Overview

overview

9

Static

static

830004.exe

windows7-x64

9

830004.exe

windows10-2004-x64

7

Resubmissions

05-10-2022 11:39

221005-nsrtyaedfm 9

05-10-2022 08:12

221005-j3wtesdfg7 9

05-10-2022 06:56

221005-hqhwcsdeg8 9

Analysis

  • max time kernel
    155s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    05-10-2022 06:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    830004.exe

  • Size

    691KB

  • MD5

    58aea2aac89947773dfae8e3859e20b0

  • SHA1

    be17c41c65703f9475e36dff55fd3de220e395f3

  • SHA256

    39b74b2fb057e8c78a2ba6639cf3d58ae91685e6ac13b57b70d2afb158cf742d

  • SHA512

    f3d43c0759b05b949498cc63084b54b869c228a427f1590a1010007b4bdbebf760145a29e5f1a7c5585133ed76a3c1a5d7bf2ace46858ac9a48ff5c05eafa6eb

  • SSDEEP

    12288:i0iads6yn93ySQDWYgeWYg955/155/m6q5iKn3zMCO342FoqdXS:dicFyn93ySQJ5f34Jo2Fi

Score
9/10
persistenceransomwarespywarestealer

Malware Config

Signatures

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies extensions of user files 18 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Delays execution with timeout.exe 61 IoCs
    evasion
  • Enumerates processes with tasklist 1 TTPs 61 IoCs
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Kills process with taskkill 10 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 18 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Runs net.exe
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\830004.exe
    "C:\Users\Admin\AppData\Local\Temp\830004.exe"
    1⤵
    • Modifies extensions of user files
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1076
    • C:\Windows\system32\cmd.exe
      cmd /c C:\ProgramData\Microsoft\Settings\4g8D6x6k9.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1556
      • C:\Windows\system32\tasklist.exe
        TASKLIST
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:1396
      • C:\Windows\system32\findstr.exe
        FINDSTR /B /L /I /C:830004.exe
        3⤵
          PID:960
        • C:\Windows\system32\timeout.exe
          TIMEOUT /T 1 /NOBREAK
          3⤵
          • Delays execution with timeout.exe
          PID:1320
        • C:\Windows\system32\tasklist.exe
          TASKLIST
          3⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:1644
        • C:\Windows\system32\findstr.exe
          FINDSTR /B /L /I /C:830004.exe
          3⤵
            PID:1568
          • C:\Windows\system32\timeout.exe
            TIMEOUT /T 1 /NOBREAK
            3⤵
            • Delays execution with timeout.exe
            PID:1348
          • C:\Windows\system32\tasklist.exe
            TASKLIST
            3⤵
            • Enumerates processes with tasklist
            • Suspicious use of AdjustPrivilegeToken
            PID:1668
          • C:\Windows\system32\findstr.exe
            FINDSTR /B /L /I /C:830004.exe
            3⤵
              PID:1748
            • C:\Windows\system32\timeout.exe
              TIMEOUT /T 1 /NOBREAK
              3⤵
              • Delays execution with timeout.exe
              PID:1924
            • C:\Windows\system32\tasklist.exe
              TASKLIST
              3⤵
              • Enumerates processes with tasklist
              • Suspicious use of AdjustPrivilegeToken
              PID:1232
            • C:\Windows\system32\findstr.exe
              FINDSTR /B /L /I /C:830004.exe
              3⤵
                PID:1720
              • C:\Windows\system32\timeout.exe
                TIMEOUT /T 1 /NOBREAK
                3⤵
                • Delays execution with timeout.exe
                PID:1176
              • C:\Windows\system32\tasklist.exe
                TASKLIST
                3⤵
                • Enumerates processes with tasklist
                • Suspicious use of AdjustPrivilegeToken
                PID:744
              • C:\Windows\system32\findstr.exe
                FINDSTR /B /L /I /C:830004.exe
                3⤵
                  PID:108
                • C:\Windows\system32\timeout.exe
                  TIMEOUT /T 1 /NOBREAK
                  3⤵
                  • Delays execution with timeout.exe
                  PID:1000
                • C:\Windows\system32\tasklist.exe
                  TASKLIST
                  3⤵
                  • Enumerates processes with tasklist
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1124
                • C:\Windows\system32\findstr.exe
                  FINDSTR /B /L /I /C:830004.exe
                  3⤵
                    PID:1988
                  • C:\Windows\system32\timeout.exe
                    TIMEOUT /T 1 /NOBREAK
                    3⤵
                    • Delays execution with timeout.exe
                    PID:2016
                  • C:\Windows\system32\tasklist.exe
                    TASKLIST
                    3⤵
                    • Enumerates processes with tasklist
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2032
                  • C:\Windows\system32\findstr.exe
                    FINDSTR /B /L /I /C:830004.exe
                    3⤵
                      PID:688
                    • C:\Windows\system32\timeout.exe
                      TIMEOUT /T 1 /NOBREAK
                      3⤵
                      • Delays execution with timeout.exe
                      PID:1732
                    • C:\Windows\system32\tasklist.exe
                      TASKLIST
                      3⤵
                      • Enumerates processes with tasklist
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1504
                    • C:\Windows\system32\findstr.exe
                      FINDSTR /B /L /I /C:830004.exe
                      3⤵
                        PID:1836
                      • C:\Windows\system32\timeout.exe
                        TIMEOUT /T 1 /NOBREAK
                        3⤵
                        • Delays execution with timeout.exe
                        PID:1248
                      • C:\Windows\system32\tasklist.exe
                        TASKLIST
                        3⤵
                        • Enumerates processes with tasklist
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1704
                      • C:\Windows\system32\findstr.exe
                        FINDSTR /B /L /I /C:830004.exe
                        3⤵
                          PID:1488
                        • C:\Windows\system32\timeout.exe
                          TIMEOUT /T 1 /NOBREAK
                          3⤵
                          • Delays execution with timeout.exe
                          PID:1752
                        • C:\Windows\system32\tasklist.exe
                          TASKLIST
                          3⤵
                          • Enumerates processes with tasklist
                          • Suspicious use of AdjustPrivilegeToken
                          PID:364
                        • C:\Windows\system32\findstr.exe
                          FINDSTR /B /L /I /C:830004.exe
                          3⤵
                            PID:900
                          • C:\Windows\system32\timeout.exe
                            TIMEOUT /T 1 /NOBREAK
                            3⤵
                            • Delays execution with timeout.exe
                            PID:1320
                          • C:\Windows\system32\tasklist.exe
                            TASKLIST
                            3⤵
                            • Enumerates processes with tasklist
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1744
                          • C:\Windows\system32\findstr.exe
                            FINDSTR /B /L /I /C:830004.exe
                            3⤵
                              PID:1932
                            • C:\Windows\system32\timeout.exe
                              TIMEOUT /T 1 /NOBREAK
                              3⤵
                              • Delays execution with timeout.exe
                              PID:1844
                            • C:\Windows\system32\tasklist.exe
                              TASKLIST
                              3⤵
                              • Enumerates processes with tasklist
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1316
                            • C:\Windows\system32\findstr.exe
                              FINDSTR /B /L /I /C:830004.exe
                              3⤵
                                PID:1756
                              • C:\Windows\system32\timeout.exe
                                TIMEOUT /T 1 /NOBREAK
                                3⤵
                                • Delays execution with timeout.exe
                                PID:1924
                              • C:\Windows\system32\tasklist.exe
                                TASKLIST
                                3⤵
                                • Enumerates processes with tasklist
                                • Suspicious use of AdjustPrivilegeToken
                                PID:800
                              • C:\Windows\system32\findstr.exe
                                FINDSTR /B /L /I /C:830004.exe
                                3⤵
                                  PID:2028
                                • C:\Windows\system32\timeout.exe
                                  TIMEOUT /T 1 /NOBREAK
                                  3⤵
                                  • Delays execution with timeout.exe
                                  PID:1540
                                • C:\Windows\system32\tasklist.exe
                                  TASKLIST
                                  3⤵
                                  • Enumerates processes with tasklist
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1612
                                • C:\Windows\system32\findstr.exe
                                  FINDSTR /B /L /I /C:830004.exe
                                  3⤵
                                    PID:1328
                                  • C:\Windows\system32\timeout.exe
                                    TIMEOUT /T 1 /NOBREAK
                                    3⤵
                                    • Delays execution with timeout.exe
                                    PID:2040
                                  • C:\Windows\system32\tasklist.exe
                                    TASKLIST
                                    3⤵
                                    • Enumerates processes with tasklist
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1484
                                  • C:\Windows\system32\findstr.exe
                                    FINDSTR /B /L /I /C:830004.exe
                                    3⤵
                                      PID:2036
                                    • C:\Windows\system32\timeout.exe
                                      TIMEOUT /T 1 /NOBREAK
                                      3⤵
                                      • Delays execution with timeout.exe
                                      PID:1112
                                    • C:\Windows\system32\tasklist.exe
                                      TASKLIST
                                      3⤵
                                      • Enumerates processes with tasklist
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1628
                                    • C:\Windows\system32\findstr.exe
                                      FINDSTR /B /L /I /C:830004.exe
                                      3⤵
                                        PID:1572
                                      • C:\Windows\system32\timeout.exe
                                        TIMEOUT /T 1 /NOBREAK
                                        3⤵
                                        • Delays execution with timeout.exe
                                        PID:1172
                                      • C:\Windows\system32\tasklist.exe
                                        TASKLIST
                                        3⤵
                                        • Enumerates processes with tasklist
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1504
                                      • C:\Windows\system32\findstr.exe
                                        FINDSTR /B /L /I /C:830004.exe
                                        3⤵
                                          PID:1248
                                        • C:\Windows\system32\timeout.exe
                                          TIMEOUT /T 1 /NOBREAK
                                          3⤵
                                          • Delays execution with timeout.exe
                                          PID:892
                                        • C:\Windows\system32\tasklist.exe
                                          TASKLIST
                                          3⤵
                                          • Enumerates processes with tasklist
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1488
                                        • C:\Windows\system32\findstr.exe
                                          FINDSTR /B /L /I /C:830004.exe
                                          3⤵
                                            PID:1652
                                          • C:\Windows\system32\timeout.exe
                                            TIMEOUT /T 1 /NOBREAK
                                            3⤵
                                            • Delays execution with timeout.exe
                                            PID:1396
                                          • C:\Windows\system32\tasklist.exe
                                            TASKLIST
                                            3⤵
                                            • Enumerates processes with tasklist
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:900
                                          • C:\Windows\system32\findstr.exe
                                            FINDSTR /B /L /I /C:830004.exe
                                            3⤵
                                              PID:1320
                                            • C:\Windows\system32\timeout.exe
                                              TIMEOUT /T 1 /NOBREAK
                                              3⤵
                                              • Delays execution with timeout.exe
                                              PID:1568
                                            • C:\Windows\system32\tasklist.exe
                                              TASKLIST
                                              3⤵
                                              • Enumerates processes with tasklist
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:1932
                                            • C:\Windows\system32\findstr.exe
                                              FINDSTR /B /L /I /C:830004.exe
                                              3⤵
                                                PID:1700
                                              • C:\Windows\system32\timeout.exe
                                                TIMEOUT /T 1 /NOBREAK
                                                3⤵
                                                • Delays execution with timeout.exe
                                                PID:1776
                                              • C:\Windows\system32\tasklist.exe
                                                TASKLIST
                                                3⤵
                                                • Enumerates processes with tasklist
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1728
                                              • C:\Windows\system32\findstr.exe
                                                FINDSTR /B /L /I /C:830004.exe
                                                3⤵
                                                  PID:1668
                                                • C:\Windows\system32\timeout.exe
                                                  TIMEOUT /T 1 /NOBREAK
                                                  3⤵
                                                  • Delays execution with timeout.exe
                                                  PID:1180
                                                • C:\Windows\system32\tasklist.exe
                                                  TASKLIST
                                                  3⤵
                                                  • Enumerates processes with tasklist
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:1176
                                                • C:\Windows\system32\findstr.exe
                                                  FINDSTR /B /L /I /C:830004.exe
                                                  3⤵
                                                    PID:1980
                                                  • C:\Windows\system32\timeout.exe
                                                    TIMEOUT /T 1 /NOBREAK
                                                    3⤵
                                                    • Delays execution with timeout.exe
                                                    PID:692
                                                  • C:\Windows\system32\tasklist.exe
                                                    TASKLIST
                                                    3⤵
                                                    • Enumerates processes with tasklist
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:1540
                                                  • C:\Windows\system32\findstr.exe
                                                    FINDSTR /B /L /I /C:830004.exe
                                                    3⤵
                                                      PID:108
                                                    • C:\Windows\system32\timeout.exe
                                                      TIMEOUT /T 1 /NOBREAK
                                                      3⤵
                                                      • Delays execution with timeout.exe
                                                      PID:1612
                                                    • C:\Windows\system32\tasklist.exe
                                                      TASKLIST
                                                      3⤵
                                                      • Enumerates processes with tasklist
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:1328
                                                    • C:\Windows\system32\findstr.exe
                                                      FINDSTR /B /L /I /C:830004.exe
                                                      3⤵
                                                        PID:1416
                                                      • C:\Windows\system32\timeout.exe
                                                        TIMEOUT /T 1 /NOBREAK
                                                        3⤵
                                                        • Delays execution with timeout.exe
                                                        PID:1008
                                                      • C:\Windows\system32\tasklist.exe
                                                        TASKLIST
                                                        3⤵
                                                        • Enumerates processes with tasklist
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:1124
                                                      • C:\Windows\system32\findstr.exe
                                                        FINDSTR /B /L /I /C:830004.exe
                                                        3⤵
                                                          PID:1484
                                                        • C:\Windows\system32\timeout.exe
                                                          TIMEOUT /T 1 /NOBREAK
                                                          3⤵
                                                          • Delays execution with timeout.exe
                                                          PID:1600
                                                        • C:\Windows\system32\findstr.exe
                                                          FINDSTR /B /L /I /C:830004.exe
                                                          3⤵
                                                            PID:624
                                                          • C:\Windows\system32\tasklist.exe
                                                            TASKLIST
                                                            3⤵
                                                            • Enumerates processes with tasklist
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:2032
                                                          • C:\Windows\system32\timeout.exe
                                                            TIMEOUT /T 1 /NOBREAK
                                                            3⤵
                                                            • Delays execution with timeout.exe
                                                            PID:1904
                                                          • C:\Windows\system32\tasklist.exe
                                                            TASKLIST
                                                            3⤵
                                                            • Enumerates processes with tasklist
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:1552
                                                          • C:\Windows\system32\findstr.exe
                                                            FINDSTR /B /L /I /C:830004.exe
                                                            3⤵
                                                              PID:1532
                                                            • C:\Windows\system32\timeout.exe
                                                              TIMEOUT /T 1 /NOBREAK
                                                              3⤵
                                                              • Delays execution with timeout.exe
                                                              PID:1420
                                                            • C:\Windows\system32\tasklist.exe
                                                              TASKLIST
                                                              3⤵
                                                              • Enumerates processes with tasklist
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:1324
                                                            • C:\Windows\system32\findstr.exe
                                                              FINDSTR /B /L /I /C:830004.exe
                                                              3⤵
                                                                PID:828
                                                              • C:\Windows\system32\timeout.exe
                                                                TIMEOUT /T 1 /NOBREAK
                                                                3⤵
                                                                • Delays execution with timeout.exe
                                                                PID:1704
                                                              • C:\Windows\system32\tasklist.exe
                                                                TASKLIST
                                                                3⤵
                                                                • Enumerates processes with tasklist
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:892
                                                              • C:\Windows\system32\findstr.exe
                                                                FINDSTR /B /L /I /C:830004.exe
                                                                3⤵
                                                                  PID:1472
                                                                • C:\Windows\system32\timeout.exe
                                                                  TIMEOUT /T 1 /NOBREAK
                                                                  3⤵
                                                                  • Delays execution with timeout.exe
                                                                  PID:972
                                                                • C:\Windows\system32\tasklist.exe
                                                                  TASKLIST
                                                                  3⤵
                                                                  • Enumerates processes with tasklist
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:1652
                                                                • C:\Windows\system32\findstr.exe
                                                                  FINDSTR /B /L /I /C:830004.exe
                                                                  3⤵
                                                                    PID:960
                                                                  • C:\Windows\system32\timeout.exe
                                                                    TIMEOUT /T 1 /NOBREAK
                                                                    3⤵
                                                                    • Delays execution with timeout.exe
                                                                    PID:1152
                                                                  • C:\Windows\system32\findstr.exe
                                                                    FINDSTR /B /L /I /C:830004.exe
                                                                    3⤵
                                                                      PID:900
                                                                    • C:\Windows\system32\tasklist.exe
                                                                      TASKLIST
                                                                      3⤵
                                                                      • Enumerates processes with tasklist
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:896
                                                                    • C:\Windows\system32\timeout.exe
                                                                      TIMEOUT /T 1 /NOBREAK
                                                                      3⤵
                                                                      • Delays execution with timeout.exe
                                                                      PID:1748
                                                                    • C:\Windows\system32\tasklist.exe
                                                                      TASKLIST
                                                                      3⤵
                                                                      • Enumerates processes with tasklist
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:1212
                                                                    • C:\Windows\system32\findstr.exe
                                                                      FINDSTR /B /L /I /C:830004.exe
                                                                      3⤵
                                                                        PID:1844
                                                                      • C:\Windows\system32\timeout.exe
                                                                        TIMEOUT /T 1 /NOBREAK
                                                                        3⤵
                                                                        • Delays execution with timeout.exe
                                                                        PID:752
                                                                      • C:\Windows\system32\tasklist.exe
                                                                        TASKLIST
                                                                        3⤵
                                                                        • Enumerates processes with tasklist
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:1924
                                                                      • C:\Windows\system32\findstr.exe
                                                                        FINDSTR /B /L /I /C:830004.exe
                                                                        3⤵
                                                                          PID:1316
                                                                        • C:\Windows\system32\timeout.exe
                                                                          TIMEOUT /T 1 /NOBREAK
                                                                          3⤵
                                                                          • Delays execution with timeout.exe
                                                                          PID:820
                                                                        • C:\Windows\system32\tasklist.exe
                                                                          TASKLIST
                                                                          3⤵
                                                                          • Enumerates processes with tasklist
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:2028
                                                                        • C:\Windows\system32\findstr.exe
                                                                          FINDSTR /B /L /I /C:830004.exe
                                                                          3⤵
                                                                            PID:452
                                                                          • C:\Windows\system32\timeout.exe
                                                                            TIMEOUT /T 1 /NOBREAK
                                                                            3⤵
                                                                            • Delays execution with timeout.exe
                                                                            PID:308
                                                                          • C:\Windows\system32\tasklist.exe
                                                                            TASKLIST
                                                                            3⤵
                                                                            • Enumerates processes with tasklist
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:1344
                                                                          • C:\Windows\system32\findstr.exe
                                                                            FINDSTR /B /L /I /C:830004.exe
                                                                            3⤵
                                                                              PID:748
                                                                            • C:\Windows\system32\timeout.exe
                                                                              TIMEOUT /T 1 /NOBREAK
                                                                              3⤵
                                                                              • Delays execution with timeout.exe
                                                                              PID:540
                                                                            • C:\Windows\system32\findstr.exe
                                                                              FINDSTR /B /L /I /C:830004.exe
                                                                              3⤵
                                                                                PID:2040
                                                                              • C:\Windows\system32\tasklist.exe
                                                                                TASKLIST
                                                                                3⤵
                                                                                • Enumerates processes with tasklist
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:1336
                                                                              • C:\Windows\system32\timeout.exe
                                                                                TIMEOUT /T 1 /NOBREAK
                                                                                3⤵
                                                                                • Delays execution with timeout.exe
                                                                                PID:1732
                                                                              • C:\Windows\system32\tasklist.exe
                                                                                TASKLIST
                                                                                3⤵
                                                                                • Enumerates processes with tasklist
                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                PID:2016
                                                                              • C:\Windows\system32\findstr.exe
                                                                                FINDSTR /B /L /I /C:830004.exe
                                                                                3⤵
                                                                                  PID:1484
                                                                                • C:\Windows\system32\timeout.exe
                                                                                  TIMEOUT /T 1 /NOBREAK
                                                                                  3⤵
                                                                                  • Delays execution with timeout.exe
                                                                                  PID:1908
                                                                                • C:\Windows\system32\tasklist.exe
                                                                                  TASKLIST
                                                                                  3⤵
                                                                                  • Enumerates processes with tasklist
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:1372
                                                                                • C:\Windows\system32\findstr.exe
                                                                                  FINDSTR /B /L /I /C:830004.exe
                                                                                  3⤵
                                                                                    PID:1036
                                                                                  • C:\Windows\system32\timeout.exe
                                                                                    TIMEOUT /T 1 /NOBREAK
                                                                                    3⤵
                                                                                    • Delays execution with timeout.exe
                                                                                    PID:828
                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                    TASKLIST
                                                                                    3⤵
                                                                                    • Enumerates processes with tasklist
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:1704
                                                                                  • C:\Windows\system32\findstr.exe
                                                                                    FINDSTR /B /L /I /C:830004.exe
                                                                                    3⤵
                                                                                      PID:1456
                                                                                    • C:\Windows\system32\timeout.exe
                                                                                      TIMEOUT /T 1 /NOBREAK
                                                                                      3⤵
                                                                                      • Delays execution with timeout.exe
                                                                                      PID:1472
                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                      TASKLIST
                                                                                      3⤵
                                                                                      • Enumerates processes with tasklist
                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                      PID:1476
                                                                                    • C:\Windows\system32\findstr.exe
                                                                                      FINDSTR /B /L /I /C:830004.exe
                                                                                      3⤵
                                                                                        PID:972
                                                                                      • C:\Windows\system32\timeout.exe
                                                                                        TIMEOUT /T 1 /NOBREAK
                                                                                        3⤵
                                                                                        • Delays execution with timeout.exe
                                                                                        PID:1460
                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                        TASKLIST
                                                                                        3⤵
                                                                                        • Enumerates processes with tasklist
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:960
                                                                                      • C:\Windows\system32\findstr.exe
                                                                                        FINDSTR /B /L /I /C:830004.exe
                                                                                        3⤵
                                                                                          PID:1152
                                                                                        • C:\Windows\system32\timeout.exe
                                                                                          TIMEOUT /T 1 /NOBREAK
                                                                                          3⤵
                                                                                          • Delays execution with timeout.exe
                                                                                          PID:552
                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                          TASKLIST
                                                                                          3⤵
                                                                                          • Enumerates processes with tasklist
                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                          PID:1776
                                                                                        • C:\Windows\system32\findstr.exe
                                                                                          FINDSTR /B /L /I /C:830004.exe
                                                                                          3⤵
                                                                                            PID:1772
                                                                                          • C:\Windows\system32\timeout.exe
                                                                                            TIMEOUT /T 1 /NOBREAK
                                                                                            3⤵
                                                                                            • Delays execution with timeout.exe
                                                                                            PID:1720
                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                            TASKLIST
                                                                                            3⤵
                                                                                            • Enumerates processes with tasklist
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:1676
                                                                                          • C:\Windows\system32\findstr.exe
                                                                                            FINDSTR /B /L /I /C:830004.exe
                                                                                            3⤵
                                                                                              PID:1668
                                                                                            • C:\Windows\system32\timeout.exe
                                                                                              TIMEOUT /T 1 /NOBREAK
                                                                                              3⤵
                                                                                              • Delays execution with timeout.exe
                                                                                              PID:580
                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                              TASKLIST
                                                                                              3⤵
                                                                                              • Enumerates processes with tasklist
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:800
                                                                                            • C:\Windows\system32\findstr.exe
                                                                                              FINDSTR /B /L /I /C:830004.exe
                                                                                              3⤵
                                                                                                PID:1980
                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                TIMEOUT /T 1 /NOBREAK
                                                                                                3⤵
                                                                                                • Delays execution with timeout.exe
                                                                                                PID:2028
                                                                                              • C:\Windows\system32\findstr.exe
                                                                                                FINDSTR /B /L /I /C:830004.exe
                                                                                                3⤵
                                                                                                  PID:744
                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                  TASKLIST
                                                                                                  3⤵
                                                                                                  • Enumerates processes with tasklist
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:1064
                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                  TIMEOUT /T 1 /NOBREAK
                                                                                                  3⤵
                                                                                                  • Delays execution with timeout.exe
                                                                                                  PID:1344
                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                  TASKLIST
                                                                                                  3⤵
                                                                                                  • Enumerates processes with tasklist
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:1332
                                                                                                • C:\Windows\system32\findstr.exe
                                                                                                  FINDSTR /B /L /I /C:830004.exe
                                                                                                  3⤵
                                                                                                    PID:540
                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                    TIMEOUT /T 1 /NOBREAK
                                                                                                    3⤵
                                                                                                    • Delays execution with timeout.exe
                                                                                                    PID:1328
                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                    TASKLIST
                                                                                                    3⤵
                                                                                                    • Enumerates processes with tasklist
                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                    PID:2040
                                                                                                  • C:\Windows\system32\findstr.exe
                                                                                                    FINDSTR /B /L /I /C:830004.exe
                                                                                                    3⤵
                                                                                                      PID:1732
                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                      TIMEOUT /T 1 /NOBREAK
                                                                                                      3⤵
                                                                                                      • Delays execution with timeout.exe
                                                                                                      PID:1664
                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                      TASKLIST
                                                                                                      3⤵
                                                                                                      • Enumerates processes with tasklist
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:1892
                                                                                                    • C:\Windows\system32\findstr.exe
                                                                                                      FINDSTR /B /L /I /C:830004.exe
                                                                                                      3⤵
                                                                                                        PID:1908
                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                        TIMEOUT /T 1 /NOBREAK
                                                                                                        3⤵
                                                                                                        • Delays execution with timeout.exe
                                                                                                        PID:1380
                                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                                        TASKLIST
                                                                                                        3⤵
                                                                                                        • Enumerates processes with tasklist
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:1372
                                                                                                      • C:\Windows\system32\findstr.exe
                                                                                                        FINDSTR /B /L /I /C:830004.exe
                                                                                                        3⤵
                                                                                                          PID:1632
                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                          TIMEOUT /T 1 /NOBREAK
                                                                                                          3⤵
                                                                                                          • Delays execution with timeout.exe
                                                                                                          PID:156
                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                          TASKLIST
                                                                                                          3⤵
                                                                                                          • Enumerates processes with tasklist
                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                          PID:1236
                                                                                                        • C:\Windows\system32\findstr.exe
                                                                                                          FINDSTR /B /L /I /C:830004.exe
                                                                                                          3⤵
                                                                                                            PID:1704
                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                            TIMEOUT /T 1 /NOBREAK
                                                                                                            3⤵
                                                                                                            • Delays execution with timeout.exe
                                                                                                            PID:1488
                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                            TASKLIST
                                                                                                            3⤵
                                                                                                            • Enumerates processes with tasklist
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:1396
                                                                                                          • C:\Windows\system32\findstr.exe
                                                                                                            FINDSTR /B /L /I /C:830004.exe
                                                                                                            3⤵
                                                                                                              PID:316
                                                                                                            • C:\Windows\system32\timeout.exe
                                                                                                              TIMEOUT /T 1 /NOBREAK
                                                                                                              3⤵
                                                                                                              • Delays execution with timeout.exe
                                                                                                              PID:328
                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                              TASKLIST
                                                                                                              3⤵
                                                                                                              • Enumerates processes with tasklist
                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                              PID:560
                                                                                                            • C:\Windows\system32\findstr.exe
                                                                                                              FINDSTR /B /L /I /C:830004.exe
                                                                                                              3⤵
                                                                                                                PID:1480
                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                TIMEOUT /T 1 /NOBREAK
                                                                                                                3⤵
                                                                                                                • Delays execution with timeout.exe
                                                                                                                PID:1532
                                                                                                              • C:\Windows\system32\tasklist.exe
                                                                                                                TASKLIST
                                                                                                                3⤵
                                                                                                                • Enumerates processes with tasklist
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:1588
                                                                                                              • C:\Windows\system32\findstr.exe
                                                                                                                FINDSTR /B /L /I /C:830004.exe
                                                                                                                3⤵
                                                                                                                  PID:1568
                                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                                  TIMEOUT /T 1 /NOBREAK
                                                                                                                  3⤵
                                                                                                                  • Delays execution with timeout.exe
                                                                                                                  PID:752
                                                                                                                • C:\Windows\system32\tasklist.exe
                                                                                                                  TASKLIST
                                                                                                                  3⤵
                                                                                                                  • Enumerates processes with tasklist
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:1096
                                                                                                                • C:\Windows\system32\findstr.exe
                                                                                                                  FINDSTR /B /L /I /C:830004.exe
                                                                                                                  3⤵
                                                                                                                    PID:1932
                                                                                                                  • C:\Windows\system32\timeout.exe
                                                                                                                    TIMEOUT /T 1 /NOBREAK
                                                                                                                    3⤵
                                                                                                                    • Delays execution with timeout.exe
                                                                                                                    PID:576
                                                                                                                  • C:\Windows\system32\tasklist.exe
                                                                                                                    TASKLIST
                                                                                                                    3⤵
                                                                                                                    • Enumerates processes with tasklist
                                                                                                                    PID:1756
                                                                                                                  • C:\Windows\system32\findstr.exe
                                                                                                                    FINDSTR /B /L /I /C:830004.exe
                                                                                                                    3⤵
                                                                                                                      PID:680
                                                                                                                    • C:\Windows\system32\timeout.exe
                                                                                                                      TIMEOUT /T 1 /NOBREAK
                                                                                                                      3⤵
                                                                                                                      • Delays execution with timeout.exe
                                                                                                                      PID:872
                                                                                                                    • C:\Windows\system32\tasklist.exe
                                                                                                                      TASKLIST
                                                                                                                      3⤵
                                                                                                                      • Enumerates processes with tasklist
                                                                                                                      PID:1232
                                                                                                                    • C:\Windows\system32\findstr.exe
                                                                                                                      FINDSTR /B /L /I /C:830004.exe
                                                                                                                      3⤵
                                                                                                                        PID:1636
                                                                                                                      • C:\Windows\system32\timeout.exe
                                                                                                                        TIMEOUT /T 1 /NOBREAK
                                                                                                                        3⤵
                                                                                                                        • Delays execution with timeout.exe
                                                                                                                        PID:1108
                                                                                                                      • C:\Windows\system32\tasklist.exe
                                                                                                                        TASKLIST
                                                                                                                        3⤵
                                                                                                                        • Enumerates processes with tasklist
                                                                                                                        PID:1540
                                                                                                                      • C:\Windows\system32\findstr.exe
                                                                                                                        FINDSTR /B /L /I /C:830004.exe
                                                                                                                        3⤵
                                                                                                                          PID:108
                                                                                                                        • C:\Windows\system32\timeout.exe
                                                                                                                          TIMEOUT /T 1 /NOBREAK
                                                                                                                          3⤵
                                                                                                                          • Delays execution with timeout.exe
                                                                                                                          PID:1988
                                                                                                                        • C:\Windows\system32\tasklist.exe
                                                                                                                          TASKLIST
                                                                                                                          3⤵
                                                                                                                          • Enumerates processes with tasklist
                                                                                                                          PID:960
                                                                                                                        • C:\Windows\system32\findstr.exe
                                                                                                                          FINDSTR /B /L /I /C:830004.exe
                                                                                                                          3⤵
                                                                                                                            PID:1568
                                                                                                                          • C:\Windows\system32\timeout.exe
                                                                                                                            TIMEOUT /T 1 /NOBREAK
                                                                                                                            3⤵
                                                                                                                            • Delays execution with timeout.exe
                                                                                                                            PID:1700
                                                                                                                          • C:\Windows\system32\tasklist.exe
                                                                                                                            TASKLIST
                                                                                                                            3⤵
                                                                                                                            • Enumerates processes with tasklist
                                                                                                                            PID:1668
                                                                                                                          • C:\Windows\system32\findstr.exe
                                                                                                                            FINDSTR /B /L /I /C:830004.exe
                                                                                                                            3⤵
                                                                                                                              PID:1756
                                                                                                                            • C:\Windows\system32\timeout.exe
                                                                                                                              TIMEOUT /T 1 /NOBREAK
                                                                                                                              3⤵
                                                                                                                              • Delays execution with timeout.exe
                                                                                                                              PID:820
                                                                                                                            • C:\Windows\system32\tasklist.exe
                                                                                                                              TASKLIST
                                                                                                                              3⤵
                                                                                                                              • Enumerates processes with tasklist
                                                                                                                              PID:1636
                                                                                                                            • C:\Windows\system32\findstr.exe
                                                                                                                              FINDSTR /B /L /I /C:830004.exe
                                                                                                                              3⤵
                                                                                                                                PID:1108
                                                                                                                              • C:\Windows\system32\timeout.exe
                                                                                                                                TIMEOUT /T 1 /NOBREAK
                                                                                                                                3⤵
                                                                                                                                • Delays execution with timeout.exe
                                                                                                                                PID:1612
                                                                                                                              • C:\Windows\system32\tasklist.exe
                                                                                                                                TASKLIST
                                                                                                                                3⤵
                                                                                                                                • Enumerates processes with tasklist
                                                                                                                                PID:108
                                                                                                                              • C:\Windows\system32\findstr.exe
                                                                                                                                FINDSTR /B /L /I /C:830004.exe
                                                                                                                                3⤵
                                                                                                                                  PID:1736
                                                                                                                                • C:\Windows\system32\timeout.exe
                                                                                                                                  TIMEOUT /T 1 /NOBREAK
                                                                                                                                  3⤵
                                                                                                                                  • Delays execution with timeout.exe
                                                                                                                                  PID:1328
                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c reg add hklm\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityUpdate /t REG_EXPAND_SZ /d C:\Users\Admin\AppData\Local\Temp\830004.exe /f
                                                                                                                                2⤵
                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                PID:1420
                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                  reg add hklm\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityUpdate /t REG_EXPAND_SZ /d C:\Users\Admin\AppData\Local\Temp\830004.exe /f
                                                                                                                                  3⤵
                                                                                                                                  • Adds Run key to start application
                                                                                                                                  • Modifies registry key
                                                                                                                                  PID:1596
                                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c net config server /autodisconnect:-1
                                                                                                                                2⤵
                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                PID:1752
                                                                                                                                • C:\Windows\system32\net.exe
                                                                                                                                  net config server /autodisconnect:-1
                                                                                                                                  3⤵
                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                  PID:1432
                                                                                                                                  • C:\Windows\system32\net1.exe
                                                                                                                                    C:\Windows\system32\net1 config server /autodisconnect:-1
                                                                                                                                    4⤵
                                                                                                                                      PID:892
                                                                                                                                • C:\Windows\explorer.exe
                                                                                                                                  explorer.exe .\readme_for_unlock.txt
                                                                                                                                  2⤵
                                                                                                                                    PID:1416
                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c vssadmin delete shadows /All /quiet
                                                                                                                                    2⤵
                                                                                                                                      PID:844
                                                                                                                                      • C:\Windows\system32\vssadmin.exe
                                                                                                                                        vssadmin delete shadows /All /quiet
                                                                                                                                        3⤵
                                                                                                                                        • Interacts with shadow copies
                                                                                                                                        PID:1624
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      cmd /c C:\Users\Admin\AppData\Local\Temp\5n7Q5j3t3.bat
                                                                                                                                      2⤵
                                                                                                                                        PID:688
                                                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                                                          TASKKILL /F /IM 830004.exe.exe
                                                                                                                                          3⤵
                                                                                                                                          • Kills process with taskkill
                                                                                                                                          PID:828
                                                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                                                          TASKKILL /F /IM 830004.exe.exe
                                                                                                                                          3⤵
                                                                                                                                          • Kills process with taskkill
                                                                                                                                          PID:1936
                                                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                                                          TASKKILL /F /IM 830004.exe.exe
                                                                                                                                          3⤵
                                                                                                                                          • Kills process with taskkill
                                                                                                                                          PID:1320
                                                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                                                          TASKKILL /F /IM 830004.exe.exe
                                                                                                                                          3⤵
                                                                                                                                          • Kills process with taskkill
                                                                                                                                          PID:1532
                                                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                                                          TASKKILL /F /IM 830004.exe.exe
                                                                                                                                          3⤵
                                                                                                                                          • Kills process with taskkill
                                                                                                                                          PID:1928
                                                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                                                          TASKKILL /F /IM 830004.exe.exe
                                                                                                                                          3⤵
                                                                                                                                          • Kills process with taskkill
                                                                                                                                          PID:1180
                                                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                                                          TASKKILL /F /IM 830004.exe.exe
                                                                                                                                          3⤵
                                                                                                                                          • Kills process with taskkill
                                                                                                                                          PID:756
                                                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                                                          TASKKILL /F /IM 830004.exe.exe
                                                                                                                                          3⤵
                                                                                                                                          • Kills process with taskkill
                                                                                                                                          PID:1772
                                                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                                                          TASKKILL /F /IM 830004.exe.exe
                                                                                                                                          3⤵
                                                                                                                                          • Kills process with taskkill
                                                                                                                                          PID:680
                                                                                                                                        • C:\Windows\system32\taskkill.exe
                                                                                                                                          TASKKILL /F /IM 830004.exe.exe
                                                                                                                                          3⤵
                                                                                                                                          • Kills process with taskkill
                                                                                                                                          PID:204
                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\6a9I6o3y5.bat
                                                                                                                                          3⤵
                                                                                                                                            PID:232
                                                                                                                                      • C:\Windows\system32\DllHost.exe
                                                                                                                                        C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
                                                                                                                                        1⤵
                                                                                                                                          PID:1904
                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                          C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                          1⤵
                                                                                                                                          • Modifies Internet Explorer settings
                                                                                                                                          • Modifies registry class
                                                                                                                                          PID:1600
                                                                                                                                        • C:\Windows\system32\vssvc.exe
                                                                                                                                          C:\Windows\system32\vssvc.exe
                                                                                                                                          1⤵
                                                                                                                                            PID:1908

                                                                                                                                          Network

                                                                                                                                          MITRE ATT&CK Matrix ATT&CK v6

                                                                                                                                          Initial Access

                                                                                                                                          Execution

                                                                                                                                          Persistence

                                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                                          1
                                                                                                                                          T1060

                                                                                                                                          Privilege Escalation

                                                                                                                                          Defense Evasion

                                                                                                                                          File Deletion

                                                                                                                                          2
                                                                                                                                          T1107

                                                                                                                                          Modify Registry

                                                                                                                                          3
                                                                                                                                          T1112

                                                                                                                                          Credential Access

                                                                                                                                          Credentials in Files

                                                                                                                                          1
                                                                                                                                          T1081

                                                                                                                                          Discovery

                                                                                                                                          Query Registry

                                                                                                                                          1
                                                                                                                                          T1012

                                                                                                                                          Peripheral Device Discovery

                                                                                                                                          1
                                                                                                                                          T1120

                                                                                                                                          System Information Discovery

                                                                                                                                          1
                                                                                                                                          T1082

                                                                                                                                          Process Discovery

                                                                                                                                          1
                                                                                                                                          T1057

                                                                                                                                          Lateral Movement

                                                                                                                                          Collection

                                                                                                                                          Data from Local System

                                                                                                                                          1
                                                                                                                                          T1005

                                                                                                                                          Exfiltration

                                                                                                                                          Command and Control

                                                                                                                                          Impact

                                                                                                                                          Inhibit System Recovery

                                                                                                                                          2
                                                                                                                                          T1490

                                                                                                                                          Replay Monitor

                                                                                                                                          Loading Replay Monitor...

                                                                                                                                          Downloads

                                                                                                                                          • C:\ProgramData\Microsoft\Settings\4g8D6x6k9.bat
                                                                                                                                            Filesize

                                                                                                                                            163B

                                                                                                                                            MD5

                                                                                                                                            3578e838f655c9bd9426651cc13f6a84

                                                                                                                                            SHA1

                                                                                                                                            10b312cca508e1958507cd3f8a6feae72f6a3a3d

                                                                                                                                            SHA256

                                                                                                                                            42f5a94a41364f4ab334ab6bf3638b1861d3a10b7684df6e5968567ca5027bde

                                                                                                                                            SHA512

                                                                                                                                            4ccd6320fe0eb7dccd3b322ffbb94b9f718123dec2781f9f9404e3c520628f8f9d544b88189dda079a8f431cebdecc7a3cd94e37d21eb9257fdc65408465a995

                                                                                                                                            Download Submit
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\5n7Q5j3t3.bat
                                                                                                                                            Filesize

                                                                                                                                            1.0MB

                                                                                                                                            MD5

                                                                                                                                            8be4f44d1ff4adadd6eb288744075886

                                                                                                                                            SHA1

                                                                                                                                            9f7e1ab5de532eb3ce683a7ec9e63ceda9577a36

                                                                                                                                            SHA256

                                                                                                                                            53fabf81e4db5654817bcdfbbe6cac96ec763ae1e9692e0f01f0e768f52478dc

                                                                                                                                            SHA512

                                                                                                                                            8ca0226335cad5dce101a88032a8203c7dd5b574a8acdb416c05b26ada4988a13d904fc956af89469cabe92b350948a327d8509eaf757a5fcb020d3c8cb8e6a5

                                                                                                                                            Download Submit
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\6a9I6o3y5.bat
                                                                                                                                            Filesize

                                                                                                                                            56B

                                                                                                                                            MD5

                                                                                                                                            c1c96250e2d9b4b03a0a805952467b3d

                                                                                                                                            SHA1

                                                                                                                                            c7d3e1d97525e29245735acddcf290835dfe0e89

                                                                                                                                            SHA256

                                                                                                                                            142deb583f865af0134063d85ad5a1742a29748617d5200c40f6473ec047252a

                                                                                                                                            SHA512

                                                                                                                                            225ac0d6a190c74c0a05abea5a34c9abcc299da7db69a333449d04dfc6b66c6e6952137b6ed992626e2cdee69016e35f7099506e633bd0b5124c58b7b8d46323

                                                                                                                                            Download Submit
                                                                                                                                          • C:\Users\Admin\Documents\Are.docx.crypt
                                                                                                                                            Filesize

                                                                                                                                            11KB

                                                                                                                                            MD5

                                                                                                                                            c8e603fda2594edb44d562541cebeaf5

                                                                                                                                            SHA1

                                                                                                                                            8fce177f4fc54125d7d6e47330d50d0361820b54

                                                                                                                                            SHA256

                                                                                                                                            2748219fdbd283dcf9360030b9b129c262d1b9db0a2d99f7ef57bcd4dd309f32

                                                                                                                                            SHA512

                                                                                                                                            6f15b2fd8a3041365fa7f2b14fb9a49571b133f09097062762f6b4dc3d77dce33f951348fbd80f60d38650620c414e7313fbae65c29ea93c7f016eb779bb8998

                                                                                                                                            Download Submit
                                                                                                                                          • C:\Users\Admin\Documents\AssertEnter.odt.crypt
                                                                                                                                            Filesize

                                                                                                                                            604KB

                                                                                                                                            MD5

                                                                                                                                            a453fe04a1ea92bc5da93b7cbd634310

                                                                                                                                            SHA1

                                                                                                                                            3cb473f91c54ba19de52851d1ffa0072c6e87ca1

                                                                                                                                            SHA256

                                                                                                                                            76f5735764445b15b09a48ae8e8f7e70bce3559c65d8ae5fc88acf62acac0288

                                                                                                                                            SHA512

                                                                                                                                            1bff73a1547b8860e93a72a5129e5c5e9c1303cd7de909e76da3f9802e284fd611b8fa96782ef2936661630b57ad4fa28d0f5383cbb10474b6576c03fe74c278

                                                                                                                                            Download Submit
                                                                                                                                          • C:\Users\Admin\Documents\BackupGroup.vdw.crypt
                                                                                                                                            Filesize

                                                                                                                                            698KB

                                                                                                                                            MD5

                                                                                                                                            38fb1538a0a8340c82b1643baa9357c5

                                                                                                                                            SHA1

                                                                                                                                            fdf4172765a9b7a382862dc86d8caf0299cb7ab6

                                                                                                                                            SHA256

                                                                                                                                            45067a0c67dba5480bbeda5a3730194276cdccdcf1b83f3bedd2b659c5aaf579

                                                                                                                                            SHA512

                                                                                                                                            6aca60fc0f5597acbf59aa4edc62478cf40e6e5879ae7500826b20c5f4f9c65500aea8df90379593f90537a7a4207ccb263297a684e68e42d3bad9fcd3448da0

                                                                                                                                            Download Submit
                                                                                                                                          • C:\Users\Admin\Documents\CheckpointMeasure.pot.crypt
                                                                                                                                            Filesize

                                                                                                                                            954KB

                                                                                                                                            MD5

                                                                                                                                            a239cd8b78daa94b70710a5f6444551d

                                                                                                                                            SHA1

                                                                                                                                            4485a15a3bce9bb36e3d815433697da086a1bec1

                                                                                                                                            SHA256

                                                                                                                                            d820a91e86e0ce62f25b534c04bea8fe9dc16f2ceaaf9b40dd25875121897f25

                                                                                                                                            SHA512

                                                                                                                                            75d3e23853a7a3d7f1da7dfe9b3af67431401a969de3687b8ecbaae956b983435a0189e5aca645e473f6042df0002225822775984276080ff1e409cd5210b6e4

                                                                                                                                            Download Submit
                                                                                                                                          • C:\Users\Admin\Documents\CompleteInvoke.vst.crypt
                                                                                                                                            Filesize

                                                                                                                                            644KB

                                                                                                                                            MD5

                                                                                                                                            2e206f28caaafc621d4506b77487ccb1

                                                                                                                                            SHA1

                                                                                                                                            f91579f942570d2815618b10b295f15f132287e5

                                                                                                                                            SHA256

                                                                                                                                            18b54e373086d8a4018183ad8f30b278e759160b944cfb0d3b7fdcf64641d94b

                                                                                                                                            SHA512

                                                                                                                                            8a328fe286b6bbee46f396255ff55ea02125ccef59c9476c53e0fe3667d84c493b4351e6034c5ca0d293374f5597e30427ddb104a1f21f9fc792f72bf04b1660

                                                                                                                                            Download Submit
                                                                                                                                          • C:\Users\Admin\Documents\CompleteSuspend.pptm.crypt
                                                                                                                                            Filesize

                                                                                                                                            403KB

                                                                                                                                            MD5

                                                                                                                                            6a772b6ed60888b6376730f9e8e647e5

                                                                                                                                            SHA1

                                                                                                                                            240ec734b20d800194bc17f302778997c244d8a6

                                                                                                                                            SHA256

                                                                                                                                            aaddcbfc90e283dfbd7e156acce77eefff9f8d52d2935f3c3139982cd419cbb0

                                                                                                                                            SHA512

                                                                                                                                            266eb823081b0554b76bef03cbdbebe0bc9b6f02dc07803d08a75b0c0bc869fe524c5ada327b0c2d9d8bad259eb3148dd84f94a1edd9170270d400d78955dc44

                                                                                                                                            Download Submit
                                                                                                                                          • C:\Users\Admin\Documents\ConvertCheckpoint.ppt.crypt
                                                                                                                                            Filesize

                                                                                                                                            685KB

                                                                                                                                            MD5

                                                                                                                                            2a62ae04624f5ea50aa7615adecdbad0

                                                                                                                                            SHA1

                                                                                                                                            c2ccfac8e076fbe6fcddd0d54ecb0ab8a7eaa95b

                                                                                                                                            SHA256

                                                                                                                                            36ce22f7db1f6226f9964f6714e79e6578704493e99304c7b94ab55b6c5097b1

                                                                                                                                            SHA512

                                                                                                                                            9fb6b591a8c482acc911cf8c0629993c5de805a846821b9f3c975fdf6ef48d280d040f291eb0f627f381493c26d7acb406662024c691a8d5d7d2231de195b8f3

                                                                                                                                            Download Submit
                                                                                                                                          • C:\Users\Admin\Documents\ConvertInstall.vsx.crypt
                                                                                                                                            Filesize

                                                                                                                                            309KB

                                                                                                                                            MD5

                                                                                                                                            2d41fb82d6772eb43b584668db1c21bd

                                                                                                                                            SHA1

                                                                                                                                            fb8cd769a9075f399fe7460b67e956e656f7ec65

                                                                                                                                            SHA256

                                                                                                                                            4dfa9090c216dc37ef075a16006e72d4741486031392125c6f8f66d9fb9b00d5

                                                                                                                                            SHA512

                                                                                                                                            2897c467ba242f75b726f473396d5f77ffb37865809a68f361246dc9fd8e0bf67c4a86e2fde8ce395b5bf90a7cefbafc751ed0cb2e2f6f54f8cc7f8fe20025d7

                                                                                                                                            Download Submit
                                                                                                                                          • C:\Users\Admin\Documents\ConvertUse.vstm.crypt
                                                                                                                                            Filesize

                                                                                                                                            550KB

                                                                                                                                            MD5

                                                                                                                                            d6d15f8e000991e8b02dd8de6eef4a18

                                                                                                                                            SHA1

                                                                                                                                            8f173b724c56a0610ba66002babdbb4c99723c7b

                                                                                                                                            SHA256

                                                                                                                                            1312ab2ada863fe0cb4ce465124e0f2d7902a8e47b20883e2137d3c36f9baf6c

                                                                                                                                            SHA512

                                                                                                                                            d0701fa254d7390e6cb7efe611e6f5f818c8f3976782f85c130bff8f5d210aaf0e3c3bdabce272d3520e9bc34ab8f79cac048a21c7162de4347b2722b1d62557

                                                                                                                                            Download Submit
                                                                                                                                          • C:\Users\Admin\Documents\DebugEdit.ods.crypt
                                                                                                                                            Filesize

                                                                                                                                            510KB

                                                                                                                                            MD5

                                                                                                                                            daf80d0fb3d68e5f80cec49c5acb3655

                                                                                                                                            SHA1

                                                                                                                                            9969ea0dad9e122a783c317d1c5837d0101a7735

                                                                                                                                            SHA256

                                                                                                                                            ae6af4b27adc53297824aeb6f33867b8600c3d2bee4f10f4e976a674344c1055

                                                                                                                                            SHA512

                                                                                                                                            b5c772688f0ff30864efe2a031ba61b629bb678c0c3b63ea05235bf24ce40ea6242d53af387da3fe299b890ce9ef80f05bae23c8f08d81e95e112eef7f998b1f

                                                                                                                                            Download Submit
                                                                                                                                          • C:\Users\Admin\Documents\DisableSearch.vstm.crypt
                                                                                                                                            Filesize

                                                                                                                                            658KB

                                                                                                                                            MD5

                                                                                                                                            196fcce82c2ccfb3a1b5dd1d7fc6691c

                                                                                                                                            SHA1

                                                                                                                                            2f2d133a771a884d6ccf6ca24a6f467777825b1a

                                                                                                                                            SHA256

                                                                                                                                            812d4f424a9e112df028016d281cae022cdb9a8428b4c6f504f6521689628b4a

                                                                                                                                            SHA512

                                                                                                                                            ab622d2303f75b4f1caf30d2b604b5f1e4d0fa1150e5b7abbc97ab0c65a72af7fe3bb5443931cb76d34baec0061984dbf0af94b7d1679d9aac8f02b4112cfe92

                                                                                                                                            Download Submit
                                                                                                                                          • C:\Users\Admin\Documents\EditReset.potm.crypt
                                                                                                                                            Filesize

                                                                                                                                            430KB

                                                                                                                                            MD5

                                                                                                                                            c79acb7024fa87f80a675d4a6dc651ee

                                                                                                                                            SHA1

                                                                                                                                            42728cfa3c76077d11067a82225183ed5fb28fe0

                                                                                                                                            SHA256

                                                                                                                                            6bf4a4ac1096831ad9de60e2ba5eafa929e4e7c671efadf83f0f0febdb42d3ea

                                                                                                                                            SHA512

                                                                                                                                            c8596684086cb8e3d6b44cc6211ae3c4d1bb36ce8a85aa1976f09445111e096e562166f73a9082d52b1cd656174c6915f34970852b7a677b67c48df6d91da629

                                                                                                                                            Download Submit
                                                                                                                                          • C:\Users\Admin\Documents\EnableInvoke.xltx.crypt
                                                                                                                                            Filesize

                                                                                                                                            591KB

                                                                                                                                            MD5

                                                                                                                                            522ac0f596445019c1ca49fb2db8e89d

                                                                                                                                            SHA1

                                                                                                                                            46e8acd62ef5487798e403c273bfffa344c1d176

                                                                                                                                            SHA256

                                                                                                                                            6eb97568c28b36f0a587346b9e709e0f5015485e205e8e1dcdbbb0fa3d064d86

                                                                                                                                            SHA512

                                                                                                                                            11a76b307f027b2389124a188d8ced3fbf32792363cd1af317544e489e0d08e39041e9c7ffbdec457602bcf2048c42e9d75505fb2cac010fde4cd99855873e1b

                                                                                                                                            Download Submit
                                                                                                                                          • C:\Users\Admin\Documents\ExportSet.pot.crypt
                                                                                                                                            Filesize

                                                                                                                                            389KB

                                                                                                                                            MD5

                                                                                                                                            720a6eb48245cbf72518f42cf27ad09a

                                                                                                                                            SHA1

                                                                                                                                            e3fb3e6e3a1b42ec56a595e62cdd16be086e5c84

                                                                                                                                            SHA256

                                                                                                                                            d768d7422324ec7305db1069c2691c64d72caa745f9642d030b8b7104598a467

                                                                                                                                            SHA512

                                                                                                                                            92c86c84697774d5ec0c951007a2640915ea320c8b971b9fc86147f8490a25dbad5b91e5eb1a8a1e869d4c68baabf484c87516e4be369571c61edacbe5bd9b2f

                                                                                                                                            Download Submit
                                                                                                                                          • C:\Users\Admin\Documents\Files.docx.crypt
                                                                                                                                            Filesize

                                                                                                                                            11KB

                                                                                                                                            MD5

                                                                                                                                            2791e5353408c88ce5b929cca41bc6b9

                                                                                                                                            SHA1

                                                                                                                                            1886e91df1b2c65bea65a7e84148b2b172a9e36a

                                                                                                                                            SHA256

                                                                                                                                            356c8153c1c99570141b88990b29a1e84b9b9b7153940f96bb810b7ff233bae0

                                                                                                                                            SHA512

                                                                                                                                            7235cbc35b9e1bdc63d7aa8c3f1fb33c1c50b775605e0a6f3754d1bed8ae21f11f93255e25f60d986f9bdad620ecde0a774206b6285e23d7cb8abcc813b316f0

                                                                                                                                            Download Submit
                                                                                                                                          • C:\Users\Admin\Documents\FindDebug.pptm.crypt
                                                                                                                                            Filesize

                                                                                                                                            671KB

                                                                                                                                            MD5

                                                                                                                                            4b7fad7bd97104250fc8f0ef2f56a879

                                                                                                                                            SHA1

                                                                                                                                            e46f9726d253064f0a442d476ee032386a1e57c1

                                                                                                                                            SHA256

                                                                                                                                            2147b846898a84242019d8beca738473833770f82ece1df7c9a836daa1b9a825

                                                                                                                                            SHA512

                                                                                                                                            4fc36453008d6a4046daa9c2280dc4e6ea5a93b88701263b00d720c16369420601cd385ec7685f2ba6e59fbc19bac1fb3f4a24c54c2c48021a5e0ce968bb3b6d

                                                                                                                                            Download Submit
                                                                                                                                          • C:\Users\Admin\Documents\InvokeSelect.vstm.crypt
                                                                                                                                            Filesize

                                                                                                                                            631KB

                                                                                                                                            MD5

                                                                                                                                            0f778d5c0ce8c6c9fc5f65403fd30754

                                                                                                                                            SHA1

                                                                                                                                            01034c9b4427d46c4db1c47a9fd6e4c8f42f3e11

                                                                                                                                            SHA256

                                                                                                                                            6bc8b92411512ac23b0db2b081cdc73d5a3c67c87bff9e6dac5a9c72e27f80b3

                                                                                                                                            SHA512

                                                                                                                                            ea48f23e4f33611fba5b155fa0e4b5059b4c08c75ec8ad9b3606b6ec57401cba39bbca5803e804ddb1ec5021ab064073cb88b3ebd4531cb7e4f9d335fa79b077

                                                                                                                                            Download Submit
                                                                                                                                          • C:\Users\Admin\Documents\MergeHide.vsd.crypt
                                                                                                                                            Filesize

                                                                                                                                            497KB

                                                                                                                                            MD5

                                                                                                                                            37902dccc80f1691c3c814c62e73e6ab

                                                                                                                                            SHA1

                                                                                                                                            63bc2289b2dd3affc576e405546aa90d54d899e7

                                                                                                                                            SHA256

                                                                                                                                            6fe7bedca7f9d63bacef6718b811e21cdca5ade89761ade9603d234c3249662b

                                                                                                                                            SHA512

                                                                                                                                            5488c3cbdc5b0f6d821122108db6f3d15fd66881295293286db0ee75fa2a0422790e21399c4fc0c5eaf1d651a1f94c0d8dde388dd7a57e260e6ba5d095f2771f

                                                                                                                                            Download Submit
                                                                                                                                          • C:\Users\Admin\Documents\MoveWrite.xltx.crypt
                                                                                                                                            Filesize

                                                                                                                                            242KB

                                                                                                                                            MD5

                                                                                                                                            def90c8bff650d031c4bec2e95a817c6

                                                                                                                                            SHA1

                                                                                                                                            7f3f25a00ea12c49d9d002b8858013ccf9a539c8

                                                                                                                                            SHA256

                                                                                                                                            11ba2261e3b5fee0c535697f814cab8eed9161a762cb5a9953dfad24b4ace653

                                                                                                                                            SHA512

                                                                                                                                            0f5096d02c8d8e6222e664e76226f23e1d0fbb9598701ed097c9d2735662f031e18cfcf889d518e7077fd27a5218dc4569fdcdbf119676b9a444bdfdf459cd58

                                                                                                                                            Download Submit
                                                                                                                                          • C:\Users\Admin\Documents\Opened.docx.crypt
                                                                                                                                            Filesize

                                                                                                                                            11KB

                                                                                                                                            MD5

                                                                                                                                            ef00530de236ee697255e04a737e023b

                                                                                                                                            SHA1

                                                                                                                                            f1d10dd4375dcf4a1a6043c8c72d8babd7e5bb1a

                                                                                                                                            SHA256

                                                                                                                                            888cab7fbd16f62c025afa9e54fe069520c505fc3b57d3872ff66c2c1ceb9069

                                                                                                                                            SHA512

                                                                                                                                            5e009e92f914e5a5800e5a29b0bfeb3bd7caa7749433d32c9bbe2dceae79ab05a1b7598491938f245aed95730b7414c64f33af089bbf783d217bcf2d8f8d6c3e

                                                                                                                                            Download Submit
                                                                                                                                          • memory/108-74-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/364-88-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/688-80-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/744-73-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/800-97-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/892-111-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/892-62-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/900-115-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/900-89-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/960-60-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1000-75-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1112-105-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1124-76-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1172-108-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1176-72-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1232-70-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1248-110-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1248-84-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1316-94-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1320-90-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1320-116-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1320-63-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1328-101-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1348-66-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1396-114-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1396-58-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1416-119-0x000007FEFB901000-0x000007FEFB903000-memory.dmp
                                                                                                                                            Filesize

                                                                                                                                            8KB

                                                                                                                                            Download
                                                                                                                                          • memory/1420-54-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1432-61-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1484-103-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1488-112-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1488-86-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1504-82-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1504-109-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1540-99-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1556-55-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1568-65-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1568-117-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1572-107-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1596-59-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1600-121-0x0000000003690000-0x00000000036A0000-memory.dmp
                                                                                                                                            Filesize

                                                                                                                                            64KB

                                                                                                                                            Download
                                                                                                                                          • memory/1612-100-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1628-106-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1644-64-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1652-113-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1668-67-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1704-85-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1720-71-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1732-81-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1744-91-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1748-68-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1752-56-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1752-87-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1756-95-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1836-83-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1844-93-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1924-96-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1924-69-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1932-92-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1932-118-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/1988-77-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/2016-78-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/2028-98-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/2032-79-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/2036-104-0x0000000000000000-mapping.dmp
                                                                                                                                            Download
                                                                                                                                          • memory/2040-102-0x0000000000000000-mapping.dmp
                                                                                                                                            Download