Overview

overview

10

Static

static

10

Chaos Rans...er.exe

windows10-2004-x64

Resubmissions

26/03/2024, 03:42

240326-d9ssfsfe3x10

24/03/2024, 08:51

240324-ksdersdh8x10

23/03/2024, 11:58

240323-n5jn4aae7w

23/03/2024, 11:47

240323-nxzeksff9710

Analysis

  • max time kernel
    612s
  • max time network
    613s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/03/2024, 11:47

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    Chaos Ransomware Builder.exe
  • Size 550KB
  • Sample240323-nxzeksff97
  • SHA256 f2665f89ba53abd3deb81988c0d5194992214053e77fc89b98b64a31a7504d77
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
chaosevasionransomwarespywarestealer

Malware Config

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos
  • Chaos Ransomware 4 IoCs
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 6 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 34 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 10 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 64 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder.exe
    "C:\Users\Admin\AppData\Local\Temp\Chaos Ransomware Builder.exe"
    1⤵
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1552
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xny2v1ie\xny2v1ie.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4952
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7574.tmp" "c:\Users\Admin\Desktop\CSC30DFECC22B1042E58AA0F7DCD868ACB.TMP"
        3⤵
          PID:1492
    • C:\Users\Admin\Desktop\cs go cheats.exe
      "C:\Users\Admin\Desktop\cs go cheats.exe"
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3712
      • C:\Users\Admin\AppData\Roaming\svchost.exe
        "C:\Users\Admin\AppData\Roaming\svchost.exe"
        2⤵
        • Checks computer location settings
        • Drops startup file
        • Executes dropped EXE
        • Drops desktop.ini file(s)
        • Sets desktop wallpaper using registry
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:60
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4204
          • C:\Windows\system32\vssadmin.exe
            vssadmin delete shadows /all /quiet
            4⤵
            • Interacts with shadow copies
            PID:3644
          • C:\Windows\System32\Wbem\WMIC.exe
            wmic shadowcopy delete
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3820
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4568
          • C:\Windows\system32\bcdedit.exe
            bcdedit /set {default} bootstatuspolicy ignoreallfailures
            4⤵
            • Modifies boot configuration data using bcdedit
            PID:4284
          • C:\Windows\system32\bcdedit.exe
            bcdedit /set {default} recoveryenabled no
            4⤵
            • Modifies boot configuration data using bcdedit
            PID:2524
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3860
          • C:\Windows\system32\wbadmin.exe
            wbadmin delete catalog -quiet
            4⤵
            • Deletes backup catalog
            PID:448
        • C:\Windows\system32\NOTEPAD.EXE
          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt
          3⤵
          • Opens file in notepad (likely ransom note)
          PID:3548
    • C:\Users\Admin\Desktop\cs go cheats.exe
      "C:\Users\Admin\Desktop\cs go cheats.exe"
      1⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3284
      • C:\Users\Admin\AppData\Roaming\svchost.exe
        "C:\Users\Admin\AppData\Roaming\svchost.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1392
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:4668
    • C:\Windows\system32\wbengine.exe
      "C:\Windows\system32\wbengine.exe"
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1348
    • C:\Windows\System32\vdsldr.exe
      C:\Windows\System32\vdsldr.exe -Embedding
      1⤵
        PID:1812
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Checks SCSI registry key(s)
        PID:3660
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k SDRSVC
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4736
      • C:\Windows\System32\rundll32.exe
        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
        1⤵
          PID:1308
        • C:\Windows\system32\taskmgr.exe
          "C:\Windows\system32\taskmgr.exe" /4
          1⤵
          • Drops startup file
          • Checks SCSI registry key(s)
          • Modifies registry class
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:4752
        • C:\Windows\system32\taskmgr.exe
          "C:\Windows\system32\taskmgr.exe" /4
          1⤵
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          PID:1084
        • C:\Windows\system32\LogonUI.exe
          "LogonUI.exe" /flags:0x4 /state0:0xa389c855 /state1:0x41c64e6d
          1⤵
          • Modifies data under HKEY_USERS
          • Suspicious use of SetWindowsHookEx
          PID:2668

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              cs go cheats.exe.log
              • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\cs go cheats.exe.log
              • Size 226B
              • SHA256 2391511d0a66ed9f84ae54254f51c09e43be01ad685db80da3201ec880abd49c
              • MD5 SHA1 SHA512
              Submit Download

              .ses
              • Path C:\Users\Admin\AppData\Local\Temp\.ses
              • Size 53B
              • SHA256 4fe65655965af5b21f69e513ff63594584ed4bd1773a902f571ce3346d4969bb
              • MD5 SHA1 SHA512
              Submit Download

              publicKey.chaos
              • Path C:\Users\Admin\AppData\Local\Temp\123-decrypter\publicKey.chaos
              • Size 397B
              • SHA256 4612cccf419770ca20fec849f2a581bccdd3286c107267743edeaab0a7a804c7
              • MD5 SHA1 SHA512
              Submit Download

              AdobeSFX.log
              • Path C:\Users\Admin\AppData\Local\Temp\AdobeSFX.log
              • Size 1KB
              • SHA256 1513ea1d5935cf8fbeaee54572da656a70602cc4b376bfe0ce997426b2ae0f89
              • MD5 SHA1 SHA512
              Submit Download

              FHOHZANM-20240226-1610.log
              • Path C:\Users\Admin\AppData\Local\Temp\FHOHZANM-20240226-1610.log
              • Size 57KB
              • SHA256 f8af4b2574c043d8db7143291356fea0a939b1311c74e4ba87dd6801b8c1f55f
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              FHOHZANM-20240226-1610a.log
              • Path C:\Users\Admin\AppData\Local\Temp\FHOHZANM-20240226-1610a.log
              • Size 181KB
              • SHA256 334b0a2a5b5561e52d01472887c299c37a46ad228450e86a8ae0c8cdac922bc1
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              JavaDeployReg.log
              • Path C:\Users\Admin\AppData\Local\Temp\JavaDeployReg.log
              • Size 13KB
              • SHA256 19992eb51ea2c9b4f2d69a3f3b66bfb38d8de5a50fa911623dd1206b1092bb5f
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Microsoft .NET Framework 4.7.2 Setup_20240226_160545023.html
              • Path C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20240226_160545023.html
              • Size 93KB
              • SHA256 599bedd2361568882293ec390671f8b1b97332ac9083d730bab3390657633bcd
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Microsoft_Windows_Desktop_Runtime_-_6.0.25_(x64)_20240226160625.log
              • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.25_(x64)_20240226160625.log
              • Size 15KB
              • SHA256 69a1d47a09bcc81857aaf8a2684ea9fe9612749716471e94a5bf80ef3738784a
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Microsoft_Windows_Desktop_Runtime_-_6.0.25_(x64)_20240226160625_000_dotnet_runtime_6.0.25_win_x64.msi.log
              • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.25_(x64)_20240226160625_000_dotnet_runtime_6.0.25_win_x64.msi.log
              • Size 551KB
              • SHA256 2935ea1fd4a238fb2d795570d49bb0e1b11b1ab19b60c362f2eea2e690af8a7d
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Microsoft_Windows_Desktop_Runtime_-_6.0.25_(x64)_20240226160625_001_dotnet_hostfxr_6.0.25_win_x64.msi.log
              • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.25_(x64)_20240226160625_001_dotnet_hostfxr_6.0.25_win_x64.msi.log
              • Size 95KB
              • SHA256 75f3b7785b9e622bf0e78a5f1fe995a0bf72c2d5d104e1857335b00f67ee38cb
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Microsoft_Windows_Desktop_Runtime_-_6.0.25_(x64)_20240226160625_002_dotnet_host_6.0.25_win_x64.msi.log
              • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.25_(x64)_20240226160625_002_dotnet_host_6.0.25_win_x64.msi.log
              • Size 105KB
              • SHA256 ee21a4a8eec4b1380899df28eb60859f452debdce13409b438f687b3955303a9
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Microsoft_Windows_Desktop_Runtime_-_6.0.25_(x64)_20240226160625_003_windowsdesktop_runtime_6.0.25_win_x64.msi.log
              • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_6.0.25_(x64)_20240226160625_003_windowsdesktop_runtime_6.0.25_win_x64.msi.log
              • Size 849KB
              • SHA256 238021e307df9b22311f420c1932736a2476e764f93fb6bf7c8e12f775184491
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Microsoft_Windows_Desktop_Runtime_-_8.0.0_(x64)_20240226160708.log
              • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.0_(x64)_20240226160708.log
              • Size 15KB
              • SHA256 2f7696929a1f5954cfbbfd10b4caba411b1ed6cce9fd2e8a51dbbb85fd00c533
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              RES7574.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\RES7574.tmp
              • Size 1KB
              • SHA256 a82c42cb9866be55d9d6bac990e472412b711602dae6248858228736cb34da7a
              • MD5 SHA1 SHA512
              Submit Download

              aria-debug-2484.log
              • Path C:\Users\Admin\AppData\Local\Temp\aria-debug-2484.log
              • Size 470B
              • SHA256 74f478e144a356ca393e41e798a7f1d05072560d86b95d099ea8980b51f2b073
              • MD5 SHA1 SHA512
              Submit Download

              chrome_installer.log
              • Path C:\Users\Admin\AppData\Local\Temp\chrome_installer.log
              • Size 6KB
              • SHA256 43e02f6861d01d2ab6fd5a9a5cebefb48ac2e534a071d36b758607d22c4470f1
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              cqk4zi3ch.jpg
              • Path C:\Users\Admin\AppData\Local\Temp\cqk4zi3ch.jpg
              • Size 457KB
              • SHA256 9899c79af2bca83ee873c053febcd2cc2d559580fc1c55fb301d7e8b782d5854
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt
              • Path C:\Users\Admin\AppData\Local\Temp\dd_NDP472-KB4054530-x86-x64-AllOS-ENU_decompression_log.txt
              • Size 1KB
              • SHA256 a460c1a6d4fcb81a308990b73df8887e019501a2a34f4549bdbc911ea6c0616b
              • MD5 SHA1 SHA512
              Submit Download

              dd_vcredistMSI12AB.txt
              • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI12AB.txt
              • Size 427KB
              • SHA256 57c84cbf23938f510ec234ff3cfb724459aa0eb95dbb86820048c5760e410288
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              dd_vcredistMSI12CF.txt
              • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistMSI12CF.txt
              • Size 416KB
              • SHA256 6fe0c9f02539240b215b2afc94613accedf32e531d896b6fa6179bf4c5f6ca29
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              dd_vcredistUI12AB.txt
              • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI12AB.txt
              • Size 11KB
              • SHA256 8509b559ff81edcdd7cd249e6ea15c0c94b6f27c333c54ea041ca7579fa1c5ac
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              dd_vcredistUI12CF.txt
              • Path C:\Users\Admin\AppData\Local\Temp\dd_vcredistUI12CF.txt
              • Size 11KB
              • SHA256 1db4d460e5e5215ac70c3275693297dc3f0bdb0361444ec1a727cd3bab7b24a2
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              jawshtml.html
              • Path C:\Users\Admin\AppData\Local\Temp\jawshtml.html
              • Size 13B
              • SHA256 7b4f72a40bd21934680f085afe8a30bf85acff1a8365af43102025c4ccf52b73
              • MD5 SHA1 SHA512
              Submit Download

              jusched.log
              • Path C:\Users\Admin\AppData\Local\Temp\jusched.log
              • Size 153KB
              • SHA256 fb354420ebeeb45ed4307cdace7167b78dc9176629d2358322bfbe97c5a2fff7
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              desktop.ini.ma20
              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini.ma20
              • Size 436B
              • SHA256 cc3ade22fbd3367e4477102b4119e08bd341189a96f5caf79cf59db5582f6da7
              • MD5 SHA1 SHA512
              Submit Download

              svchost.url
              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url
              • Size 142B
              • SHA256 0a3bdc40dc0d243784bc5fa887b79110350b3d3200684f3ba99880fcea40e3b8
              • MD5 SHA1 SHA512
              Submit Download

              sdf.txt
              • Path C:\Users\Admin\AppData\Roaming\sdf.txt
              • Size 812KB
              • SHA256 4147b7e0c0f55696390e69d7e7afeaf0c9d023a0e1945417d53b63c6750ae280
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              cs go cheats.exe
              • Path C:\Users\Admin\Desktop\cs go cheats.exe
              • Size 1.2MB
              • SHA256 5b51b6de226f11a27c776488c1d454027cac6aed09784efcb70d93836e8cfc09
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              read_it.txt
              • Path C:\Users\Admin\Documents\read_it.txt
              • Size 8B
              • SHA256 8235ae9fab4ab01ca7c181ecb8d094b58cf1999af0700feae504561afb69c09e
              • MD5 SHA1 SHA512
              Submit Download

              gw1gni.exe
              • Path C:\Windows\System32\gw1gni.exe
              • Size 7.2MB
              • SHA256 d95c7b2e5cac794ad6116e26a9bd394164c2f29775cd8d419d57b513ab974bc2
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              vcredist2010_x64.log-MSI_vc_red.msi.txt
              • Path C:\vcredist2010_x64.log-MSI_vc_red.msi.txt
              • Size 380KB
              • SHA256 829a125e5f83650081e6a0135231f82b62ec0fee40b68653ba9f71f66d2e4316
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              vcredist2010_x64.log.html
              • Path C:\vcredist2010_x64.log.html
              • Size 86KB
              • SHA256 53ce916649818842bf7a82f27837bb3ad5648ba1e7858669534df30b1ca92a71
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              vcredist2010_x86.log-MSI_vc_red.msi.txt
              • Path C:\vcredist2010_x86.log-MSI_vc_red.msi.txt
              • Size 395KB
              • SHA256 fc4822c03e3ce76c3f5b0a5daa12affce28cefb0ef33161d1d26b4ce4ec8998b
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              vcredist2010_x86.log.html
              • Path C:\vcredist2010_x86.log.html
              • Size 80KB
              • SHA256 badabe7b4af2e2429a94f2a9608aff88c72992e3ee54787991fa205bb91bbb82
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              vcredist2012_x64_0_vcRuntimeMinimum_x64.log
              • Path C:\vcredist2012_x64_0_vcRuntimeMinimum_x64.log
              • Size 168KB
              • SHA256 320bf8b97f1e816055dfbaae959f8fd0221343c19402cb8b365697ce31b62f77
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              vcredist2012_x64_1_vcRuntimeAdditional_x64.log
              • Path C:\vcredist2012_x64_1_vcRuntimeAdditional_x64.log
              • Size 195KB
              • SHA256 62f4df2dcb1c7ee2373c23f97689a9cfba1263501d2f7094281f4cd5cce5689f
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              vcredist2012_x86_0_vcRuntimeMinimum_x86.log
              • Path C:\vcredist2012_x86_0_vcRuntimeMinimum_x86.log
              • Size 171KB
              • SHA256 9a92879369170caabcb878eeacf063db9792d9a67f361c29088b4c4dc35775c2
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              vcredist2012_x86_1_vcRuntimeAdditional_x86.log
              • Path C:\vcredist2012_x86_1_vcRuntimeAdditional_x86.log
              • Size 208KB
              • SHA256 8241549f5caa14629e530b8bf9369df9f363f869d0c749f44881729381cd1ccb
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              vcredist2013_x64_000_vcRuntimeMinimum_x64.log
              • Path C:\vcredist2013_x64_000_vcRuntimeMinimum_x64.log
              • Size 170KB
              • SHA256 a5b539a40e4d05370f779c44c931cde569da2783051cbc760269260092613d30
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              vcredist2013_x64_001_vcRuntimeAdditional_x64.log
              • Path C:\vcredist2013_x64_001_vcRuntimeAdditional_x64.log
              • Size 190KB
              • SHA256 a925c55032643fdcbfb1382149d261233fd923de3c963fd73c401b3c2bb36898
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              vcredist2013_x86_000_vcRuntimeMinimum_x86.log
              • Path C:\vcredist2013_x86_000_vcRuntimeMinimum_x86.log
              • Size 170KB
              • SHA256 a429c25a39d83913a7370fb45475bb6e8ec687d972bd6b95eb30a9c9372b38f0
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              vcredist2013_x86_001_vcRuntimeAdditional_x86.log
              • Path C:\vcredist2013_x86_001_vcRuntimeAdditional_x86.log
              • Size 198KB
              • SHA256 dedaa47dc02aeadc04fafc744f7947389a4bfb1e5de284bfdb448d568089af80
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              vcredist2022_x64_000_vcRuntimeMinimum_x64.log
              • Path C:\vcredist2022_x64_000_vcRuntimeMinimum_x64.log
              • Size 123KB
              • SHA256 9207e0ce4955856ac22efcaf4a81246b46e34748e974b93583f6ae0d23f8297d
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              vcredist2022_x64_001_vcRuntimeAdditional_x64.log
              • Path C:\vcredist2022_x64_001_vcRuntimeAdditional_x64.log
              • Size 129KB
              • SHA256 fd2333ac1151fbda8c43c433024e41419798610c7d623b7d136ffd8bf3cd3690
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              vcredist2022_x86_000_vcRuntimeMinimum_x86.log
              • Path C:\vcredist2022_x86_000_vcRuntimeMinimum_x86.log
              • Size 123KB
              • SHA256 b99c5faf359c18d32f188ec979d58a8899e8f8edeebde6fea2aa5189afce3cb9
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              vcredist2022_x86_001_vcRuntimeAdditional_x86.log
              • Path C:\vcredist2022_x86_001_vcRuntimeAdditional_x86.log
              • Size 135KB
              • SHA256 cdb680985b7e6c40be725e47e2413eebee28048fb7ac700816422aa2bc90bec0
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              xny2v1ie.0.cs
              • Path \??\c:\Users\Admin\AppData\Local\Temp\xny2v1ie\xny2v1ie.0.cs
              • Size 639KB
              • SHA256 a74ed2e5d6f8691580d24fac91c0c3c7743f98e629a5a10c0defc4e16e59a48e
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              xny2v1ie.cmdline
              • Path \??\c:\Users\Admin\AppData\Local\Temp\xny2v1ie\xny2v1ie.cmdline
              • Size 338B
              • SHA256 7854294180c5e8750d4e57211eef3bc7c0debd19ad67548963095261d5778947
              • MD5 SHA1 SHA512
              Submit Download

              CSC30DFECC22B1042E58AA0F7DCD868ACB.TMP
              • Path \??\c:\Users\Admin\Desktop\CSC30DFECC22B1042E58AA0F7DCD868ACB.TMP
              • Size 1KB
              • SHA256 dbb765e226a516eaf39468bbe4087f0d0cd8ceed3127ba8e248839c086b84206
              • MD5 SHA1 SHA512
              Submit Download

              memory/60-49-0x00007FF9FB120000-0x00007FF9FBBE1000-memory.dmp
              Download

              memory/60-498-0x00007FF9FB120000-0x00007FF9FBBE1000-memory.dmp
              Download

              memory/60-479-0x00007FF9FB120000-0x00007FF9FBBE1000-memory.dmp
              Download

              memory/1084-557-0x00000248D4B60000-0x00000248D4B61000-memory.dmp
              Download

              memory/1084-558-0x00000248D4B60000-0x00000248D4B61000-memory.dmp
              Download

              memory/1084-551-0x00000248D4B60000-0x00000248D4B61000-memory.dmp
              Download

              memory/1084-550-0x00000248D4B60000-0x00000248D4B61000-memory.dmp
              Download

              memory/1084-549-0x00000248D4B60000-0x00000248D4B61000-memory.dmp
              Download

              memory/1084-556-0x00000248D4B60000-0x00000248D4B61000-memory.dmp
              Download

              memory/1084-554-0x00000248D4B60000-0x00000248D4B61000-memory.dmp
              Download

              memory/1084-555-0x00000248D4B60000-0x00000248D4B61000-memory.dmp
              Download

              memory/1084-553-0x00000248D4B60000-0x00000248D4B61000-memory.dmp
              Download

              memory/1392-135-0x00007FF9FB120000-0x00007FF9FBBE1000-memory.dmp
              Download

              memory/1392-431-0x00007FF9FB120000-0x00007FF9FBBE1000-memory.dmp
              Download

              memory/1552-4-0x000000001B520000-0x000000001B530000-memory.dmp
              Download

              memory/1552-0-0x0000000000880000-0x000000000090E000-memory.dmp
              Download

              memory/1552-2-0x000000001B520000-0x000000001B530000-memory.dmp
              Download

              memory/1552-1-0x00007FF9FB120000-0x00007FF9FBBE1000-memory.dmp
              Download

              memory/1552-548-0x00007FF9FB120000-0x00007FF9FBBE1000-memory.dmp
              Download

              memory/1552-3-0x00007FF9FB120000-0x00007FF9FBBE1000-memory.dmp
              Download

              memory/1552-5-0x000000001B520000-0x000000001B530000-memory.dmp
              Download

              memory/1552-8-0x000000001B520000-0x000000001B530000-memory.dmp
              Download

              memory/1552-7-0x000000001B520000-0x000000001B530000-memory.dmp
              Download

              memory/1552-6-0x000000001B520000-0x000000001B530000-memory.dmp
              Download

              memory/3284-52-0x00007FF9FB120000-0x00007FF9FBBE1000-memory.dmp
              Download

              memory/3284-134-0x00007FF9FB120000-0x00007FF9FBBE1000-memory.dmp
              Download

              memory/3712-34-0x0000000000AB0000-0x0000000000BEC000-memory.dmp
              Download

              memory/3712-48-0x00007FF9FB120000-0x00007FF9FBBE1000-memory.dmp
              Download

              memory/3712-35-0x00007FF9FB120000-0x00007FF9FBBE1000-memory.dmp
              Download

              memory/4752-490-0x000001AFA5D20000-0x000001AFA5D21000-memory.dmp
              Download

              memory/4752-488-0x000001AFA5D20000-0x000001AFA5D21000-memory.dmp
              Download

              memory/4752-484-0x000001AFA5D20000-0x000001AFA5D21000-memory.dmp
              Download

              memory/4752-483-0x000001AFA5D20000-0x000001AFA5D21000-memory.dmp
              Download

              memory/4752-482-0x000001AFA5D20000-0x000001AFA5D21000-memory.dmp
              Download

              memory/4752-489-0x000001AFA5D20000-0x000001AFA5D21000-memory.dmp
              Download

              memory/4752-492-0x000001AFA5D20000-0x000001AFA5D21000-memory.dmp
              Download

              memory/4752-491-0x000001AFA5D20000-0x000001AFA5D21000-memory.dmp
              Download

              memory/4752-494-0x000001AFA5D20000-0x000001AFA5D21000-memory.dmp
              Download

              memory/4752-493-0x000001AFA5D20000-0x000001AFA5D21000-memory.dmp
              Download