                                                                  "C:\Windows\system32\Lubang Hitam.exe"
                                                                  3⤵
                                                                  • Executes dropped EXE
                                                                  • Drops file in System32 directory
                                                                  • Drops file in Windows directory
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:3380
                                                                  • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                    C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                    4⤵
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:3528
                                                                • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                                                                  "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
                                                                  3⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:2084
                                                                  • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                    C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                    4⤵
                                                                      PID:4436
                                                                  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                                                                    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
                                                                    3⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:4448
                                                                    • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                      C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                      4⤵
                                                                        PID:2288
                                                                    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
                                                                      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE"
                                                                      3⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:1900
                                                                    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
                                                                      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE"
                                                                      3⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:4392
                                                                      • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                        4⤵
                                                                          PID:4568
                                                                      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                                                        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE"
                                                                        3⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:4588
                                                                        • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                          C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                          4⤵
                                                                            PID:3976
                                                                    • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                      C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                      1⤵
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:4592
                                                                    • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                      C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                      1⤵
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:4228
                                                                    • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                      C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                      1⤵
                                                                        PID:1980
                                                                      • C:\WINDOWS\SysWOW64\shutdown.exe
                                                                        C:\WINDOWS\system32\shutdown.exe -s -f -t 3600 -c An Error Occured. System Not Found!
                                                                        1⤵
                                                                          PID:956

                                                                        Network

                                                                        MITRE ATT&CK Enterprise v6

                                                                        Replay Monitor

                                                                        Loading Replay Monitor...

                                                                        Downloads

                                                                        • C:\Black Hole.exe
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          645ab6af99062e3f0f1c21519cf9c526

                                                                          SHA1

                                                                          6e4bd854b4113dbc16b63c90956d14506d3dd26a

                                                                          SHA256

                                                                          c78bfe00ad27975cc49c6921b72269dce6cba4db16057c370e8a7277ca5fd3ac

                                                                          SHA512

                                                                          708b0870ddbb79473f1f6ac058708b89ed50b490d3d0623396b0054ac1e15c1946c6a8688ebfa658e21fb50a1973c11eec55f461fa40190dc735a2f015f115f0

                                                                          Download Submit

                                                                        • C:\Black Hole.exe
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          b6bc048a4736e9242ef8cab049d6d16a

                                                                          SHA1

                                                                          bc8b6b98b9e92d1718cf5020e7d127dc33f7e042

                                                                          SHA256

                                                                          e9af6b22ebbd9385c749396b661a089d447249079f597bcdc830c508ca00f737

                                                                          SHA512

                                                                          73780a20247c5d25559e5cb46d88beefe760830239abcf4e06a1da99c0d6a08495e618c4723588e5945d3796688b7e556be4a4a92b34f0de51479d5a9d17bcb5

                                                                          Download Submit

                                                                        • C:\Black Hole.exe
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          f487551786741d31752c5af0d9b76d4f

                                                                          SHA1

                                                                          4236180b1490225db0798a4e31a5462844c1eda8

                                                                          SHA256

                                                                          677d2e33728c7d476e5136d77474125af9088b0ff7ade95e67cf49625b4df72c

                                                                          SHA512

                                                                          97008201d2132f654759eebfcf7021665ad4232f04e69d1bbdd25e1753dca168b996a601ecd05f786121228522bf3fd0d56047e26fb431864620f6ff2b50d18a

                                                                          Download Submit

                                                                        • C:\Black Hole.exe
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          d1d52ff3ae93be79112b9f1987fbe6fe

                                                                          SHA1

                                                                          efd61f65d5464c7ac669fbf0e212bee5c412b7e3

                                                                          SHA256

                                                                          b23a95d1e44627c5443760150a808b6af2278af7eadee303c9e2c35bf6f6c4bc

                                                                          SHA512

                                                                          6fda8109104cb60321393000a92618330ee98e1833936dd2b0bc4e2ad5efadee80c626be22fd935a71e5a8591688e19e7063c01994e84dd363eb47667d17dc92

                                                                          Download Submit

                                                                        • C:\Black Hole.exe
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          d1d52ff3ae93be79112b9f1987fbe6fe

                                                                          SHA1

                                                                          efd61f65d5464c7ac669fbf0e212bee5c412b7e3

                                                                          SHA256

                                                                          b23a95d1e44627c5443760150a808b6af2278af7eadee303c9e2c35bf6f6c4bc

                                                                          SHA512

                                                                          6fda8109104cb60321393000a92618330ee98e1833936dd2b0bc4e2ad5efadee80c626be22fd935a71e5a8591688e19e7063c01994e84dd363eb47667d17dc92

                                                                          Download Submit

                                                                        • C:\Black Hole.exe
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          6cd6a622338a4c9d3f0521526342e129

                                                                          SHA1

                                                                          1261562ad4f56a8b014b17fb11beb96241a5d1f3

                                                                          SHA256

                                                                          f90ac10cf777ecd5b967bee6a48c7eaacc677427074aad9755dc46c2339c36de

                                                                          SHA512

                                                                          8a4bdc1e1b1ad4d0d9d0e5e29a00ec971cf9fe49f45b8bc0ac9c3c3fe0f0c668506130ef1b6f3673ab3cf974fe8784ced257b12673dae9684d711bb8a5597774

                                                                          Download Submit

                                                                        • C:\Black Hole.exe
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          555891f4871e48e025e887ce5b70c845

                                                                          SHA1

                                                                          536792c94d94a8a8d341cf6bde4db13d3dc96886

                                                                          SHA256

                                                                          5af482f9dfcfbce4cc465fa576e9b193698671a1e2bd4ddc5ba6f92008a1f27a

                                                                          SHA512

                                                                          3998bf855cca12fa0f5b1d776747bd6a59346a0acfcb07ad1c43d09c32f5075eaf4af18aa46d9a6da9556eab2a22b76749e3ba0bcbfdf10142d0b0bd7db74388

                                                                          Download Submit

                                                                        • C:\Black Hole.exe
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          555891f4871e48e025e887ce5b70c845

                                                                          SHA1

                                                                          536792c94d94a8a8d341cf6bde4db13d3dc96886

                                                                          SHA256

                                                                          5af482f9dfcfbce4cc465fa576e9b193698671a1e2bd4ddc5ba6f92008a1f27a

                                                                          SHA512

                                                                          3998bf855cca12fa0f5b1d776747bd6a59346a0acfcb07ad1c43d09c32f5075eaf4af18aa46d9a6da9556eab2a22b76749e3ba0bcbfdf10142d0b0bd7db74388

                                                                          Download Submit

                                                                        • C:\Black Hole.exe
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          4f7a0de15fe5467fd52af471919aeec5

                                                                          SHA1

                                                                          6561f76ba31c4e5fef48362684faa8140d39ff54

                                                                          SHA256

                                                                          608eaed5293acbe240c120f1408a1077006db194750983ca4d4edf31ca6c3c5f

                                                                          SHA512

                                                                          620670360f29ea8a36e2c142b68d60b81656c66fdc9ef07afe7eb35d8b611f595791aaafd26e61eb527fe45f4022f045f62c8e20b9dd2c0a8705f551b6f2ed85

                                                                          Download Submit

                                                                        • C:\Black Hole.exe
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          10720a439b47757875db7d1f335f6608

                                                                          SHA1

                                                                          4f702b04020dcda88feb5b5d13324ef3d4592908

                                                                          SHA256

                                                                          495e5a63232782917357c0716086dcacdb3f432e3557631d4d6fb3522a4061b3

                                                                          SHA512

                                                                          58b26e5a5e34fd0aab429cad68c7ecc1a1be2bd6d0a77c060037e5ca08251e560be400ece5fa9ce4d304424be59342d5757ed2f9ad1b5cee028063aa06919029

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          d1d52ff3ae93be79112b9f1987fbe6fe

                                                                          SHA1

                                                                          efd61f65d5464c7ac669fbf0e212bee5c412b7e3

                                                                          SHA256

                                                                          b23a95d1e44627c5443760150a808b6af2278af7eadee303c9e2c35bf6f6c4bc

                                                                          SHA512

                                                                          6fda8109104cb60321393000a92618330ee98e1833936dd2b0bc4e2ad5efadee80c626be22fd935a71e5a8591688e19e7063c01994e84dd363eb47667d17dc92

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\WINDOWS\CSRSS.EXE
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          d1d52ff3ae93be79112b9f1987fbe6fe

                                                                          SHA1

                                                                          efd61f65d5464c7ac669fbf0e212bee5c412b7e3

                                                                          SHA256

                                                                          b23a95d1e44627c5443760150a808b6af2278af7eadee303c9e2c35bf6f6c4bc

                                                                          SHA512

                                                                          6fda8109104cb60321393000a92618330ee98e1833936dd2b0bc4e2ad5efadee80c626be22fd935a71e5a8591688e19e7063c01994e84dd363eb47667d17dc92

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          f175ebf7d845e860f6c76d9a03c06c07

                                                                          SHA1

                                                                          b008c793fe1c590b22dd1fb6245d2383c152c6ae

                                                                          SHA256

                                                                          1b7a3b78d2f13008f8fc7fb454769d91b9a253cc61457dbcc0310b957bb5cd5f

                                                                          SHA512

                                                                          a3a06fc11282f7fc027367973b5da2bf830165dc10544ffeddf3780822b274d17487433804588c7d94cf452a9c542733a459ffab27a4361317e1058ee4caf913

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\WINDOWS\LSASS.EXE
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          f175ebf7d845e860f6c76d9a03c06c07

                                                                          SHA1

                                                                          b008c793fe1c590b22dd1fb6245d2383c152c6ae

                                                                          SHA256

                                                                          1b7a3b78d2f13008f8fc7fb454769d91b9a253cc61457dbcc0310b957bb5cd5f

                                                                          SHA512

                                                                          a3a06fc11282f7fc027367973b5da2bf830165dc10544ffeddf3780822b274d17487433804588c7d94cf452a9c542733a459ffab27a4361317e1058ee4caf913

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          f487551786741d31752c5af0d9b76d4f

                                                                          SHA1

                                                                          4236180b1490225db0798a4e31a5462844c1eda8

                                                                          SHA256

                                                                          677d2e33728c7d476e5136d77474125af9088b0ff7ade95e67cf49625b4df72c

                                                                          SHA512

                                                                          97008201d2132f654759eebfcf7021665ad4232f04e69d1bbdd25e1753dca168b996a601ecd05f786121228522bf3fd0d56047e26fb431864620f6ff2b50d18a

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          f487551786741d31752c5af0d9b76d4f

                                                                          SHA1

                                                                          4236180b1490225db0798a4e31a5462844c1eda8

                                                                          SHA256

                                                                          677d2e33728c7d476e5136d77474125af9088b0ff7ade95e67cf49625b4df72c

                                                                          SHA512

                                                                          97008201d2132f654759eebfcf7021665ad4232f04e69d1bbdd25e1753dca168b996a601ecd05f786121228522bf3fd0d56047e26fb431864620f6ff2b50d18a

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\WINDOWS\SMSS.EXE
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          6cd6a622338a4c9d3f0521526342e129

                                                                          SHA1

                                                                          1261562ad4f56a8b014b17fb11beb96241a5d1f3

                                                                          SHA256

                                                                          f90ac10cf777ecd5b967bee6a48c7eaacc677427074aad9755dc46c2339c36de

                                                                          SHA512

                                                                          8a4bdc1e1b1ad4d0d9d0e5e29a00ec971cf9fe49f45b8bc0ac9c3c3fe0f0c668506130ef1b6f3673ab3cf974fe8784ced257b12673dae9684d711bb8a5597774

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          5ae2ae145258979b76b3f752ab3e734e

                                                                          SHA1

                                                                          7f411cb00a8f5e10aa2dbf5ecdb35384e57c71c2

                                                                          SHA256

                                                                          76ac20bc9d10a2554a8e94eaadd628543c675e3df19dd038dd5a8c91c55e7a79

                                                                          SHA512

                                                                          2d02556d88cfc5053132b59f9b9f8994e38fa7cd2f657181e2422d42b325d5b82488013d974ec92f1e0a7eeb3a27003ed0a4464ef2a242ae44b27d3ee44dd184

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          5ae2ae145258979b76b3f752ab3e734e

                                                                          SHA1

                                                                          7f411cb00a8f5e10aa2dbf5ecdb35384e57c71c2

                                                                          SHA256

                                                                          76ac20bc9d10a2554a8e94eaadd628543c675e3df19dd038dd5a8c91c55e7a79

                                                                          SHA512

                                                                          2d02556d88cfc5053132b59f9b9f8994e38fa7cd2f657181e2422d42b325d5b82488013d974ec92f1e0a7eeb3a27003ed0a4464ef2a242ae44b27d3ee44dd184

                                                                          Download Submit

                                                                        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          d1d52ff3ae93be79112b9f1987fbe6fe

                                                                          SHA1

                                                                          efd61f65d5464c7ac669fbf0e212bee5c412b7e3

                                                                          SHA256

                                                                          b23a95d1e44627c5443760150a808b6af2278af7eadee303c9e2c35bf6f6c4bc

                                                                          SHA512

                                                                          6fda8109104cb60321393000a92618330ee98e1833936dd2b0bc4e2ad5efadee80c626be22fd935a71e5a8591688e19e7063c01994e84dd363eb47667d17dc92

                                                                          Download Submit

                                                                        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          f175ebf7d845e860f6c76d9a03c06c07

                                                                          SHA1

                                                                          b008c793fe1c590b22dd1fb6245d2383c152c6ae

                                                                          SHA256

                                                                          1b7a3b78d2f13008f8fc7fb454769d91b9a253cc61457dbcc0310b957bb5cd5f

                                                                          SHA512

                                                                          a3a06fc11282f7fc027367973b5da2bf830165dc10544ffeddf3780822b274d17487433804588c7d94cf452a9c542733a459ffab27a4361317e1058ee4caf913

                                                                          Download Submit

                                                                        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          f487551786741d31752c5af0d9b76d4f

                                                                          SHA1

                                                                          4236180b1490225db0798a4e31a5462844c1eda8

                                                                          SHA256

                                                                          677d2e33728c7d476e5136d77474125af9088b0ff7ade95e67cf49625b4df72c

                                                                          SHA512

                                                                          97008201d2132f654759eebfcf7021665ad4232f04e69d1bbdd25e1753dca168b996a601ecd05f786121228522bf3fd0d56047e26fb431864620f6ff2b50d18a

                                                                          Download Submit

                                                                        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          6cd6a622338a4c9d3f0521526342e129

                                                                          SHA1

                                                                          1261562ad4f56a8b014b17fb11beb96241a5d1f3

                                                                          SHA256

                                                                          f90ac10cf777ecd5b967bee6a48c7eaacc677427074aad9755dc46c2339c36de

                                                                          SHA512

                                                                          8a4bdc1e1b1ad4d0d9d0e5e29a00ec971cf9fe49f45b8bc0ac9c3c3fe0f0c668506130ef1b6f3673ab3cf974fe8784ced257b12673dae9684d711bb8a5597774

                                                                          Download Submit

                                                                        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          5ae2ae145258979b76b3f752ab3e734e

                                                                          SHA1

                                                                          7f411cb00a8f5e10aa2dbf5ecdb35384e57c71c2

                                                                          SHA256

                                                                          76ac20bc9d10a2554a8e94eaadd628543c675e3df19dd038dd5a8c91c55e7a79

                                                                          SHA512

                                                                          2d02556d88cfc5053132b59f9b9f8994e38fa7cd2f657181e2422d42b325d5b82488013d974ec92f1e0a7eeb3a27003ed0a4464ef2a242ae44b27d3ee44dd184

                                                                          Download Submit

                                                                        • C:\Users\Admin\Local Settings\Application Data\csrss.exe
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          3977c2294190f27ed68b94f20f919870

                                                                          SHA1

                                                                          c353ca5ebc7bb558c2a07216aae052195c230955

                                                                          SHA256

                                                                          451e52991127304b404380cafb68279584227020090ffb95c25daa5a1fed1e74

                                                                          SHA512

                                                                          be515f41897c77a52d1962e09a98f26be26b65c76fe5000ac9462a18aacc86592776fca1de43d77ee245c4580c857b3fdad41ed7cfa314be4454f7e655fbb99a

                                                                          Download Submit

                                                                        • C:\Users\Admin\Local Settings\Application Data\lsass.exe
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          3977c2294190f27ed68b94f20f919870

                                                                          SHA1

                                                                          c353ca5ebc7bb558c2a07216aae052195c230955

                                                                          SHA256

                                                                          451e52991127304b404380cafb68279584227020090ffb95c25daa5a1fed1e74

                                                                          SHA512

                                                                          be515f41897c77a52d1962e09a98f26be26b65c76fe5000ac9462a18aacc86592776fca1de43d77ee245c4580c857b3fdad41ed7cfa314be4454f7e655fbb99a

                                                                          Download Submit

                                                                        • C:\Users\Admin\Local Settings\Application Data\services.exe
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          3977c2294190f27ed68b94f20f919870

                                                                          SHA1

                                                                          c353ca5ebc7bb558c2a07216aae052195c230955

                                                                          SHA256

                                                                          451e52991127304b404380cafb68279584227020090ffb95c25daa5a1fed1e74

                                                                          SHA512

                                                                          be515f41897c77a52d1962e09a98f26be26b65c76fe5000ac9462a18aacc86592776fca1de43d77ee245c4580c857b3fdad41ed7cfa314be4454f7e655fbb99a

                                                                          Download Submit

                                                                        • C:\Users\Admin\Local Settings\Application Data\smss.exe
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          3977c2294190f27ed68b94f20f919870

                                                                          SHA1

                                                                          c353ca5ebc7bb558c2a07216aae052195c230955

                                                                          SHA256

                                                                          451e52991127304b404380cafb68279584227020090ffb95c25daa5a1fed1e74

                                                                          SHA512

                                                                          be515f41897c77a52d1962e09a98f26be26b65c76fe5000ac9462a18aacc86592776fca1de43d77ee245c4580c857b3fdad41ed7cfa314be4454f7e655fbb99a

                                                                          Download Submit

                                                                        • C:\Users\Admin\Local Settings\Application Data\winlogon.exe
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          3977c2294190f27ed68b94f20f919870

                                                                          SHA1

                                                                          c353ca5ebc7bb558c2a07216aae052195c230955

                                                                          SHA256

                                                                          451e52991127304b404380cafb68279584227020090ffb95c25daa5a1fed1e74

                                                                          SHA512

                                                                          be515f41897c77a52d1962e09a98f26be26b65c76fe5000ac9462a18aacc86592776fca1de43d77ee245c4580c857b3fdad41ed7cfa314be4454f7e655fbb99a

                                                                          Download Submit

                                                                        • C:\Users\All Users\Start Menu\Programs\Startup\Zero Code.pif
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          645ab6af99062e3f0f1c21519cf9c526

                                                                          SHA1

                                                                          6e4bd854b4113dbc16b63c90956d14506d3dd26a

                                                                          SHA256

                                                                          c78bfe00ad27975cc49c6921b72269dce6cba4db16057c370e8a7277ca5fd3ac

                                                                          SHA512

                                                                          708b0870ddbb79473f1f6ac058708b89ed50b490d3d0623396b0054ac1e15c1946c6a8688ebfa658e21fb50a1973c11eec55f461fa40190dc735a2f015f115f0

                                                                          Download Submit

                                                                        • C:\Users\All Users\Start Menu\Programs\Startup\Zero Code.pif
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          5ae2ae145258979b76b3f752ab3e734e

                                                                          SHA1

                                                                          7f411cb00a8f5e10aa2dbf5ecdb35384e57c71c2

                                                                          SHA256

                                                                          76ac20bc9d10a2554a8e94eaadd628543c675e3df19dd038dd5a8c91c55e7a79

                                                                          SHA512

                                                                          2d02556d88cfc5053132b59f9b9f8994e38fa7cd2f657181e2422d42b325d5b82488013d974ec92f1e0a7eeb3a27003ed0a4464ef2a242ae44b27d3ee44dd184

                                                                          Download Submit

                                                                        • C:\Users\All Users\Start Menu\Programs\Startup\Zero Code.pif
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          f487551786741d31752c5af0d9b76d4f

                                                                          SHA1

                                                                          4236180b1490225db0798a4e31a5462844c1eda8

                                                                          SHA256

                                                                          677d2e33728c7d476e5136d77474125af9088b0ff7ade95e67cf49625b4df72c

                                                                          SHA512

                                                                          97008201d2132f654759eebfcf7021665ad4232f04e69d1bbdd25e1753dca168b996a601ecd05f786121228522bf3fd0d56047e26fb431864620f6ff2b50d18a

                                                                          Download Submit

                                                                        • C:\Users\All Users\Start Menu\Programs\Startup\Zero Code.pif
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          6cd6a622338a4c9d3f0521526342e129

                                                                          SHA1

                                                                          1261562ad4f56a8b014b17fb11beb96241a5d1f3

                                                                          SHA256

                                                                          f90ac10cf777ecd5b967bee6a48c7eaacc677427074aad9755dc46c2339c36de

                                                                          SHA512

                                                                          8a4bdc1e1b1ad4d0d9d0e5e29a00ec971cf9fe49f45b8bc0ac9c3c3fe0f0c668506130ef1b6f3673ab3cf974fe8784ced257b12673dae9684d711bb8a5597774

                                                                          Download Submit

                                                                        • C:\Users\All Users\Start Menu\Programs\Startup\Zero Code.pif
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          102b9b310c51a1e6a52ddf42c0572754

                                                                          SHA1

                                                                          5916a97a482a4b4738349be1a940415a80b13727

                                                                          SHA256

                                                                          b805c5bf93a6dfab73a8c9ed0c93b93c7c57ec94dc12c1c01c053917b0496b6b

                                                                          SHA512

                                                                          6c18a865f5ea225b75871fb9a936335a733b8a3f5c78c3f98b8ba78a31dd4931347cc89ea94d8340f8dc1fa3ff5fc579c86f8385c51bcce1c1348bf0b257cddc

                                                                          Download Submit

                                                                        • C:\Users\All Users\Start Menu\Programs\Startup\Zero Code.pif
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          102b9b310c51a1e6a52ddf42c0572754

                                                                          SHA1

                                                                          5916a97a482a4b4738349be1a940415a80b13727

                                                                          SHA256

                                                                          b805c5bf93a6dfab73a8c9ed0c93b93c7c57ec94dc12c1c01c053917b0496b6b

                                                                          SHA512

                                                                          6c18a865f5ea225b75871fb9a936335a733b8a3f5c78c3f98b8ba78a31dd4931347cc89ea94d8340f8dc1fa3ff5fc579c86f8385c51bcce1c1348bf0b257cddc

                                                                          Download Submit

                                                                        • C:\WINDOWS\Black Hole.txt
                                                                          Filesize

                                                                          1KB

                                                                          MD5

                                                                          4c7fa739f19c5a236abdba26cce2e3a5

                                                                          SHA1

                                                                          7929944ee8ba07bc85957b77ea3765d5cdfe6fe7

                                                                          SHA256

                                                                          82309530fd14528685d3bdefd6d2ee59e33e3154e4b77b7efeea35c329fa46b3

                                                                          SHA512

                                                                          4edd06f523a14b4b9af7e82bdf8823d231e74fa1bc4f5a3b3b94ddd677fdee4d207801a0276a5fcea519ed3962a43b138877e9afda26ee503bca5b15a19d10fa

                                                                          Download Submit

                                                                        • C:\WINDOWS\Hacked By Gerry.txt
                                                                          Filesize

                                                                          1KB

                                                                          MD5

                                                                          e067dafcbe64a95f5045a281397732db

                                                                          SHA1

                                                                          1af7095f98c486ca247449980000d06b04ffc50c

                                                                          SHA256

                                                                          b6085ee8c1f2de574973b9f3a7417257e25573c2b5228b5a8f87e3788e2733b6

                                                                          SHA512

                                                                          1b575d62fee219538f8d624ab833cbce0aee431559a0adfa1e3ce9cd4f5ab8a2887b394843ebf164c884ccbed5687d644474328471b23c28edba8f99ccf08b58

                                                                          Download Submit

                                                                        • C:\Windows\Black Hole.exe
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          3977c2294190f27ed68b94f20f919870

                                                                          SHA1

                                                                          c353ca5ebc7bb558c2a07216aae052195c230955

                                                                          SHA256

                                                                          451e52991127304b404380cafb68279584227020090ffb95c25daa5a1fed1e74

                                                                          SHA512

                                                                          be515f41897c77a52d1962e09a98f26be26b65c76fe5000ac9462a18aacc86592776fca1de43d77ee245c4580c857b3fdad41ed7cfa314be4454f7e655fbb99a

                                                                          Download Submit

                                                                        • C:\Windows\Black Hole.exe
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          3977c2294190f27ed68b94f20f919870

                                                                          SHA1

                                                                          c353ca5ebc7bb558c2a07216aae052195c230955

                                                                          SHA256

                                                                          451e52991127304b404380cafb68279584227020090ffb95c25daa5a1fed1e74

                                                                          SHA512

                                                                          be515f41897c77a52d1962e09a98f26be26b65c76fe5000ac9462a18aacc86592776fca1de43d77ee245c4580c857b3fdad41ed7cfa314be4454f7e655fbb99a

                                                                          Download Submit

                                                                        • C:\Windows\Black Hole.exe
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          d919684329656a39d3435a4512967ab8

                                                                          SHA1

                                                                          4e13cfa723f9143ecdf9573b9c6b7368b1017ac5

                                                                          SHA256

                                                                          509539fd9001b0c38bedfa4e3c16f673e0ad6bd31a5c9b6616472bc853199184

                                                                          SHA512

                                                                          48d471e80f6e88ce723d7326288010413d25223780e0e0e7291ccb7ad2cfb25264b6ff32ae356ed998eeb058587f904a9127c911b51d20611aa23418840d45e9

                                                                          Download Submit

                                                                        • C:\Windows\Black Hole.exe
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          d919684329656a39d3435a4512967ab8

                                                                          SHA1

                                                                          4e13cfa723f9143ecdf9573b9c6b7368b1017ac5

                                                                          SHA256

                                                                          509539fd9001b0c38bedfa4e3c16f673e0ad6bd31a5c9b6616472bc853199184

                                                                          SHA512

                                                                          48d471e80f6e88ce723d7326288010413d25223780e0e0e7291ccb7ad2cfb25264b6ff32ae356ed998eeb058587f904a9127c911b51d20611aa23418840d45e9

                                                                          Download Submit

                                                                        • C:\Windows\MSVBVM60.DLL
                                                                          Filesize

                                                                          1.4MB

                                                                          MD5

                                                                          25f62c02619174b35851b0e0455b3d94

                                                                          SHA1

                                                                          4e8ee85157f1769f6e3f61c0acbe59072209da71

                                                                          SHA256

                                                                          898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

                                                                          SHA512

                                                                          f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

                                                                          Download Submit

                                                                        • C:\Windows\SysWOW64\Destruction.scr
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          645ab6af99062e3f0f1c21519cf9c526

                                                                          SHA1

                                                                          6e4bd854b4113dbc16b63c90956d14506d3dd26a

                                                                          SHA256

                                                                          c78bfe00ad27975cc49c6921b72269dce6cba4db16057c370e8a7277ca5fd3ac

                                                                          SHA512

                                                                          708b0870ddbb79473f1f6ac058708b89ed50b490d3d0623396b0054ac1e15c1946c6a8688ebfa658e21fb50a1973c11eec55f461fa40190dc735a2f015f115f0

                                                                          Download Submit

                                                                        • C:\Windows\SysWOW64\Destruction.scr
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          f487551786741d31752c5af0d9b76d4f

                                                                          SHA1

                                                                          4236180b1490225db0798a4e31a5462844c1eda8

                                                                          SHA256

                                                                          677d2e33728c7d476e5136d77474125af9088b0ff7ade95e67cf49625b4df72c

                                                                          SHA512

                                                                          97008201d2132f654759eebfcf7021665ad4232f04e69d1bbdd25e1753dca168b996a601ecd05f786121228522bf3fd0d56047e26fb431864620f6ff2b50d18a

                                                                          Download Submit

                                                                        • C:\Windows\SysWOW64\Destruction.scr
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          f487551786741d31752c5af0d9b76d4f

                                                                          SHA1

                                                                          4236180b1490225db0798a4e31a5462844c1eda8

                                                                          SHA256

                                                                          677d2e33728c7d476e5136d77474125af9088b0ff7ade95e67cf49625b4df72c

                                                                          SHA512

                                                                          97008201d2132f654759eebfcf7021665ad4232f04e69d1bbdd25e1753dca168b996a601ecd05f786121228522bf3fd0d56047e26fb431864620f6ff2b50d18a

                                                                          Download Submit

                                                                        • C:\Windows\SysWOW64\Destruction.scr
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          d1d52ff3ae93be79112b9f1987fbe6fe

                                                                          SHA1

                                                                          efd61f65d5464c7ac669fbf0e212bee5c412b7e3

                                                                          SHA256

                                                                          b23a95d1e44627c5443760150a808b6af2278af7eadee303c9e2c35bf6f6c4bc

                                                                          SHA512

                                                                          6fda8109104cb60321393000a92618330ee98e1833936dd2b0bc4e2ad5efadee80c626be22fd935a71e5a8591688e19e7063c01994e84dd363eb47667d17dc92

                                                                          Download Submit

                                                                        • C:\Windows\SysWOW64\Destruction.scr
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          d1d52ff3ae93be79112b9f1987fbe6fe

                                                                          SHA1

                                                                          efd61f65d5464c7ac669fbf0e212bee5c412b7e3

                                                                          SHA256

                                                                          b23a95d1e44627c5443760150a808b6af2278af7eadee303c9e2c35bf6f6c4bc

                                                                          SHA512

                                                                          6fda8109104cb60321393000a92618330ee98e1833936dd2b0bc4e2ad5efadee80c626be22fd935a71e5a8591688e19e7063c01994e84dd363eb47667d17dc92

                                                                          Download Submit

                                                                        • C:\Windows\SysWOW64\Destruction.scr
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          6cd6a622338a4c9d3f0521526342e129

                                                                          SHA1

                                                                          1261562ad4f56a8b014b17fb11beb96241a5d1f3

                                                                          SHA256

                                                                          f90ac10cf777ecd5b967bee6a48c7eaacc677427074aad9755dc46c2339c36de

                                                                          SHA512

                                                                          8a4bdc1e1b1ad4d0d9d0e5e29a00ec971cf9fe49f45b8bc0ac9c3c3fe0f0c668506130ef1b6f3673ab3cf974fe8784ced257b12673dae9684d711bb8a5597774

                                                                          Download Submit

                                                                        • C:\Windows\SysWOW64\Destruction.scr
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          94341b905794e288c01a14d755b796d7

                                                                          SHA1

                                                                          26eb6db709c9d427ddbab684b25b1208b0a3946b

                                                                          SHA256

                                                                          36977e74148cac957170c510fcde1ad030d22d45f194502bc616ff9419706a36

                                                                          SHA512

                                                                          226ddb05b9ad7bc9bb4ffd768ff3f0b081185e0964fd02b9efcfe49829ec71dd1ab677ed05b9216e97ce2106947e9b45972ee7457bf5832b65f809521d0fa5e6

                                                                          Download Submit

                                                                        • C:\Windows\SysWOW64\Destruction.scr
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          94341b905794e288c01a14d755b796d7

                                                                          SHA1

                                                                          26eb6db709c9d427ddbab684b25b1208b0a3946b

                                                                          SHA256

                                                                          36977e74148cac957170c510fcde1ad030d22d45f194502bc616ff9419706a36

                                                                          SHA512

                                                                          226ddb05b9ad7bc9bb4ffd768ff3f0b081185e0964fd02b9efcfe49829ec71dd1ab677ed05b9216e97ce2106947e9b45972ee7457bf5832b65f809521d0fa5e6

                                                                          Download Submit

                                                                        • C:\Windows\SysWOW64\Destruction.scr
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          99e1ae8704f64db9546b64bb7bb33008

                                                                          SHA1

                                                                          f305258aacfd486625df3521745599d24b860a1e

                                                                          SHA256

                                                                          60c6b0a68ba7a8135a99e9f7500d482f30b7fd7524c5b10b4fc9bbfef024946c

                                                                          SHA512

                                                                          ade102657ada1b32ac53d4f0d5cef5d8708928970736d65b5e1063f5bd0f4a9388a7ef0fbe113486f77c2f54df87f8c3dcf8a7953e79aea11a634105f34ae1cc

                                                                          Download Submit

                                                                        • C:\Windows\SysWOW64\Lubang Hitam.exe
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          645ab6af99062e3f0f1c21519cf9c526

                                                                          SHA1

                                                                          6e4bd854b4113dbc16b63c90956d14506d3dd26a

                                                                          SHA256

                                                                          c78bfe00ad27975cc49c6921b72269dce6cba4db16057c370e8a7277ca5fd3ac

                                                                          SHA512

                                                                          708b0870ddbb79473f1f6ac058708b89ed50b490d3d0623396b0054ac1e15c1946c6a8688ebfa658e21fb50a1973c11eec55f461fa40190dc735a2f015f115f0

                                                                          Download Submit

                                                                        • C:\Windows\SysWOW64\Lubang Hitam.exe
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          645ab6af99062e3f0f1c21519cf9c526

                                                                          SHA1

                                                                          6e4bd854b4113dbc16b63c90956d14506d3dd26a

                                                                          SHA256

                                                                          c78bfe00ad27975cc49c6921b72269dce6cba4db16057c370e8a7277ca5fd3ac

                                                                          SHA512

                                                                          708b0870ddbb79473f1f6ac058708b89ed50b490d3d0623396b0054ac1e15c1946c6a8688ebfa658e21fb50a1973c11eec55f461fa40190dc735a2f015f115f0

                                                                          Download Submit

                                                                        • C:\Windows\SysWOW64\Lubang Hitam.exe
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          645ab6af99062e3f0f1c21519cf9c526

                                                                          SHA1

                                                                          6e4bd854b4113dbc16b63c90956d14506d3dd26a

                                                                          SHA256

                                                                          c78bfe00ad27975cc49c6921b72269dce6cba4db16057c370e8a7277ca5fd3ac

                                                                          SHA512

                                                                          708b0870ddbb79473f1f6ac058708b89ed50b490d3d0623396b0054ac1e15c1946c6a8688ebfa658e21fb50a1973c11eec55f461fa40190dc735a2f015f115f0

                                                                          Download Submit

                                                                        • C:\Windows\SysWOW64\Shell.exe
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          645ab6af99062e3f0f1c21519cf9c526

                                                                          SHA1

                                                                          6e4bd854b4113dbc16b63c90956d14506d3dd26a

                                                                          SHA256

                                                                          c78bfe00ad27975cc49c6921b72269dce6cba4db16057c370e8a7277ca5fd3ac

                                                                          SHA512

                                                                          708b0870ddbb79473f1f6ac058708b89ed50b490d3d0623396b0054ac1e15c1946c6a8688ebfa658e21fb50a1973c11eec55f461fa40190dc735a2f015f115f0

                                                                          Download Submit

                                                                        • C:\Windows\SysWOW64\Shell.exe
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          f487551786741d31752c5af0d9b76d4f

                                                                          SHA1

                                                                          4236180b1490225db0798a4e31a5462844c1eda8

                                                                          SHA256

                                                                          677d2e33728c7d476e5136d77474125af9088b0ff7ade95e67cf49625b4df72c

                                                                          SHA512

                                                                          97008201d2132f654759eebfcf7021665ad4232f04e69d1bbdd25e1753dca168b996a601ecd05f786121228522bf3fd0d56047e26fb431864620f6ff2b50d18a

                                                                          Download Submit

                                                                        • C:\Windows\SysWOW64\Shell.exe
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          f487551786741d31752c5af0d9b76d4f

                                                                          SHA1

                                                                          4236180b1490225db0798a4e31a5462844c1eda8

                                                                          SHA256

                                                                          677d2e33728c7d476e5136d77474125af9088b0ff7ade95e67cf49625b4df72c

                                                                          SHA512

                                                                          97008201d2132f654759eebfcf7021665ad4232f04e69d1bbdd25e1753dca168b996a601ecd05f786121228522bf3fd0d56047e26fb431864620f6ff2b50d18a

                                                                          Download Submit

                                                                        • C:\Windows\SysWOW64\Shell.exe
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          d1d52ff3ae93be79112b9f1987fbe6fe

                                                                          SHA1

                                                                          efd61f65d5464c7ac669fbf0e212bee5c412b7e3

                                                                          SHA256

                                                                          b23a95d1e44627c5443760150a808b6af2278af7eadee303c9e2c35bf6f6c4bc

                                                                          SHA512

                                                                          6fda8109104cb60321393000a92618330ee98e1833936dd2b0bc4e2ad5efadee80c626be22fd935a71e5a8591688e19e7063c01994e84dd363eb47667d17dc92

                                                                          Download Submit

                                                                        • C:\Windows\SysWOW64\Shell.exe
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          d1d52ff3ae93be79112b9f1987fbe6fe

                                                                          SHA1

                                                                          efd61f65d5464c7ac669fbf0e212bee5c412b7e3

                                                                          SHA256

                                                                          b23a95d1e44627c5443760150a808b6af2278af7eadee303c9e2c35bf6f6c4bc

                                                                          SHA512

                                                                          6fda8109104cb60321393000a92618330ee98e1833936dd2b0bc4e2ad5efadee80c626be22fd935a71e5a8591688e19e7063c01994e84dd363eb47667d17dc92

                                                                          Download Submit

                                                                        • C:\Windows\SysWOW64\Shell.exe
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          6cd6a622338a4c9d3f0521526342e129

                                                                          SHA1

                                                                          1261562ad4f56a8b014b17fb11beb96241a5d1f3

                                                                          SHA256

                                                                          f90ac10cf777ecd5b967bee6a48c7eaacc677427074aad9755dc46c2339c36de

                                                                          SHA512

                                                                          8a4bdc1e1b1ad4d0d9d0e5e29a00ec971cf9fe49f45b8bc0ac9c3c3fe0f0c668506130ef1b6f3673ab3cf974fe8784ced257b12673dae9684d711bb8a5597774

                                                                          Download Submit

                                                                        • C:\Windows\SysWOW64\Shell.exe
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          a2c0293aa7a0ca5253663f034a2cce43

                                                                          SHA1

                                                                          3d0d4892dca0a9085b7983d703f544adad61c902

                                                                          SHA256

                                                                          92ef4e1bc3ff74e28937a0d1f670b2c7fd3f02630908f80ffbeec1443a7ee733

                                                                          SHA512

                                                                          e83f8e8b5dae6ac9c2371cfba1e9aabbfa874b6c547ab294856c76a3155eb2ccce59f3c777a6c862ab071d95fd17118e6bb904c222f87df6f1e1896ec79f07a8

                                                                          Download Submit

                                                                        • C:\Windows\SysWOW64\Shell.exe
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          a2c0293aa7a0ca5253663f034a2cce43

                                                                          SHA1

                                                                          3d0d4892dca0a9085b7983d703f544adad61c902

                                                                          SHA256

                                                                          92ef4e1bc3ff74e28937a0d1f670b2c7fd3f02630908f80ffbeec1443a7ee733

                                                                          SHA512

                                                                          e83f8e8b5dae6ac9c2371cfba1e9aabbfa874b6c547ab294856c76a3155eb2ccce59f3c777a6c862ab071d95fd17118e6bb904c222f87df6f1e1896ec79f07a8

                                                                          Download Submit

                                                                        • C:\Windows\SysWOW64\Shell.exe
                                                                          Filesize

                                                                          70KB

                                                                          MD5

                                                                          09f74f0eb73a9ee46508bd03c084aa49

                                                                          SHA1

                                                                          64034747d00b064994703005c766ae00d2b38583

                                                                          SHA256

                                                                          5325f479ac7d37cf9c4e13d853b8d00a15fc5e4b1f0b497747972ac460a647aa

                                                                          SHA512

                                                                          d61e16ece722a4c8a3c523b5c5998dfd95b678fb8e96728ee4e6faab164b9681e7dc450882835f81bd35b602adfddf35a95893edc66c8e4c790fe99ba0a8b0a5

                                                                          Download Submit

                                                                        • C:\Windows\msvbvm60.dll
                                                                          Filesize

                                                                          1.4MB

                                                                          MD5

                                                                          25f62c02619174b35851b0e0455b3d94

                                                                          SHA1

                                                                          4e8ee85157f1769f6e3f61c0acbe59072209da71

                                                                          SHA256

                                                                          898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2

                                                                          SHA512

                                                                          f4529fd9eca4e4696f7f06874866ff98a1447a9b0d3a20ef0de54d4d694e2497fd39c452f73fab9b8a02962a7b2b88d1e85f6e35c7cbcb9555003c6828bebc3a

                                                                          Download Submit

                                                                        • memory/8-390-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/8-379-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/216-138-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/216-149-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/216-393-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/220-307-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/1168-283-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/1452-260-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/1452-262-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/1500-193-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/1556-445-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/1696-132-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/1756-391-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/1756-380-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/1824-434-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/1900-370-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/2004-333-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/2072-174-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/2084-357-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/2296-238-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/2320-328-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/2332-311-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/2332-383-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/2332-304-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/2348-363-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/2724-177-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/3156-301-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/3176-408-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/3380-335-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/3416-407-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/3416-417-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/3444-195-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/3520-405-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/3552-440-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/3552-439-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/3604-232-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/3648-278-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/3780-413-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/3780-421-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/3788-404-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/3896-330-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/3924-382-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/3924-389-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/3940-414-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/3940-422-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/4072-245-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/4144-292-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/4220-381-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/4220-392-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/4448-384-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/4480-429-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/4552-302-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/4672-337-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/4808-206-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/4840-168-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/4860-291-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/4872-367-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/4916-308-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/4916-315-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/4996-406-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/4996-416-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/5016-196-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/5072-259-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download

                                                                        • memory/5072-171-0x0000000000400000-0x000000000046C000-memory.dmp

                                                                          Filesize

                                                                          432KB

                                                                          Download