Analysis
-
max time kernel
167s -
max time network
169s -
platform
windows10-1703_x64 -
resource
win10-20240221-en -
resource tags
arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system -
submitted
03-03-2024 15:00
Behavioral task
behavioral1
Sample
some_malicious_file.exe
Resource
win10-20240221-en
General
-
Target
some_malicious_file.exe
-
Size
164KB
-
MD5
890a58f200dfff23165df9e1b088e58f
-
SHA1
74e3d82f7ee81109e150dc41112cf95b3a4b5307
-
SHA256
5f56d5748940e4039053f85978074bde16d64bd5ba97f6f0026ba8172cb29e93
-
SHA512
2ee3636833cd9b02f5e311401817b15514845d4c12c1416d7e345845f8084775bf8c5f8f32822066b75a6b627a93138a0b27deb99c8bbb1f8d640132a2d8de0d
-
SSDEEP
3072:Hp5SexkWi1Lbi4eTMlwDCnu/q2GB96W/y:JvGWwbnWJ/yB9
Malware Config
Extracted
C:\Recovery\r4qti7176-readme.txt
sodinokibi
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/8703908FA807F8F7
http://decryptor.top/8703908FA807F8F7
Signatures
-
Sodin,Sodinokibi,REvil
Ransomware with advanced anti-analysis and privilege escalation functionality.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
some_malicious_file.exedescription ioc process File opened (read-only) \??\L: some_malicious_file.exe File opened (read-only) \??\Z: some_malicious_file.exe File opened (read-only) \??\E: some_malicious_file.exe File opened (read-only) \??\R: some_malicious_file.exe File opened (read-only) \??\S: some_malicious_file.exe File opened (read-only) \??\V: some_malicious_file.exe File opened (read-only) \??\D: some_malicious_file.exe File opened (read-only) \??\F: some_malicious_file.exe File opened (read-only) \??\N: some_malicious_file.exe File opened (read-only) \??\P: some_malicious_file.exe File opened (read-only) \??\O: some_malicious_file.exe File opened (read-only) \??\U: some_malicious_file.exe File opened (read-only) \??\G: some_malicious_file.exe File opened (read-only) \??\H: some_malicious_file.exe File opened (read-only) \??\I: some_malicious_file.exe File opened (read-only) \??\J: some_malicious_file.exe File opened (read-only) \??\K: some_malicious_file.exe File opened (read-only) \??\W: some_malicious_file.exe File opened (read-only) \??\Y: some_malicious_file.exe File opened (read-only) \??\A: some_malicious_file.exe File opened (read-only) \??\T: some_malicious_file.exe File opened (read-only) \??\M: some_malicious_file.exe File opened (read-only) \??\X: some_malicious_file.exe File opened (read-only) \??\Q: some_malicious_file.exe File opened (read-only) \??\B: some_malicious_file.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
some_malicious_file.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3281913400-1494313570-2321515684-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ej39.bmp" some_malicious_file.exe -
Drops file in Program Files directory 16 IoCs
Processes:
some_malicious_file.exedescription ioc process File opened for modification \??\c:\program files\SearchSuspend.pdf some_malicious_file.exe File opened for modification \??\c:\program files\SendApprove.M2V some_malicious_file.exe File opened for modification \??\c:\program files\UndoInitialize.html some_malicious_file.exe File created \??\c:\program files\r4qti7176-readme.txt some_malicious_file.exe File created \??\c:\program files (x86)\r4qti7176-readme.txt some_malicious_file.exe File opened for modification \??\c:\program files\ConnectFormat.vdx some_malicious_file.exe File opened for modification \??\c:\program files\RepairUnpublish.au some_malicious_file.exe File opened for modification \??\c:\program files\RepairUninstall.jpeg some_malicious_file.exe File opened for modification \??\c:\program files\StartRestart.vbe some_malicious_file.exe File opened for modification \??\c:\program files\UpdateAssert.xht some_malicious_file.exe File opened for modification \??\c:\program files\ApproveNew.bmp some_malicious_file.exe File opened for modification \??\c:\program files\ClearUnregister.vbe some_malicious_file.exe File created \??\c:\program files\d60dff40.lock some_malicious_file.exe File created \??\c:\program files (x86)\d60dff40.lock some_malicious_file.exe File opened for modification \??\c:\program files\AddSearch.jpeg some_malicious_file.exe File opened for modification \??\c:\program files\UnlockNew.vstx some_malicious_file.exe -
Drops file in Windows directory 64 IoCs
Processes:
some_malicious_file.exedescription ioc process File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-winlogon.resources_31bf3856ad364e35_10.0.15063.0_en-us_dc0c6ac43ce52ba2_winlogon.exe.mui_3280fc46 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.15063.0_tr-tr_56267d09fac4d7b0_memtest.efi.mui_71e15c22 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-s..ty-cng-keyisolation_31bf3856ad364e35_10.0.15063.0_none_dfa51ff763495326_keyiso.dll_897976dc some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-c..temminpnp.resources_31bf3856ad364e35_10.0.15063.0_de-de_5a1742dfc8bd4040_drvcfg.exe.mui_ff2bc967 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-pdc-mw_31bf3856ad364e35_10.0.15063.0_none_33e5ebd3a5fb8454_pdc.sys_dcf04bf8 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasserver.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_2ed7c061e8031d3f_iprtrmgr.dll.mui_eb023b92 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..ontroller.resources_31bf3856ad364e35_10.0.15063.0_en-us_7b1120505ec3e729_services.exe.mui_86ea5e71 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-networkbridge_31bf3856ad364e35_10.0.15063.0_none_18fdca143ee4528f_bridge.sys_4e5f368e some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-rasserver.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_2ed7c061e8031d3f_mprdim.dll.mui_11b5ef08 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-i..r_service.resources_31bf3856ad364e35_10.0.15063.0_de-de_beb9e9f73d4f9ded.manifest some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-a..structure.resources_31bf3856ad364e35_10.0.15063.0_de-de_6a9ff63914f2420a_sdbinst.exe.mui_258ad624 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-w..eservices.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_30cfa4f72d905e85_wiarpc.dll.mui_0c913b87 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_el-gr_6dec26b9213f9155_comctl32.dll.mui_0da4e682 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.15063.0_it-it_54a7f9c38e05bd42.manifest some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.15063.0_hr-hr_78aafb7af9d71d92.manifest some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..oexistencemigration_31bf3856ad364e35_10.0.15063.0_none_22f6ec0bb529250e_httpprxp.dll_53541354 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-d..vices-sam.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_d26b94dd9f9ffa57.manifest some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-s..-credprov.resources_31bf3856ad364e35_10.0.15063.0_en-us_04218ecbbddd265d_fidocredprov.dll.mui_4ca89266 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.15063.0_bg-bg_a18c0c1f4d396f4e_bootmgfw.efi.mui_a6e78cfa some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-network-security_31bf3856ad364e35_10.0.15063.0_none_de38492263599171_bfe.dll_056865e3 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-c..temminpnp.resources_31bf3856ad364e35_10.0.15063.0_es-es_a6b4da38ff64cc74_drvcfg.exe.mui_ff2bc967 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_fi-fi_9afd8f54d47294fd.manifest some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_ro-ro_6d5264705f16445d.manifest some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.15063.0_ja-jp_d02a172e465bf139_comctl32.dll.mui_0da4e682 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-shlwapi_31bf3856ad364e35_10.0.15063.0_none_0aed8b3ddd7da4b2_shlwapi.dll_1eec0a2e some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-s..ty-kerbclientshared_31bf3856ad364e35_10.0.15063.0_none_fd61363b291ec882.manifest some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-rasauto-mui.resources_31bf3856ad364e35_10.0.15063.0_es-es_7bf2374fc6d7b1d1_rasautou.exe.mui_55686a97 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-h..p-listsvc.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_a0923f690628eba2_listsvc.dll.mui_27f0fc85 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-n..orkconnectionbroker_31bf3856ad364e35_10.0.15063.0_none_6dc3296afdb08731.manifest some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-com-base.resources_31bf3856ad364e35_10.0.15063.0_it-it_609308d47503071e_wintypes.dll.mui_36d5f25a some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_nl-nl_dfa589a69594078d_comctl32.dll.mui_0da4e682 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_networking-mpssvc-drv.resources_31bf3856ad364e35_10.0.15063.0_en-us_5ed8287abe95c9de_mpsdrv.sys.mui_b2aea3b6 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-com-base_31bf3856ad364e35_10.0.15063.0_none_2956ba0293b4f9a6_wintypes.dll_96e015b1 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_sr-..-rs_61f5adcf622ceaac.manifest some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-u..istration.resources_31bf3856ad364e35_10.0.15063.0_en-us_74d5f5c7b3aae50f_dsreg.dll.mui_5d9efc7e some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-wmi-core-svc_31bf3856ad364e35_10.0.15063.0_none_bc1b3f5b642099f1.manifest some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_networking-mpssvc-drv.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_0bafa5afe5ef93e0_mpsdrv.sys.mui_b2aea3b6 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_10.0.15063.0_lv-lv_4b49c6e247bf15ca_bootmgr.exe.mui_c434701f some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-font-bitmap-terminal_31bf3856ad364e35_10.0.15063.0_none_2583321dfa2b45c4_ega80857.fon_608e9436 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.15063.0_et-ee_8976f68a25e8760b_bootmgfw.efi.mui_a6e78cfa some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-lua-filevirtualization_31bf3856ad364e35_10.0.15063.0_none_78f4fe0cdd696494_luafv.sys_602842f9 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-s..subsystem.resources_31bf3856ad364e35_10.0.15063.0_ja-jp_33a9f3ab14804647_scarddlg.dll.mui_300ae9df some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-tcpip.resources_31bf3856ad364e35_10.0.15063.0_en-us_8137b70e4d9546cf.manifest some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..ient-core.resources_31bf3856ad364e35_10.0.15063.0_it-it_b501a8e10436c519.manifest some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-lsa.resources_31bf3856ad364e35_10.0.15063.0_es-es_97870a6ecf910234_lsasrv.dll.mui_d47f7e1c some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-u..istration.resources_31bf3856ad364e35_10.0.15063.0_it-it_0180bef17dd5d294_userdeviceregistration.ngc.dll.mui_d2c6ca95 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_networking-mpssvc-svc.resources_31bf3856ad364e35_10.0.15063.0_de-de_f9e061c50cc99b3e_firewallapi.dll.mui_43c7a05b some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..iagnostic.resources_31bf3856ad364e35_10.0.15063.0_tr-tr_56267d09fac4d7b0.manifest some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-rasserver.resources_31bf3856ad364e35_10.0.15063.0_de-de_edb8c1d83a8ccb6e.manifest some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-i..r_service.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_0a2d92d31f26b1b9_iscsiexe.dll.mui_7d81b1cc some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..-usermode.resources_31bf3856ad364e35_10.0.15063.0_it-it_64a328f85aa51b62_wudfsvc.dll.mui_e907fe77 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-f..ependencyminifilter_31bf3856ad364e35_10.0.15063.0_none_3b66d324c049b96f_fsdepends.sys_fe2390cb some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-grouppolicy-base_31bf3856ad364e35_10.0.15063.0_none_39373b181fd15f6d_gpapi.dll_868dd225 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_ro-ro_9eee956fea195b3b.manifest some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-imm32_31bf3856ad364e35_10.0.15063.0_none_77bea1a1e79a7865.manifest some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-w..r-webclnt.resources_31bf3856ad364e35_10.0.15063.0_de-de_a78df7cf1a8f042b_webclnt.dll.mui_e8f04040 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.15063.0_ru-ru_b767e6d3720d3033.manifest some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-eventlog-api_31bf3856ad364e35_10.0.15063.0_none_bd44db559e18ebcf_wevtapi.dll_df064540 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..r_service.resources_31bf3856ad364e35_10.0.15063.0_fr-fr_664c2e56d78422ef_iscsicli.exe.mui_64c0a23c some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-p..onmanager.resources_31bf3856ad364e35_10.0.15063.0_en-us_0f3f9edc83750aba.manifest some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\wow64_microsoft-windows-appid.resources_31bf3856ad364e35_10.0.15063.0_es-es_515e69731a3131d1.manifest some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_10.0.15063.0_none_eb8784774de6a9ad_iscsiwmiv2.dll_daf801c2 some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_10.0.15063.0_ko-kr_ce5152af8ee877a4.manifest some_malicious_file.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.15063.0_es-es_8fb72afa21e2997c.manifest some_malicious_file.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 3408 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 36 IoCs
Processes:
some_malicious_file.exepid process 752 some_malicious_file.exe 752 some_malicious_file.exe 752 some_malicious_file.exe 752 some_malicious_file.exe 752 some_malicious_file.exe 752 some_malicious_file.exe 752 some_malicious_file.exe 752 some_malicious_file.exe 752 some_malicious_file.exe 752 some_malicious_file.exe 752 some_malicious_file.exe 752 some_malicious_file.exe 752 some_malicious_file.exe 752 some_malicious_file.exe 752 some_malicious_file.exe 752 some_malicious_file.exe 752 some_malicious_file.exe 752 some_malicious_file.exe 752 some_malicious_file.exe 752 some_malicious_file.exe 752 some_malicious_file.exe 752 some_malicious_file.exe 752 some_malicious_file.exe 752 some_malicious_file.exe 752 some_malicious_file.exe 752 some_malicious_file.exe 752 some_malicious_file.exe 752 some_malicious_file.exe 752 some_malicious_file.exe 752 some_malicious_file.exe 752 some_malicious_file.exe 752 some_malicious_file.exe 752 some_malicious_file.exe 752 some_malicious_file.exe 752 some_malicious_file.exe 752 some_malicious_file.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 4256 vssvc.exe Token: SeRestorePrivilege 4256 vssvc.exe Token: SeAuditPrivilege 4256 vssvc.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
some_malicious_file.execmd.exedescription pid process target process PID 752 wrote to memory of 2216 752 some_malicious_file.exe cmd.exe PID 752 wrote to memory of 2216 752 some_malicious_file.exe cmd.exe PID 752 wrote to memory of 2216 752 some_malicious_file.exe cmd.exe PID 2216 wrote to memory of 3408 2216 cmd.exe vssadmin.exe PID 2216 wrote to memory of 3408 2216 cmd.exe vssadmin.exe PID 2216 wrote to memory of 3408 2216 cmd.exe vssadmin.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\some_malicious_file.exe"C:\Users\Admin\AppData\Local\Temp\some_malicious_file.exe"1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe Delete Shadows /All /Quiet & bcdedit /set {default} recoveryenabled No & bcdedit /set {default} bootstatuspolicy ignoreallfailures2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Recovery\r4qti7176-readme.txtFilesize
6KB
MD5e2a005da08ad0653731fb8999c7db338
SHA189e4e340889c0b523d3a8826f897b7c7b328fcb7
SHA256eaf963165a06b7a8d8e8444c9e0ef45c1fd06b587b5fa10088205756198b30df
SHA512c121fefaaabcd42119f1b1af6cf84ae2f82e08b15cb8b8a30e8b088845d243ec0a7d549ca71566088bb1170acff278c52a789add92ee2b5bcc040f4529a3eb5d
-
memory/752-11-0x0000000002E70000-0x0000000002E8E000-memory.dmpFilesize
120KB
-
memory/752-5-0x00000000012B0000-0x00000000012B6000-memory.dmpFilesize
24KB
-
memory/752-12-0x0000000003620000-0x0000000003647000-memory.dmpFilesize
156KB
-
memory/752-14-0x00000000037E0000-0x000000000387A000-memory.dmpFilesize
616KB
-
memory/752-13-0x0000000003650000-0x00000000037D9000-memory.dmpFilesize
1.5MB
-
memory/752-6-0x00000000012B0000-0x00000000012B6000-memory.dmpFilesize
24KB
-
memory/752-8-0x0000000003000000-0x00000000030AE000-memory.dmpFilesize
696KB
-
memory/752-9-0x00000000031B0000-0x00000000033F9000-memory.dmpFilesize
2.3MB
-
memory/752-10-0x00000000034D0000-0x000000000361A000-memory.dmpFilesize
1.3MB
-
memory/752-0-0x0000000001230000-0x000000000123A000-memory.dmpFilesize
40KB
-
memory/752-4-0x00000000012A0000-0x00000000012A1000-memory.dmpFilesize
4KB
-
memory/752-3-0x00000000012B0000-0x00000000012B6000-memory.dmpFilesize
24KB
-
memory/752-2-0x0000000001250000-0x0000000001251000-memory.dmpFilesize
4KB
-
memory/752-15-0x0000000003880000-0x0000000003976000-memory.dmpFilesize
984KB
-
memory/752-16-0x0000000003980000-0x00000000039AD000-memory.dmpFilesize
180KB
-
memory/752-17-0x00000000039B0000-0x0000000003A4D000-memory.dmpFilesize
628KB
-
memory/752-18-0x0000000003A90000-0x0000000003BB5000-memory.dmpFilesize
1.1MB
-
memory/752-20-0x0000000003CC0000-0x0000000003D19000-memory.dmpFilesize
356KB
-
memory/752-19-0x0000000003C10000-0x0000000003CB1000-memory.dmpFilesize
644KB
-
memory/752-21-0x00000000012A0000-0x00000000012A1000-memory.dmpFilesize
4KB
-
memory/752-1-0x0000000001240000-0x0000000001241000-memory.dmpFilesize
4KB