ef99a1844cbf354868a70cdcc2584ec94ffceafc4ffcd3a6b5563fa1d632844e

Analysis

max time kernel
190s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01-01-2024 15:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
Size

74KB
MD5

85110da3605b25aaaa7533e2bdbdc6fb
SHA1

8eb6f6e0e50d1d6e496e1c3498d500e00c47b8ae
SHA256

6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac
SHA512

f49ddeb9c0ad79f5979b299fbb231f225c0e6c149633c1d1cdfe0f4d94ce2cf28ee65e17c020624dadb036c20270d343f5f869da3d01b535181e7e7aafae0312
SSDEEP

1536:naDpA+SIN1RWDmGN7NuoH4T+p9yF+KUFP4VuBs7hu7HU0QU9v:1lHNZuoHnyQKrVhWHLQU

Score

9^/10

persistence ransomware

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Renames multiple (2758) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zQZanoJa.lnk	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zQZanoJa.lnk	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe

Loads dropped DLL 1 IoCs

pid	Process
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\zQZanoJa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mzQFWnMR.exe"	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT+9	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\amd64\INFO.txt	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\charsets.jar	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Santo_Domingo	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.jpg	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\SearchConfirm.ps1xml	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.greychart.ui.zh_CN_5.5.0.165303.jar	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File created	C:\Program Files\Java\jdk1.7.0_80\INFO.txt	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kolkata	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-7	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets.nl_zh_4.4.0.v20140623020002.jar	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository.nl_zh_4.4.0.v20140623020002.jar	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-favorites.xml	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Java\jre7\lib\ext\access-bridge-64.jar	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker_1.1.200.v20131119-0908.jar	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Bucharest	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\INFO.txt	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.resources_3.9.1.v20140825-1431.jar	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_ButtonGraphic.png	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\sports_disc_mask.png	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Riga	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Argentina\Jujuy	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Kentucky\Monticello	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Jamaica	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Puerto_Rico	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.SF	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref.wmv	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Bahia	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Aqtobe	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Tahiti	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\vlc.mo	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Pacific\Enderbury	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Maldives	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-multitabs.xml	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-output2_zh_CN.jar	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-sampler_ja.jar	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\UCT	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Bears.jpg	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_scrapbook_Thumbnail.bmp	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Noronha	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Asia\Aqtau	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Athens	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Antarctica\DumontDUrville	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_ButtonGraphic.png	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Samara	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Barbados	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui_5.5.0.165303.jar	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler_ja.jar	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler.xml	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-host.xml	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\vintage.png	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.properties	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-masterfs-nio2.xml	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Montevideo	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.bin	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\720x480blacksquare.png	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\include\win32\jni_md.h	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
1956	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeRestorePrivilege	2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
Token: SeBackupPrivilege	2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
Token: SeSecurityPrivilege	2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
Token: SeDebugPrivilege	2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
Token: SeBackupPrivilege	440	vssvc.exe
Token: SeRestorePrivilege	440	vssvc.exe
Token: SeAuditPrivilege	440	vssvc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 1956	2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe	29
PID 2908 wrote to memory of 1956	2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe	29
PID 2908 wrote to memory of 1956	2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe	29
PID 2908 wrote to memory of 1956	2908	6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe	29

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe
"C:\Users\Admin\AppData\Local\Temp\6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\SysWOW64\vssadmin.exe
  "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
  2⤵
  - Interacts with shadow copies
  PID:1956

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl

Filesize
7KB

MD5
5d33524b3d9c0286da42a9abb377b84a

SHA1
11ffc0b2577265efce0d43a87a091d904b1f825c

SHA256
059a7ee7ea312c4855b5919d377bafd47de59a97e4820674d153409357f7abcc

SHA512
72d7b1501553f5c455435deef8fb36b9691335e67998cae2305e516d326ccb3af527d54761eacf759040e9748418fe1bf4555eea0f8293556b7d831c6382ce90

Download Submit
C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer

Filesize
7KB

MD5
7527855f02395852d7f2b8822f5c5880

SHA1
beca372897651bcaac5a9cfa95d386a614491c1c

SHA256
c5611af99921264a491ff02cfa58351a6f9ee7a15968d790a39f87613f5aa923

SHA512
a129c65ef6205b56a6f63f5505a1eb72d88f0b2de271ed7f50cf1de0a322e896f09498ee07b695614a84c69fbc0e80b3250ac9203346446ab1371a06e35f917a

Download Submit
C:\Users\Admin\AppData\Local\INFO.txt

Filesize
176B

MD5
0e9097cdaf73b5053a84416311a398a6

SHA1
193c87f698f1b3e7bbb596def0951f3049720068

SHA256
04d6c1fb3bb657babb6947b58ff11a315e852839b1a4bf737648eef7a1990188

SHA512
a5b369b977be1f74739bf52bda7578886d4ccf5f11eee4a4560842ff80bb7358b5cca29f73d25bf7bb802ac6c64dd78e16c6bcf814375514b8f23cfaff132f94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Feeds\Feeds for United States~\Popular Government Questions from USA~dgov~.feed-ms

Filesize
29KB

MD5
30f6e390ea7f16e7c9d6690bd3423fff

SHA1
e1e5c1cefea64e5fb2f93adb959030246cc112c4

SHA256
ebd64008d9531549e25aea1c85ca4dbec3af968eb8337097e06e1358f254008c

SHA512
6313b7c19919725b325173083714af26c6c26181388254708e20da20cd411d70aa40285530f3c0ba74d43be2b17eb1c3abd4e84dc976bc652e305751c62ad82e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\V01res00002.jrs

Filesize
513KB

MD5
43c3023ad53c5abe682e635e64ac2646

SHA1
5f4915e34e70a2b1d8a3767e37cbb5d2f0955212

SHA256
e0d63f0da5546bcef024394a3d978822381272a687bd7e9c207e28629443aa8a

SHA512
d0458b9b4202f015030793dbc69d4738ae081c29cb2d064b764a87772e01171b01fa0ee371bbb4b719e4a3ce220996fe48ec3a4b7e2114b8eaf77720b058877a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\zQZanoJa.lnk

Filesize
1005B

MD5
7b27f8d31c81fe99682d1622468377fb

SHA1
1058ccc5e7e1499eefa0036d45a5c9d0ea83e5a8

SHA256
ff7824d46d679a93129a7ce663febd42b96b6d5e4080261a58136cd3fb1c8ea9

SHA512
72528f7dc6402f41dfd97ac424ec29b75f8122445be14afc5f65ef9617495eaa3c9d42fc8664c94ca7909328356ff81f56a90abb3e16f7b64067e23ad1af380a

Download Submit
C:\Users\Admin\Desktop\AddCompress.dwg!@#$%^&-()_+.1C

Filesize
374KB

MD5
62cbf5c0990efa536924fb787efd18bb

SHA1
7d597715b51d47d083b5a0e5be23715bc3618ec0

SHA256
7f5b9c826a6b73498cf3a7b712bc542d7918221b68464f78f94f357f14e3faf4

SHA512
b5e317653b62152b865ce614fcf49e8024c77065e40194fcf192771dc1d15287950de1ede93b60c95986decce4818f351fa96bd123d5656ef8a232bb2e88ce69

Download Submit
C:\Users\Admin\Desktop\AddProtect.docx!@#$%^&-()_+.1C

Filesize
299KB

MD5
741916a509cef41db669e92404689adc

SHA1
f2e73d8afa9fc06d2560a9bad00ff1593bd5cddc

SHA256
c15f0eebaa511d4580e6ed86b79cf8462e44fb25e9bf59aad726a9e5e61d4409

SHA512
27cb56d7a74c0d6d55f70df52dee53afdc32eaaba909e8d0a500396631a95d08b5df0fbd653e6f049c61a50cf669d63b58cd50375436ed3474d3a833e254e432

Download Submit
C:\Users\Admin\Desktop\BackupFormat.au3!@#$%^&-()_+.1C

Filesize
349KB

MD5
b5c630b0755a1761d4fb29e4c4fd8887

SHA1
59dd71305709487bacb269edcd296da09ffca91f

SHA256
eae473f9069ca636304e50fbf4286280b779c7c0cd896411ffb908b8b10d6705

SHA512
a893d02cec41882efa80ed7f5662da3eb8ee5a8fc9884901a2961868c9d24023ac843a5022e547e27c40294bcb71b386d8aca80ea4d6c4ac027cd62dd9a87380

Download Submit
C:\Users\Admin\Desktop\CheckpointSearch.vb!@#$%^&-()_+.1C

Filesize
311KB

MD5
a204ebeace9e26121d131f5391c639ae

SHA1
1249f4509853a53275516a1719a9f461d115465e

SHA256
29eaf334f8169e906c7c3e3d5c8dd5c1af0ca9391c4eb488928eed2a5475b981

SHA512
2b91075976db5f18508c2af166e859ec09a743caada0d760c1ac243f585be9153d4f7cef1195faab92bb1a3e5234028bca3b1ed8c9129c830508441cc128c8f4

Download Submit
C:\Users\Admin\Desktop\CheckpointUnpublish.wmf!@#$%^&-()_+.1C

Filesize
160KB

MD5
accb1f66c218c8b299ee1ec4a8617568

SHA1
9665bdaec279b3841f6862e955918888cd3618a4

SHA256
0d0395b2eae592fe3b9770b1864146a0d2768392f3b0eceb08e086c95b426b43

SHA512
28c6bf520c4ab619989aece4821bd1ac87763dc727a49ad3f6023302343b4815cac2192fe04d8f0f69eee0cb06089e355de35f4127be58b69c12b8a1b8f23fda

Download Submit
C:\Users\Admin\Desktop\CompareUnlock.au!@#$%^&-()_+.1C

Filesize
244KB

MD5
6e7b7d9447423f05a09dc697e28ba704

SHA1
66e92408df3c215faead69f86ae09d4cc4d49fa3

SHA256
10697e5276ab30387e88cdb987e3d1736855f5bd0660eff5fe50444ac26cd677

SHA512
7e584bdd00e4490b53cd76543f492f5c755354eeebcc306f29191dc73517c29e4a81609faad5c6dd397c0a013365a3d4cd502b9f9b4b5aa726994e6301605a49

Download Submit
C:\Users\Admin\Desktop\CompleteSync.emz!@#$%^&-()_+.1C

Filesize
400KB

MD5
234de02951248468b39dd1b633e74ecf

SHA1
97e93aea47fa0e46420cae085427043b24bd31c1

SHA256
a6b37e8b9df3fd67430988178fdbb2facfa97c9dee94d024c27c7e8bbfe0429f

SHA512
e0a4c7d638fb493e3b3a5ed1632c6c2062725612cb50ad0d44fca81976ce4a8515979f358ee778b7e6c2949c0341e28b9ebebf457e7efd3f5ed6c71cf0a63ce3

Download Submit
C:\Users\Admin\Desktop\CompleteWrite.xlsm!@#$%^&-()_+.1C

Filesize
243KB

MD5
2115b2580c3031cdb6a6d6cd2aed9b18

SHA1
c39c9e78b769f3abd28745f0beb5b41723067114

SHA256
86f0bf7b99a5873e4c5a2a216d3ad3bbc7c294a5b4964ed38bc645c6ebeb1569

SHA512
5d70d76c6f9bc09ab12d8dc8fded0a29b2d564b68bfb32da7f3f203a7dab94ca6acf0cade53c203db760ab00b0e024bc5157792df812382650a2bdfba4f1e9f4

Download Submit
C:\Users\Admin\Desktop\DebugBackup.vst!@#$%^&-()_+.1C

Filesize
313KB

MD5
a80cf678bc1c842f4132888218a17c70

SHA1
10ca49daf189c98bec314a22c5bcac32e90cd701

SHA256
c52dd3f3af013d040be7261e1541b05e95e042b2739d2cb147ec89e6ba33a517

SHA512
ccf3e0bcafdc3d3197d2b0e036cae17501dd6bab8135e9963c257e1fb3a44192ba57d6934c3a0363706da9cd25359a4d1837ceb21599a29cf0b190a3a2752d6e

Download Submit
C:\Users\Admin\Desktop\DenyWatch.m3u!@#$%^&-()_+.1C

Filesize
286KB

MD5
53db04ab08e120388cb4db315b470a04

SHA1
03e6b184dec54f27383920256de40acd5f01e64b

SHA256
1d488eadea4018413b39309361184a374330c52ce864b2f3fca030059cb6a27d

SHA512
d1233aabf9a89a6e26a0fd843d8912170673bc282250dce78dd5fcf722007d17909a81137cad6cdabbae381ed85554bcb84865f9297289d39fddd238ec3e7a60

Download Submit
C:\Users\Admin\Desktop\ExportUnregister.asx!@#$%^&-()_+.1C

Filesize
219KB

MD5
2e3cc9db7a5cd8b21a3f845e50885e48

SHA1
a8f22a746969fdd206a789bdf15bad6b07c5f651

SHA256
b669e8408966111f9cf91c9e22777498771322741bd57f1d565958525e9827d6

SHA512
84053613d38ae90d0c1a0c332b91d77a5fb2f9c4552ce2e43915b1e931561a8465cd6b68c55cacaf08e99664ef6ac022e83f0547882f60fc02cb89e4b4b01952

Download Submit
C:\Users\Admin\Desktop\GroupInitialize.shtml!@#$%^&-()_+.1C

Filesize
128KB

MD5
6f82e4f7c80cc8f53769e8ca50510556

SHA1
025b1a56f1100d31e7235a86b95befe9304eb33c

SHA256
c3443548b7984017669be61f7a3828aea49169376bfa9b566128bf8d88bef611

SHA512
70ba828d6d3c6ad78044452d0992e4c82d82d1f22c3cf24d3132551164d6a3a917660048f2e5cf82f59d53875c802e54b34e14c5f28424cea42b35f91a302799

Download Submit
C:\Users\Admin\Desktop\ImportSplit.m3u!@#$%^&-()_+.1C

Filesize
173KB

MD5
69252d20b9fa0a01338590649ea0e7c0

SHA1
f84ab681d03002852154c97853e48cf031ed7cd6

SHA256
c1f16ead31f10656b2533c13cda02f7e342d897945c1ac194eb2977aa7384c24

SHA512
f1279930ffcbce24e75d78acdc27f690ed01b5ff91b25764435a880e6c54a09d2be1cfb8baca9a87308c46fb35f1b21ace210f76396b1b572cb48cbe9f83e691

Download Submit
C:\Users\Admin\Desktop\InitializeProtect.wmv!@#$%^&-()_+.1C

Filesize
64KB

MD5
c1a3c2f6fa69f669b736e9d5de95b054

SHA1
ce2fcc0948de2ff1c298e1439516d093084f9dad

SHA256
52283b5957bed935672bbf985e47e44d6c3e6df125d71e7ca50f55a2c56bcddc

SHA512
0a19b8f89c169a20c8c79929a3ae4ae84258d7b0cd756f63da307d677b22a7e3690a7e0eedd8eb1cbbc0af5312af734bc5b57b365fd96532ef2ed794765371a7

Download Submit
C:\Users\Admin\Desktop\PushOpen.mp4v!@#$%^&-()_+.1C

Filesize
223KB

MD5
75982e74b7052c26e8cef06cf10b2172

SHA1
0ed1a28517e25acc0906c89e770f9e3e034431d2

SHA256
a08929391975ea13a541414f53966db74637160fb9f76e3f189191584b15c85a

SHA512
fe1ab9be7137c3d3bf7a759cff7a1a40cfd5e27597a2ae93ffaa0ba868f7bcb0e70c6e288f315bb05054f7aceb3de0922dd3ac1275a5c92d36e3e421cdf1be42

Download Submit
C:\Users\Admin\Desktop\RenameMeasure.html!@#$%^&-()_+.1C

Filesize
64KB

MD5
40888d3298845839a9726da045932ccc

SHA1
8d53219ad4d593aac0bf86c6642345d47f4b3cd1

SHA256
0f91c80de47d1045ac1edd42e2d653f2ac6f55b6aed271c3faee8f38b6a462c6

SHA512
410534a4446b62665a6decb4e8b83e065c8c6c0e888e9f657839b1c837f88643dab54a317d81082a37dbd255ce1f4e71c7269a8c56298df7428349359538a59d

Download Submit
C:\Users\Admin\Desktop\RestoreAssert.zip!@#$%^&-()_+.1C

Filesize
261KB

MD5
80431a6f71c07cb49590afc047b3efa4

SHA1
a243797a6b9d8edc4224b3cb819d9b4959af73a7

SHA256
8497784bb3e32904499edf20150c4f34e99e510cb1ae17c17dc56bed56134cfd

SHA512
ffa37467a39a6520abd3474539d9cfc60220da61901802edfad13a6d2c14d50335b5276840c293d3cdaa7273ae8f144861b41274691b7db642751665143113df

Download Submit
C:\Users\Admin\Desktop\SaveConvertFrom.pdf!@#$%^&-()_+.1C

Filesize
185KB

MD5
8a35b693ee1b0dc3db7acc48cb45e625

SHA1
9b01c929448a8e4a6a5c48138414a7e6d179eb6f

SHA256
dbb05ed66e6ec58abdd4db3e06f7227d249fb929a41926a6d5b89cdb47c774f0

SHA512
ab29eb7793db7e29fca339e777e961bad143675324ff552d31fe0bcd2a0c68a0f59c9e115ec5105a658557766c76486b4ea3d0f2e0e41d922ab550f93d374536

Download Submit
C:\Users\Admin\Desktop\SelectConvert.ttf!@#$%^&-()_+.1C

Filesize
210KB

MD5
ad31ee46a1e65a692622266a72cfa58d

SHA1
7ad144bd192c2609cd03792f4fc441a750bfc323

SHA256
51352d1fa752b591721fb1fc9b313771448e11f35295141f74e5adf20f836551

SHA512
dba46d09e91915a14fde23a50e61b2e417da737151b706fffcd7b1a7394d644f92754aa7703d917a7df2364cb884bcf58facfdffbd9ca0d6041976387b25c4c6

Download Submit
C:\Users\Admin\Desktop\SetBackup.xps!@#$%^&-()_+.1C

Filesize
412KB

MD5
a86a4617e99af2a702ce22d70bb495c1

SHA1
2a1566e1f0233e7ddcfee908408b58e4f514638d

SHA256
9031797c59e161cf00219903aa2b358154d7677a4f6309da77c7def8469cc679

SHA512
8c47448970000dc4f389c8e4020f971b23b75007ce9d102b99adcd7a17eeb57fe9cb6fd0674c806e98e8e9a878de53638de83dd3d73a9e60f77c662315a6f983

Download Submit
C:\Users\Admin\Desktop\SetInstall.ADTS!@#$%^&-()_+.1C

Filesize
248KB

MD5
19b1c5d58dec9200b64ca2b83e89a1f1

SHA1
a9d42ce04ad2e6b6081ae21add1d9812094dcbd8

SHA256
bb2808189628530d81f317a65b41d82ba1d7aef99ed234662b658730931190d4

SHA512
06a285dd0f7a25d41f5b6f85751a0a4d30cc364b7cbb336f9d6955cb7638b81b4b80cd7e688c015bd8dbd4be402d440115f1d207f3056e1ffa39b1e1a142d0a6

Download Submit
C:\Users\Admin\Desktop\StopCheckpoint.docm!@#$%^&-()_+.1C

Filesize
362KB

MD5
81c2c7305adaef8d82979a87c7d6f0e0

SHA1
d239103a25c409a5a89996264488df748f530052

SHA256
cdaaf009b350e6287cc3a6e75f72e3f9b85f22759d436a2b1fceab5939100e14

SHA512
7ef80c6e2fd3dd3e3fa72e1a654a9bcbae27b746e83cdf2ac7a6359fe5927802689f6edd26e577704b9451990c554882b3f20e38a77f00e064c0c9335a9bc9f3

Download Submit
C:\Users\Admin\Desktop\UnregisterResume.3gp!@#$%^&-()_+.1C

Filesize
143KB

MD5
d6c68d4b0ff86c1665f74da1c451b8de

SHA1
2b20069281a9da3be4d1ec02867d642cb43469dd

SHA256
bd07d9b2d9578a4201d9496d13ae31e673b29154a4c0990a477c7a9287c1c5c4

SHA512
cc18f8233a8ce1727df27cef1557ee80d84c4600816763cd9e34e9351c6caf1dbee0ece2f874cf4b402158ae71ba5dee9d6dc19f1c1b013eed8639326fcc0278

Download Submit
C:\Users\Admin\Desktop\UpdateFind.7z!@#$%^&-()_+.1C

Filesize
184KB

MD5
a11a36c687cde77c8041157c73e95ef4

SHA1
4ba772b0898249214107363c3cbf416f55ad4c9b

SHA256
2fea16930918c7f3c78c079343417f5423e6bc52ddc75cfea991db72e558aa0d

SHA512
a2b0e4ecd7fb6bf2bd50dc155a1b945d842a73b31cab4ba90626b2bf2540e0087f98f49aff9a03c50dec1b3f2d0ba65f90f7da43c65d6e9599a9c53d506a700c

Download Submit
C:\Users\Admin\Desktop\UseSplit.dib!@#$%^&-()_+.1C

Filesize
349KB

MD5
8b241ca3c565e30ac3235d8e92546a9b

SHA1
64bc878c46248d65c7f0216dfc37e83fcb1c1804

SHA256
ad446f9d424bbe02a04d2cd7886d522bfe40b2d19b98d54d71eac294e973921c

SHA512
fd021105774940c325e8238871fe7dceb4ddaac69d31646cfc39df8fec130c0210b6277f9740b8615d8f5790eac4f7baeed2054d663eb80ae0a0cdc5d05e3c41

Download Submit
\Users\Admin\AppData\Local\Temp\mzQFWnMR.exe

Filesize
74KB

MD5
85110da3605b25aaaa7533e2bdbdc6fb

SHA1
8eb6f6e0e50d1d6e496e1c3498d500e00c47b8ae

SHA256
6e2db44578ff2fdcab7938517973ed9bfd3532d7b29b7798ceb9f04ed079c1ac

SHA512
f49ddeb9c0ad79f5979b299fbb231f225c0e6c149633c1d1cdfe0f4d94ce2cf28ee65e17c020624dadb036c20270d343f5f869da3d01b535181e7e7aafae0312

Download Submit
memory/2908-0-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/2908-1-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download