Analysis
-
max time kernel
119s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29-01-2024 05:55
Static task
static1
Behavioral task
behavioral1
Sample
Cerber5.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Cerber5.exe
Resource
win10v2004-20231215-en
General
-
Target
Cerber5.exe
-
Size
313KB
-
MD5
fe1bc60a95b2c2d77cd5d232296a7fa4
-
SHA1
c07dfdea8da2da5bad036e7c2f5d37582e1cf684
-
SHA256
b3e1e9d97d74c416c2a30dd11858789af5554cf2de62f577c13944a19623777d
-
SHA512
266c541a421878e1e175db5d94185c991cec5825a4bc50178f57264f3556080e6fe984ed0380acf022ce659aa1ca46c9a5e97efc25ff46cbfd67b9385fd75f89
-
SSDEEP
6144:nl578cxdGY87FohbnmM2i8ito7wTmCbL94KCT3OAmK:nl59zH8MiM2z+NLQBN
Malware Config
Extracted
C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___5KCDFZ_.txt
cerber
http://xpcx6erilkjced3j.onion/FEA4-8D4F-A8C7-0098-B25D
http://xpcx6erilkjced3j.1n5mod.top/FEA4-8D4F-A8C7-0098-B25D
http://xpcx6erilkjced3j.19kdeh.top/FEA4-8D4F-A8C7-0098-B25D
http://xpcx6erilkjced3j.1mpsnr.top/FEA4-8D4F-A8C7-0098-B25D
http://xpcx6erilkjced3j.18ey8e.top/FEA4-8D4F-A8C7-0098-B25D
http://xpcx6erilkjced3j.17gcun.top/FEA4-8D4F-A8C7-0098-B25D
Signatures
-
Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
-
Blocklisted process makes network request 6 IoCs
Processes:
mshta.exeflow pid process 2181 740 mshta.exe 2184 740 mshta.exe 2186 740 mshta.exe 2188 740 mshta.exe 2190 740 mshta.exe 2192 740 mshta.exe -
Contacts a large (1095) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Windows Firewall 2 TTPs 2 IoCs
Processes:
netsh.exenetsh.exepid process 2772 netsh.exe 2652 netsh.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
Cerber5.exedescription ioc process File opened (read-only) \??\x: Cerber5.exe File opened (read-only) \??\b: Cerber5.exe File opened (read-only) \??\t: Cerber5.exe File opened (read-only) \??\u: Cerber5.exe File opened (read-only) \??\v: Cerber5.exe File opened (read-only) \??\q: Cerber5.exe File opened (read-only) \??\s: Cerber5.exe File opened (read-only) \??\z: Cerber5.exe File opened (read-only) \??\k: Cerber5.exe File opened (read-only) \??\l: Cerber5.exe File opened (read-only) \??\m: Cerber5.exe File opened (read-only) \??\n: Cerber5.exe File opened (read-only) \??\r: Cerber5.exe File opened (read-only) \??\y: Cerber5.exe File opened (read-only) \??\a: Cerber5.exe File opened (read-only) \??\g: Cerber5.exe File opened (read-only) \??\h: Cerber5.exe File opened (read-only) \??\j: Cerber5.exe File opened (read-only) \??\w: Cerber5.exe File opened (read-only) \??\e: Cerber5.exe File opened (read-only) \??\i: Cerber5.exe File opened (read-only) \??\o: Cerber5.exe File opened (read-only) \??\p: Cerber5.exe -
Drops file in System32 directory 38 IoCs
Processes:
Cerber5.exedescription ioc process File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\thunderbird Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\bitcoin Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\microsoft sql server Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\onenote Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\outlook Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\powerpoint Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\onenote Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\the bat! Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\thunderbird Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\desktop Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\bitcoin Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\outlook Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\outlook Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\steam Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\excel Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\office Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\word Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\steam Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\excel Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft sql server Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\excel Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\outlook Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\office Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\office Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\powerpoint Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\word Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\documents Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\powerpoint Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\excel Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft sql server Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\microsoft sql server Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\powerpoint Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\word Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\microsoft\word Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\onenote Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\local\the bat! Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\office Cerber5.exe File opened for modification \??\c:\windows\SysWOW64\config\systemprofile\appdata\roaming\microsoft\onenote Cerber5.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
Cerber5.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp80B4.bmp" Cerber5.exe -
Drops file in Program Files directory 20 IoCs
Processes:
Cerber5.exedescription ioc process File opened for modification \??\c:\program files (x86)\bitcoin Cerber5.exe File opened for modification \??\c:\program files (x86)\microsoft\office Cerber5.exe File opened for modification \??\c:\program files (x86)\microsoft\word Cerber5.exe File opened for modification \??\c:\program files (x86)\outlook Cerber5.exe File opened for modification \??\c:\program files (x86)\steam Cerber5.exe File opened for modification \??\c:\program files (x86)\thunderbird Cerber5.exe File opened for modification \??\c:\program files (x86)\microsoft\onenote Cerber5.exe File opened for modification \??\c:\program files\ Cerber5.exe File opened for modification \??\c:\program files (x86)\excel Cerber5.exe File opened for modification \??\c:\program files (x86)\microsoft\microsoft sql server Cerber5.exe File opened for modification \??\c:\program files (x86)\microsoft\outlook Cerber5.exe File opened for modification \??\c:\program files (x86)\microsoft\powerpoint Cerber5.exe File opened for modification \??\c:\program files (x86)\word Cerber5.exe File opened for modification \??\c:\program files (x86)\ Cerber5.exe File opened for modification \??\c:\program files (x86)\microsoft sql server Cerber5.exe File opened for modification \??\c:\program files (x86)\microsoft\excel Cerber5.exe File opened for modification \??\c:\program files (x86)\office Cerber5.exe File opened for modification \??\c:\program files (x86)\onenote Cerber5.exe File opened for modification \??\c:\program files (x86)\powerpoint Cerber5.exe File opened for modification \??\c:\program files (x86)\the bat! Cerber5.exe -
Drops file in Windows directory 64 IoCs
Processes:
Cerber5.exedescription ioc process File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\bitcoin Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft sql server Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\outlook Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\word Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\the bat! Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\outlook Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\powerpoint Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\word Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\office Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\powerpoint Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\steam Cerber5.exe File opened for modification \??\c:\windows\ Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft sql server Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\excel Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\office Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\steam Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\word Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\documents Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\excel Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\microsoft sql server Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\office Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\onenote Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\the bat! Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\excel Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\onenote Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\thunderbird Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\bitcoin Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\excel Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\onenote Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\outlook Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\powerpoint Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\desktop Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\desktop Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\outlook Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\bitcoin Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\excel Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\microsoft sql server Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\powerpoint Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\powerpoint Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\word Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\word Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\documents Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft sql server Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\office Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\outlook Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\onenote Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\steam Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\thunderbird Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\outlook Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\powerpoint Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft sql server Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\onenote Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\excel Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\excel Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\excel Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\microsoft\microsoft sql server Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\office Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\bitcoin Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\microsoft\microsoft sql server Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\outlook Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\local\the bat! Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\roaming\word Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\localservice\appdata\local\word Cerber5.exe File opened for modification \??\c:\windows\serviceprofiles\networkservice\appdata\roaming\microsoft\office Cerber5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2260 taskkill.exe -
Processes:
mshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 2056 NOTEPAD.EXE -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Cerber5.exetaskkill.exedescription pid process Token: SeShutdownPrivilege 2336 Cerber5.exe Token: SeDebugPrivilege 2260 taskkill.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Cerber5.exepid process 2336 Cerber5.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
Cerber5.execmd.exedescription pid process target process PID 2336 wrote to memory of 2772 2336 Cerber5.exe netsh.exe PID 2336 wrote to memory of 2772 2336 Cerber5.exe netsh.exe PID 2336 wrote to memory of 2772 2336 Cerber5.exe netsh.exe PID 2336 wrote to memory of 2772 2336 Cerber5.exe netsh.exe PID 2336 wrote to memory of 2652 2336 Cerber5.exe netsh.exe PID 2336 wrote to memory of 2652 2336 Cerber5.exe netsh.exe PID 2336 wrote to memory of 2652 2336 Cerber5.exe netsh.exe PID 2336 wrote to memory of 2652 2336 Cerber5.exe netsh.exe PID 2336 wrote to memory of 740 2336 Cerber5.exe mshta.exe PID 2336 wrote to memory of 740 2336 Cerber5.exe mshta.exe PID 2336 wrote to memory of 740 2336 Cerber5.exe mshta.exe PID 2336 wrote to memory of 740 2336 Cerber5.exe mshta.exe PID 2336 wrote to memory of 2056 2336 Cerber5.exe NOTEPAD.EXE PID 2336 wrote to memory of 2056 2336 Cerber5.exe NOTEPAD.EXE PID 2336 wrote to memory of 2056 2336 Cerber5.exe NOTEPAD.EXE PID 2336 wrote to memory of 2056 2336 Cerber5.exe NOTEPAD.EXE PID 2336 wrote to memory of 2384 2336 Cerber5.exe cmd.exe PID 2336 wrote to memory of 2384 2336 Cerber5.exe cmd.exe PID 2336 wrote to memory of 2384 2336 Cerber5.exe cmd.exe PID 2336 wrote to memory of 2384 2336 Cerber5.exe cmd.exe PID 2384 wrote to memory of 2260 2384 cmd.exe taskkill.exe PID 2384 wrote to memory of 2260 2384 cmd.exe taskkill.exe PID 2384 wrote to memory of 2260 2384 cmd.exe taskkill.exe PID 2384 wrote to memory of 2260 2384 cmd.exe taskkill.exe PID 2384 wrote to memory of 1472 2384 cmd.exe PING.EXE PID 2384 wrote to memory of 1472 2384 cmd.exe PING.EXE PID 2384 wrote to memory of 1472 2384 cmd.exe PING.EXE PID 2384 wrote to memory of 1472 2384 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\Cerber5.exe"C:\Users\Admin\AppData\Local\Temp\Cerber5.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall set allprofiles state on2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exeC:\Windows\system32\netsh.exe advfirewall reset2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___YB2Q_.hta"2⤵
- Blocklisted process makes network request
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___5KCDFZ_.txt2⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /d /c taskkill /f /im "C" > NUL & ping -n 1 127.0.0.1 > NUL & del "C" > NUL && exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im "C"3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXEping -n 1 127.0.0.13⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\CabB2AE.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\TarB35D.tmpFilesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___5KCDFZ_.txtFilesize
1KB
MD582bf46d28f915072c51f8dc97e87c501
SHA13cf7607584ffb7d0960a96be86b05c1b697be7a4
SHA2563ff0d100a3c5e61a5b470637bef22e2a1942bf7612b1f167e8c23040d0cc6303
SHA512c9a1874fe22d207fac5feaa8ffc4217c9bdd9a29a37c7cf22d35055ad4b5b572a61e94a6c9056866be1d4b80582e22c98f00d17ebffccc165192c7a696db8f9c
-
C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___YB2Q_.htaFilesize
76KB
MD5bfd8979e564960acef922f46ae2ca70d
SHA1cbbf74f2cdcfb32963c6bc6a94d5df36113346ae
SHA25640e70cda7fa2c4d486e11eb89985b6e0dcb6ac65e25163c38c79e49fc7ea7ff4
SHA51270d9d60275d1644f420bbeef08a2ec6ff20c5ada40954cb1497bd8aecf305ab2ca75794e7942ee025d5cfe7d3632a7fd3e2dc0d8b5fba730c09cf4b9469f4443
-
memory/740-203-0x0000000004740000-0x0000000004760000-memory.dmpFilesize
128KB
-
memory/740-144-0x0000000004740000-0x0000000004760000-memory.dmpFilesize
128KB
-
memory/2336-12-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2336-24-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2336-107-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2336-110-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2336-23-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2336-14-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2336-0-0x0000000000120000-0x0000000000151000-memory.dmpFilesize
196KB
-
memory/2336-145-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2336-5-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2336-2-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB
-
memory/2336-1-0x0000000000400000-0x0000000000433000-memory.dmpFilesize
204KB