d351ac17dc0d9476ef029484a165f99e258f546bba2d619b1c6485cb8875ac7a

Resubmissions

18/04/2024, 05:22

240418-f2z8nscc74 10

18/04/2024, 05:22

18/04/2024, 05:21

18/04/2024, 05:21

18/04/2024, 05:21

Analysis

max time kernel
1191s
max time network
840s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18/04/2024, 05:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d351ac17dc0d9476ef029484a165f99e258f546bba2d619b1c6485cb8875ac7a.exe
Size

371KB
MD5

bb8cd5df2be7e8bcc5be439675b3d0a2
SHA1

627ac60f64974d5caaf81c2de8ca0977c91f4219
SHA256

d351ac17dc0d9476ef029484a165f99e258f546bba2d619b1c6485cb8875ac7a
SHA512

57031eb7d7b2c27d7ecacdc085d07065ced46a742128f9818f62c9fe6633c31aa8eb20ffc52c8415613787946060f5a6b5adf8b977d5ca4fed9656233ebd9cfa
SSDEEP

6144:tnzQnu/cmM1oSigOQT2F8U92Iu7DMVQZhWLvLRXdYX9ji+uhi2PsrhY:hzQnkM1oSiBGI8bxn5m6i+uo20tY

Score

10^/10

ransomware

Malware Config

Extracted

Path

C:\Users\Public\Recorded TV\Sample Media\_DECRYPT_INFO_zlgvgla.html

Ransom Note

<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Transitional//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd'>  <html xmlns='http://www.w3.org/1999/xhtml'> <head> <meta http-equiv='Content-Type' content='text/html; charset=UTF-8' /> <title>zlgvgla decrypt</title> <style type='text/css'>  </style> <script type='text/javascript'> function init() { var xtime; document.getElementById('fe_text').innerHTML = '00:00:00'; var language = window.navigator.userLanguage || window.navigator.language; if (language.indexOf('-') !== -1) language = language.split('-')[0]; if (language.indexOf('_') !== -1) language = language.split('_')[0]; change_lang(language); var ua = window.navigator.userAgent; var msie = ua.indexOf('MSIE '); xtime = Math.floor( (1713419124+(12*60*60)) - (Date.now()/1000)); if (msie == 0) window.setTimeout('update_timestamp('+xtime+')',1000); else update_timestamp(xtime); } function component(x, y, z) { var res if (z == 1) res = Math.floor(x / y); else res = Math.floor(x / y) % z; if (res < 10) res = '0'+res; return res; } function update_timestamp(tstamp) { if (tstamp < 1) { document.getElementById('fe_text').innerHTML = '00:00:00'; } else { var hours = component(tstamp, 60*60, 1), minutes = component(tstamp, 60, 60), seconds = component(tstamp, 1, 60); document.getElementById('fe_text').innerHTML = hours+':'+minutes+':'+seconds; tstamp-=1; window.setTimeout('update_timestamp('+tstamp+')',1000); } } function change_lang(lang) { if (lang == "de") show_de(); else if (lang == "es") show_es(); else if (lang == "fr") show_fr(); else if (lang == "it") show_it(); else if (lang == "nl") show_nl(); else show_en(); } function show_en() { document.getElementById('text_01').innerHTML = 'WARNING!'; document.getElementById('text_02').innerHTML = 'Your personal files are encrypted.'; document.getElementById('text_03').innerHTML = 'Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. The server will eliminate the key after a time period specified in this window.'; document.getElementById('text_09').innerHTML = 'Download TOR Browser from'; document.getElementById('text_10').innerHTML = 'In the Tor Browser open the'; document.getElementById('text_11').innerHTML = '(Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable).'; document.getElementById('text_12').innerHTML = 'Write in the following public key in the input from on server:'; } function show_de() { document.getElementById('text_01').innerHTML = 'WARNUNG!'; document.getElementById('text_02').innerHTML = 'Ihre persönlichen Dateien sind verschlüsselt!'; document.getElementById('text_03').innerHTML = 'Ihre Dokumente, Fotos, Datenbanken und andere wichtige Dateien wurden mit der stärkste Verschlüsselung und einem einzigartigen Schlüssel verschlüsselt, der für diesen Computer generiert wurde. Der Dechiffrierschlüssel ist auf einem geheimen Internet-Server gespeichert und niemand kann Ihre Dateien entschlüsseln, bis Sie bezahlen und den privaten Schlüssel erhalten. Der Server wird den Schlüssel nach einer bestimmten Zeit löschen, die in diesem Fenster angezeigt wird.'; document.getElementById('text_09').innerHTML = 'Laden Sie TOR-Browser von'; document.getElementById('text_10').innerHTML = 'Im Tor-Browser öffnen Sie'; document.getElementById('text_11').innerHTML = '(Beachten Sie, dass dieser Server nur über den Tor-Browser verfügbar ist. Wiederholen Sie den Vorgang nach 1 Stunde, wenn die Website nicht erreichbar ist).'; document.getElementById('text_12').innerHTML = 'Schreiben Sie den folgenden öffentlichen Schlüssel in die Eingabemaske auf dem Server:'; } function show_es() { document.getElementById('text_01').innerHTML = '¡PELIGRO!'; document.getElementById('text_02').innerHTML = '¡Tus archivos personales han sido encriptados!'; document.getElementById('text_03').innerHTML = 'Tus documentos, fotos, bases de datos y otros archivos importantes han sido encriptados con una encriptación extremadamente fuerte y una clave única, generada para este computador. La clave de desencriptación privada está almacenada en un servidor de internet secreto. El servidor eliminará la clave luego del tiempo especificado en esta ventana.'; document.getElementById('text_09').innerHTML = 'Descarga el navegador TOR desde'; document.getElementById('text_10').innerHTML = 'En el navegador TOR abre'; document.getElementById('text_11').innerHTML = '(Nota que este servidor solo es accesible desde el navegador TOR. Intenta nuevamente en 1 hora si no puedes acceder).'; document.getElementById('text_12').innerHTML = 'Escribe la siguiente clave publica en la forma de ingreso del servidor:'; } function show_fr() { document.getElementById('text_01').innerHTML = 'ATTENTION!'; document.getElementById('text_02').innerHTML = 'Vos fichiers personnels ont été cryptés !'; document.getElementById('text_03').innerHTML = 'Vos documents, photos, bases de données, et autres fichiers importants ont été cryptées avec le meilleur processus de cryptage et une clé unique générée pour cet ordinateur. La clé privée de cryptage est accessible sur un serveur Internet secret et personne ne peut décrypter vos fichiers à moins que vous ne payiez et obtenez cette clé. Le serveur éliminera la clé après le compte à rebours affiché sur cette fenêtre.'; document.getElementById('text_09').innerHTML = 'Télécharger le navigateur TOR de'; document.getElementById('text_10').innerHTML = 'Dans le navigateur, ouvrez '; document.getElementById('text_11').innerHTML = '(Veuillez noter que ce serveur est disponible via le navigateur Tor uniquement. Réessayez dans 1 heure si le site n’est pas accessible).'; document.getElementById('text_12').innerHTML = 'Ecrivez les clés publiques suivantes sur le portail d’entrée du serveur :'; } function show_it() { document.getElementById('text_01').innerHTML = 'ATTENZIONE!'; document.getElementById('text_02').innerHTML = 'I tuoi file personali sono criptati!'; document.getElementById('text_03').innerHTML = 'I tuoi documenti, le tue foto, database e altri file importanti sono stati criptati con forte codificazione ed una chiave unica, generata appositamente per questo computer. La chiave segreta di decriptazione è conservata su un server Internet segreto e nessuno può decriptare i tuoi file finché non paghi per ottenere la chiave. Il server eliminerà la chiave dopo il tempo indicato in questa finestra.'; document.getElementById('text_09').innerHTML = 'Scarica il Browser TOR da'; document.getElementById('text_10').innerHTML = 'Nel Browser TOR apri il link'; document.getElementById('text_11').innerHTML = '(Nota che questo server è disponibile solo tramite il Browser TOR. Riprova tra un’ora se il sito non è raggiungibile).'; document.getElementById('text_12').innerHTML = 'Scrivi la seguente chiave pubblica nel modulo di input sul server:'; } function show_nl() { document.getElementById('text_01').innerHTML = 'WAARSCHUWING!'; document.getElementById('text_02').innerHTML = 'Uw persoonlijke bestanden zijn gecodeerd!'; document.getElementById('text_03').innerHTML = 'Uw documenten, foto’s, databases en andere belangrijke bestanden zijn gecodeerd met de sterkste encryptie en een unieke sleutel, gegenereerd voor deze computer. De persoonlijke decoderingssleutel is te vinden op een geheime Internet server en niemand kan uw bestanden decoderen totdat u betaalt en de persoonlijke sleutel heeft. De server zal de sleutel elimineren na de tijdsperiode genoemd in dit venster.'; document.getElementById('text_09').innerHTML = 'Download de TOR Browser van'; document.getElementById('text_10').innerHTML = 'In de Tor Browser, open'; document.getElementById('text_11').innerHTML = '(Let op dat deze server alleen via de Tor Browser te bereiken is. Probeer het na een uur weer als de site niet werkt).'; document.getElementById('text_12').innerHTML = 'Schrijf in de volgende openbare sleutel in het invoerformulier op de server:'; } //var language = window.navigator.userLanguage || window.navigator.language; //alert(language); </script> </head> <body onload='init();'> <div align='center'> <table width='700' height='100%' border='0' cellpadding='0' cellspacing='0' bgcolor='#000000'> <tr> <td width='225' align='left'><img src='file:///C:/Users/Admin/AppData/Local/Temp/zlgvgla.gif' width='225' height='221' /></td> <td width='415' valign='top'><div align='center' class='style1' id='text_01'>WARNING!</div><br /> <div align='center' id='text_02'>Your personal files are encrypted.<br /> <br /> <br /> </div> <div align='center' class='style3' id='fe_text'></div></p> <div class="styled-select" align='center'> <select id ="ddl" name="ddl" onmousedown="this.value='';" onchange="change_lang(this.value);"> <option selected disabled value="" style="display:none;">Select language</option> <option value='en'>   ENGLISH</option> <option value='de'>   GERMAN</option> <option value='es'>   SPANISH</option> <option value='fr'>   FRENCH</option> <option value='it'>   ITALIAN</option> <option value='nl'>   DUTCH</option> </select> </div> </td> </tr> <tr> <td colspan='2' align='center'><table width='97%' border='0' cellpadding='0' cellspacing='0'> <tr> <td colspan='2' align='left'> <br /> <div id='text_03'>Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. The server will eliminate the key after a time period specified in this window.</div><br /> <br /> </td> </tr> <tr> <td colspan='2' align='left'> 1) <span id='text_09'>Download TOR Browser from</span> <a href='http://torproject.org' class='style4'>http://torproject.org</a><br /> 2) <span id='text_10'>In the Tor Browser open the</span> <span class='style6'>http://maktubmvgn22y2ns.onion</span><br /><br /> <span id='text_11'>(Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable).</span><br /> <br /> <span class='style5' id='text_12'>Write in the following public key in the input from on server:</span><br /><br /> <div align='center'><textarea class='style7'> CTG7W-NR1GG-8BXB3-VZP6Y-UJSUV-8QFTM-27X1S-5FKGQ-Q2FGB-1N4VV-YMFUB-A4D1G-SNGKV-RPMUG ZXBSW-TZMSH-UYN5W-KS7CC-VUDQC-U1P5P-83KUU-KN36U-YK4V4-PX0PX-J1M40-2XR7Q-CVXXU-4ZWMB HV6S0-M2JZF-U6BMM-W45NH-UN2W2-UBHCF-W88TV-ECV4X-6FR8D-MHKDP-2A2RT-3CV5K-2KQFM-V3CS4 KHFQH-E134A-BKK7J-SGWAT-RKMX1-JXY03-KYD72-CG7BW-UJSTD-BTG3Q-3CFXD-0CMMS-XYYD7-KHKRZ YF766-RESA1-ADN8Y-805E1-X12SZ-KUVB5-05Y48-RQ4JW-CGCX3-EPVDA-GZ0MA-KWFTQ-USPG5-0MK7D JSTNH-T2VFZ-M50GJ-VDTS8-DM8FM-R6CFE-U3WWY-10GX6-EUE3F-70MCG-WCZEV-W3UYQ </textarea> <br /> </div> <br /> <br /> <br /> </div> </td> </tr> </table></td> </tr> </table> </div> </body> </html>

URLs

http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd'>

http-equiv='Content-Type

Extracted

Path

C:\Users\Public\Music\Sample Music\_DECRYPT_INFO_zlgvgla.html

Ransom Note

<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Transitional//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd'>  <html xmlns='http://www.w3.org/1999/xhtml'> <head> <meta http-equiv='Content-Type' content='text/html; charset=UTF-8' /> <title>zlgvgla decrypt</title> <style type='text/css'>  </style> <script type='text/javascript'> function init() { var xtime; document.getElementById('fe_text').innerHTML = '00:00:00'; var language = window.navigator.userLanguage || window.navigator.language; if (language.indexOf('-') !== -1) language = language.split('-')[0]; if (language.indexOf('_') !== -1) language = language.split('_')[0]; change_lang(language); var ua = window.navigator.userAgent; var msie = ua.indexOf('MSIE '); xtime = Math.floor( (1713419125+(12*60*60)) - (Date.now()/1000)); if (msie == 0) window.setTimeout('update_timestamp('+xtime+')',1000); else update_timestamp(xtime); } function component(x, y, z) { var res if (z == 1) res = Math.floor(x / y); else res = Math.floor(x / y) % z; if (res < 10) res = '0'+res; return res; } function update_timestamp(tstamp) { if (tstamp < 1) { document.getElementById('fe_text').innerHTML = '00:00:00'; } else { var hours = component(tstamp, 60*60, 1), minutes = component(tstamp, 60, 60), seconds = component(tstamp, 1, 60); document.getElementById('fe_text').innerHTML = hours+':'+minutes+':'+seconds; tstamp-=1; window.setTimeout('update_timestamp('+tstamp+')',1000); } } function change_lang(lang) { if (lang == "de") show_de(); else if (lang == "es") show_es(); else if (lang == "fr") show_fr(); else if (lang == "it") show_it(); else if (lang == "nl") show_nl(); else show_en(); } function show_en() { document.getElementById('text_01').innerHTML = 'WARNING!'; document.getElementById('text_02').innerHTML = 'Your personal files are encrypted.'; document.getElementById('text_03').innerHTML = 'Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. The server will eliminate the key after a time period specified in this window.'; document.getElementById('text_09').innerHTML = 'Download TOR Browser from'; document.getElementById('text_10').innerHTML = 'In the Tor Browser open the'; document.getElementById('text_11').innerHTML = '(Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable).'; document.getElementById('text_12').innerHTML = 'Write in the following public key in the input from on server:'; } function show_de() { document.getElementById('text_01').innerHTML = 'WARNUNG!'; document.getElementById('text_02').innerHTML = 'Ihre persönlichen Dateien sind verschlüsselt!'; document.getElementById('text_03').innerHTML = 'Ihre Dokumente, Fotos, Datenbanken und andere wichtige Dateien wurden mit der stärkste Verschlüsselung und einem einzigartigen Schlüssel verschlüsselt, der für diesen Computer generiert wurde. Der Dechiffrierschlüssel ist auf einem geheimen Internet-Server gespeichert und niemand kann Ihre Dateien entschlüsseln, bis Sie bezahlen und den privaten Schlüssel erhalten. Der Server wird den Schlüssel nach einer bestimmten Zeit löschen, die in diesem Fenster angezeigt wird.'; document.getElementById('text_09').innerHTML = 'Laden Sie TOR-Browser von'; document.getElementById('text_10').innerHTML = 'Im Tor-Browser öffnen Sie'; document.getElementById('text_11').innerHTML = '(Beachten Sie, dass dieser Server nur über den Tor-Browser verfügbar ist. Wiederholen Sie den Vorgang nach 1 Stunde, wenn die Website nicht erreichbar ist).'; document.getElementById('text_12').innerHTML = 'Schreiben Sie den folgenden öffentlichen Schlüssel in die Eingabemaske auf dem Server:'; } function show_es() { document.getElementById('text_01').innerHTML = '¡PELIGRO!'; document.getElementById('text_02').innerHTML = '¡Tus archivos personales han sido encriptados!'; document.getElementById('text_03').innerHTML = 'Tus documentos, fotos, bases de datos y otros archivos importantes han sido encriptados con una encriptación extremadamente fuerte y una clave única, generada para este computador. La clave de desencriptación privada está almacenada en un servidor de internet secreto. El servidor eliminará la clave luego del tiempo especificado en esta ventana.'; document.getElementById('text_09').innerHTML = 'Descarga el navegador TOR desde'; document.getElementById('text_10').innerHTML = 'En el navegador TOR abre'; document.getElementById('text_11').innerHTML = '(Nota que este servidor solo es accesible desde el navegador TOR. Intenta nuevamente en 1 hora si no puedes acceder).'; document.getElementById('text_12').innerHTML = 'Escribe la siguiente clave publica en la forma de ingreso del servidor:'; } function show_fr() { document.getElementById('text_01').innerHTML = 'ATTENTION!'; document.getElementById('text_02').innerHTML = 'Vos fichiers personnels ont été cryptés !'; document.getElementById('text_03').innerHTML = 'Vos documents, photos, bases de données, et autres fichiers importants ont été cryptées avec le meilleur processus de cryptage et une clé unique générée pour cet ordinateur. La clé privée de cryptage est accessible sur un serveur Internet secret et personne ne peut décrypter vos fichiers à moins que vous ne payiez et obtenez cette clé. Le serveur éliminera la clé après le compte à rebours affiché sur cette fenêtre.'; document.getElementById('text_09').innerHTML = 'Télécharger le navigateur TOR de'; document.getElementById('text_10').innerHTML = 'Dans le navigateur, ouvrez '; document.getElementById('text_11').innerHTML = '(Veuillez noter que ce serveur est disponible via le navigateur Tor uniquement. Réessayez dans 1 heure si le site n’est pas accessible).'; document.getElementById('text_12').innerHTML = 'Ecrivez les clés publiques suivantes sur le portail d’entrée du serveur :'; } function show_it() { document.getElementById('text_01').innerHTML = 'ATTENZIONE!'; document.getElementById('text_02').innerHTML = 'I tuoi file personali sono criptati!'; document.getElementById('text_03').innerHTML = 'I tuoi documenti, le tue foto, database e altri file importanti sono stati criptati con forte codificazione ed una chiave unica, generata appositamente per questo computer. La chiave segreta di decriptazione è conservata su un server Internet segreto e nessuno può decriptare i tuoi file finché non paghi per ottenere la chiave. Il server eliminerà la chiave dopo il tempo indicato in questa finestra.'; document.getElementById('text_09').innerHTML = 'Scarica il Browser TOR da'; document.getElementById('text_10').innerHTML = 'Nel Browser TOR apri il link'; document.getElementById('text_11').innerHTML = '(Nota che questo server è disponibile solo tramite il Browser TOR. Riprova tra un’ora se il sito non è raggiungibile).'; document.getElementById('text_12').innerHTML = 'Scrivi la seguente chiave pubblica nel modulo di input sul server:'; } function show_nl() { document.getElementById('text_01').innerHTML = 'WAARSCHUWING!'; document.getElementById('text_02').innerHTML = 'Uw persoonlijke bestanden zijn gecodeerd!'; document.getElementById('text_03').innerHTML = 'Uw documenten, foto’s, databases en andere belangrijke bestanden zijn gecodeerd met de sterkste encryptie en een unieke sleutel, gegenereerd voor deze computer. De persoonlijke decoderingssleutel is te vinden op een geheime Internet server en niemand kan uw bestanden decoderen totdat u betaalt en de persoonlijke sleutel heeft. De server zal de sleutel elimineren na de tijdsperiode genoemd in dit venster.'; document.getElementById('text_09').innerHTML = 'Download de TOR Browser van'; document.getElementById('text_10').innerHTML = 'In de Tor Browser, open'; document.getElementById('text_11').innerHTML = '(Let op dat deze server alleen via de Tor Browser te bereiken is. Probeer het na een uur weer als de site niet werkt).'; document.getElementById('text_12').innerHTML = 'Schrijf in de volgende openbare sleutel in het invoerformulier op de server:'; } //var language = window.navigator.userLanguage || window.navigator.language; //alert(language); </script> </head> <body onload='init();'> <div align='center'> <table width='700' height='100%' border='0' cellpadding='0' cellspacing='0' bgcolor='#000000'> <tr> <td width='225' align='left'><img src='file:///C:/Users/Admin/AppData/Local/Temp/zlgvgla.gif' width='225' height='221' /></td> <td width='415' valign='top'><div align='center' class='style1' id='text_01'>WARNING!</div><br /> <div align='center' id='text_02'>Your personal files are encrypted.<br /> <br /> <br /> </div> <div align='center' class='style3' id='fe_text'></div></p> <div class="styled-select" align='center'> <select id ="ddl" name="ddl" onmousedown="this.value='';" onchange="change_lang(this.value);"> <option selected disabled value="" style="display:none;">Select language</option> <option value='en'>   ENGLISH</option> <option value='de'>   GERMAN</option> <option value='es'>   SPANISH</option> <option value='fr'>   FRENCH</option> <option value='it'>   ITALIAN</option> <option value='nl'>   DUTCH</option> </select> </div> </td> </tr> <tr> <td colspan='2' align='center'><table width='97%' border='0' cellpadding='0' cellspacing='0'> <tr> <td colspan='2' align='left'> <br /> <div id='text_03'>Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. The server will eliminate the key after a time period specified in this window.</div><br /> <br /> </td> </tr> <tr> <td colspan='2' align='left'> 1) <span id='text_09'>Download TOR Browser from</span> <a href='http://torproject.org' class='style4'>http://torproject.org</a><br /> 2) <span id='text_10'>In the Tor Browser open the</span> <span class='style6'>http://maktubmvgn22y2ns.onion</span><br /><br /> <span id='text_11'>(Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable).</span><br /> <br /> <span class='style5' id='text_12'>Write in the following public key in the input from on server:</span><br /><br /> <div align='center'><textarea class='style7'> CTG7W-NR1GG-8BXB3-VZP6Y-UJSUV-8QFTM-27X1S-5FKGQ-Q2FGB-1N4VV-YMFUB-A4D1G-SNGKV-RPMUG ZXBSW-TZMSH-UYN5W-KS7CC-VUDQC-U1P5P-83KUU-KN36U-YK4V4-PX0PX-J1M40-2XR7Q-CVXXU-4ZWMB HV6S0-M2JZF-U6BMM-W45NH-UN2W2-UBHCF-W88TV-ECV4X-6FR8D-MHKDP-2A2RT-3CV5K-2KQFM-V3CS4 KHFQH-E134A-BKK7J-SGWAT-RKMX1-JXY03-KYD72-CG7BW-UJSTD-BTG3Q-3CFXD-0CMMS-XYYD7-KHKRZ YF766-RESA1-ADN8Y-805E1-X12SZ-KUVB5-05Y48-RQ4JW-CGCX3-EPVDA-GZ0MA-KWFTQ-USPG5-0MK7D JSTNH-T2VFZ-M50GJ-VDTS8-DM8FM-R6CFE-U3WWY-10GX6-EUE3F-70MCG-WCZEV-W3UYQ </textarea> <br /> </div> <br /> <br /> <br /> </div> </td> </tr> </table></td> </tr> </table> </div> </body> </html>

URLs

http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd'>

http-equiv='Content-Type

Extracted

Path

C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\_DECRYPT_INFO_zlgvgla.html

Ransom Note

<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Transitional//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd'>  <html xmlns='http://www.w3.org/1999/xhtml'> <head> <meta http-equiv='Content-Type' content='text/html; charset=UTF-8' /> <title>zlgvgla decrypt</title> <style type='text/css'>  </style> <script type='text/javascript'> function init() { var xtime; document.getElementById('fe_text').innerHTML = '00:00:00'; var language = window.navigator.userLanguage || window.navigator.language; if (language.indexOf('-') !== -1) language = language.split('-')[0]; if (language.indexOf('_') !== -1) language = language.split('_')[0]; change_lang(language); var ua = window.navigator.userAgent; var msie = ua.indexOf('MSIE '); xtime = Math.floor( (1713419126+(12*60*60)) - (Date.now()/1000)); if (msie == 0) window.setTimeout('update_timestamp('+xtime+')',1000); else update_timestamp(xtime); } function component(x, y, z) { var res if (z == 1) res = Math.floor(x / y); else res = Math.floor(x / y) % z; if (res < 10) res = '0'+res; return res; } function update_timestamp(tstamp) { if (tstamp < 1) { document.getElementById('fe_text').innerHTML = '00:00:00'; } else { var hours = component(tstamp, 60*60, 1), minutes = component(tstamp, 60, 60), seconds = component(tstamp, 1, 60); document.getElementById('fe_text').innerHTML = hours+':'+minutes+':'+seconds; tstamp-=1; window.setTimeout('update_timestamp('+tstamp+')',1000); } } function change_lang(lang) { if (lang == "de") show_de(); else if (lang == "es") show_es(); else if (lang == "fr") show_fr(); else if (lang == "it") show_it(); else if (lang == "nl") show_nl(); else show_en(); } function show_en() { document.getElementById('text_01').innerHTML = 'WARNING!'; document.getElementById('text_02').innerHTML = 'Your personal files are encrypted.'; document.getElementById('text_03').innerHTML = 'Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. The server will eliminate the key after a time period specified in this window.'; document.getElementById('text_09').innerHTML = 'Download TOR Browser from'; document.getElementById('text_10').innerHTML = 'In the Tor Browser open the'; document.getElementById('text_11').innerHTML = '(Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable).'; document.getElementById('text_12').innerHTML = 'Write in the following public key in the input from on server:'; } function show_de() { document.getElementById('text_01').innerHTML = 'WARNUNG!'; document.getElementById('text_02').innerHTML = 'Ihre persönlichen Dateien sind verschlüsselt!'; document.getElementById('text_03').innerHTML = 'Ihre Dokumente, Fotos, Datenbanken und andere wichtige Dateien wurden mit der stärkste Verschlüsselung und einem einzigartigen Schlüssel verschlüsselt, der für diesen Computer generiert wurde. Der Dechiffrierschlüssel ist auf einem geheimen Internet-Server gespeichert und niemand kann Ihre Dateien entschlüsseln, bis Sie bezahlen und den privaten Schlüssel erhalten. Der Server wird den Schlüssel nach einer bestimmten Zeit löschen, die in diesem Fenster angezeigt wird.'; document.getElementById('text_09').innerHTML = 'Laden Sie TOR-Browser von'; document.getElementById('text_10').innerHTML = 'Im Tor-Browser öffnen Sie'; document.getElementById('text_11').innerHTML = '(Beachten Sie, dass dieser Server nur über den Tor-Browser verfügbar ist. Wiederholen Sie den Vorgang nach 1 Stunde, wenn die Website nicht erreichbar ist).'; document.getElementById('text_12').innerHTML = 'Schreiben Sie den folgenden öffentlichen Schlüssel in die Eingabemaske auf dem Server:'; } function show_es() { document.getElementById('text_01').innerHTML = '¡PELIGRO!'; document.getElementById('text_02').innerHTML = '¡Tus archivos personales han sido encriptados!'; document.getElementById('text_03').innerHTML = 'Tus documentos, fotos, bases de datos y otros archivos importantes han sido encriptados con una encriptación extremadamente fuerte y una clave única, generada para este computador. La clave de desencriptación privada está almacenada en un servidor de internet secreto. El servidor eliminará la clave luego del tiempo especificado en esta ventana.'; document.getElementById('text_09').innerHTML = 'Descarga el navegador TOR desde'; document.getElementById('text_10').innerHTML = 'En el navegador TOR abre'; document.getElementById('text_11').innerHTML = '(Nota que este servidor solo es accesible desde el navegador TOR. Intenta nuevamente en 1 hora si no puedes acceder).'; document.getElementById('text_12').innerHTML = 'Escribe la siguiente clave publica en la forma de ingreso del servidor:'; } function show_fr() { document.getElementById('text_01').innerHTML = 'ATTENTION!'; document.getElementById('text_02').innerHTML = 'Vos fichiers personnels ont été cryptés !'; document.getElementById('text_03').innerHTML = 'Vos documents, photos, bases de données, et autres fichiers importants ont été cryptées avec le meilleur processus de cryptage et une clé unique générée pour cet ordinateur. La clé privée de cryptage est accessible sur un serveur Internet secret et personne ne peut décrypter vos fichiers à moins que vous ne payiez et obtenez cette clé. Le serveur éliminera la clé après le compte à rebours affiché sur cette fenêtre.'; document.getElementById('text_09').innerHTML = 'Télécharger le navigateur TOR de'; document.getElementById('text_10').innerHTML = 'Dans le navigateur, ouvrez '; document.getElementById('text_11').innerHTML = '(Veuillez noter que ce serveur est disponible via le navigateur Tor uniquement. Réessayez dans 1 heure si le site n’est pas accessible).'; document.getElementById('text_12').innerHTML = 'Ecrivez les clés publiques suivantes sur le portail d’entrée du serveur :'; } function show_it() { document.getElementById('text_01').innerHTML = 'ATTENZIONE!'; document.getElementById('text_02').innerHTML = 'I tuoi file personali sono criptati!'; document.getElementById('text_03').innerHTML = 'I tuoi documenti, le tue foto, database e altri file importanti sono stati criptati con forte codificazione ed una chiave unica, generata appositamente per questo computer. La chiave segreta di decriptazione è conservata su un server Internet segreto e nessuno può decriptare i tuoi file finché non paghi per ottenere la chiave. Il server eliminerà la chiave dopo il tempo indicato in questa finestra.'; document.getElementById('text_09').innerHTML = 'Scarica il Browser TOR da'; document.getElementById('text_10').innerHTML = 'Nel Browser TOR apri il link'; document.getElementById('text_11').innerHTML = '(Nota che questo server è disponibile solo tramite il Browser TOR. Riprova tra un’ora se il sito non è raggiungibile).'; document.getElementById('text_12').innerHTML = 'Scrivi la seguente chiave pubblica nel modulo di input sul server:'; } function show_nl() { document.getElementById('text_01').innerHTML = 'WAARSCHUWING!'; document.getElementById('text_02').innerHTML = 'Uw persoonlijke bestanden zijn gecodeerd!'; document.getElementById('text_03').innerHTML = 'Uw documenten, foto’s, databases en andere belangrijke bestanden zijn gecodeerd met de sterkste encryptie en een unieke sleutel, gegenereerd voor deze computer. De persoonlijke decoderingssleutel is te vinden op een geheime Internet server en niemand kan uw bestanden decoderen totdat u betaalt en de persoonlijke sleutel heeft. De server zal de sleutel elimineren na de tijdsperiode genoemd in dit venster.'; document.getElementById('text_09').innerHTML = 'Download de TOR Browser van'; document.getElementById('text_10').innerHTML = 'In de Tor Browser, open'; document.getElementById('text_11').innerHTML = '(Let op dat deze server alleen via de Tor Browser te bereiken is. Probeer het na een uur weer als de site niet werkt).'; document.getElementById('text_12').innerHTML = 'Schrijf in de volgende openbare sleutel in het invoerformulier op de server:'; } //var language = window.navigator.userLanguage || window.navigator.language; //alert(language); </script> </head> <body onload='init();'> <div align='center'> <table width='700' height='100%' border='0' cellpadding='0' cellspacing='0' bgcolor='#000000'> <tr> <td width='225' align='left'><img src='file:///C:/Users/Admin/AppData/Local/Temp/zlgvgla.gif' width='225' height='221' /></td> <td width='415' valign='top'><div align='center' class='style1' id='text_01'>WARNING!</div><br /> <div align='center' id='text_02'>Your personal files are encrypted.<br /> <br /> <br /> </div> <div align='center' class='style3' id='fe_text'></div></p> <div class="styled-select" align='center'> <select id ="ddl" name="ddl" onmousedown="this.value='';" onchange="change_lang(this.value);"> <option selected disabled value="" style="display:none;">Select language</option> <option value='en'>   ENGLISH</option> <option value='de'>   GERMAN</option> <option value='es'>   SPANISH</option> <option value='fr'>   FRENCH</option> <option value='it'>   ITALIAN</option> <option value='nl'>   DUTCH</option> </select> </div> </td> </tr> <tr> <td colspan='2' align='center'><table width='97%' border='0' cellpadding='0' cellspacing='0'> <tr> <td colspan='2' align='left'> <br /> <div id='text_03'>Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. The server will eliminate the key after a time period specified in this window.</div><br /> <br /> </td> </tr> <tr> <td colspan='2' align='left'> 1) <span id='text_09'>Download TOR Browser from</span> <a href='http://torproject.org' class='style4'>http://torproject.org</a><br /> 2) <span id='text_10'>In the Tor Browser open the</span> <span class='style6'>http://maktubmvgn22y2ns.onion</span><br /><br /> <span id='text_11'>(Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable).</span><br /> <br /> <span class='style5' id='text_12'>Write in the following public key in the input from on server:</span><br /><br /> <div align='center'><textarea class='style7'> CTG7W-NR1GG-8BXB3-VZP6Y-UJSUV-8QFTM-27X1S-5FKGQ-Q2FGB-1N4VV-YMFUB-A4D1G-SNGKV-RPMUG ZXBSW-TZMSH-UYN5W-KS7CC-VUDQC-U1P5P-83KUU-KN36U-YK4V4-PX0PX-J1M40-2XR7Q-CVXXU-4ZWMB HV6S0-M2JZF-U6BMM-W45NH-UN2W2-UBHCF-W88TV-ECV4X-6FR8D-MHKDP-2A2RT-3CV5K-2KQFM-V3CS4 KHFQH-E134A-BKK7J-SGWAT-RKMX1-JXY03-KYD72-CG7BW-UJSTD-BTG3Q-3CFXD-0CMMS-XYYD7-KHKRZ YF766-RESA1-ADN8Y-805E1-X12SZ-KUVB5-05Y48-RQ4JW-CGCX3-EPVDA-GZ0MA-KWFTQ-USPG5-0MK7D JSTNH-T2VFZ-M50GJ-VDTS8-DM8FM-R6CFE-U3WWY-10GX6-EUE3F-70MCG-WCZEV-W3UYQ </textarea> <br /> </div> <br /> <br /> <br /> </div> </td> </tr> </table></td> </tr> </table> </div> </body> </html>

URLs

http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd'>

http-equiv='Content-Type

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Renames multiple (198) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

ACProtect 1.3x - 1.4x DLL software 3 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/memory/1968-29-0x0000000003960000-0x0000000003968000-memory.dmp	acprotect
behavioral2/memory/1968-33-0x0000000003960000-0x0000000003968000-memory.dmp	acprotect
behavioral2/memory/1968-34-0x0000000003960000-0x0000000003968000-memory.dmp	acprotect

Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.

Proxy
T1090

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
868	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	d351ac17dc0d9476ef029484a165f99e258f546bba2d619b1c6485cb8875ac7a.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	d351ac17dc0d9476ef029484a165f99e258f546bba2d619b1c6485cb8875ac7a.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2632	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1968	d351ac17dc0d9476ef029484a165f99e258f546bba2d619b1c6485cb8875ac7a.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	2444	vssvc.exe
Token: SeRestorePrivilege	2444	vssvc.exe
Token: SeAuditPrivilege	2444	vssvc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2632	WINWORD.EXE
2632	WINWORD.EXE

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 2632	1968	d351ac17dc0d9476ef029484a165f99e258f546bba2d619b1c6485cb8875ac7a.exe	28
PID 1968 wrote to memory of 2632	1968	d351ac17dc0d9476ef029484a165f99e258f546bba2d619b1c6485cb8875ac7a.exe	28
PID 1968 wrote to memory of 2632	1968	d351ac17dc0d9476ef029484a165f99e258f546bba2d619b1c6485cb8875ac7a.exe	28
PID 1968 wrote to memory of 2632	1968	d351ac17dc0d9476ef029484a165f99e258f546bba2d619b1c6485cb8875ac7a.exe	28
PID 2632 wrote to memory of 1676	2632	WINWORD.EXE	31
PID 2632 wrote to memory of 1676	2632	WINWORD.EXE	31
PID 2632 wrote to memory of 1676	2632	WINWORD.EXE	31
PID 2632 wrote to memory of 1676	2632	WINWORD.EXE	31
PID 1968 wrote to memory of 868	1968	d351ac17dc0d9476ef029484a165f99e258f546bba2d619b1c6485cb8875ac7a.exe	39
PID 1968 wrote to memory of 868	1968	d351ac17dc0d9476ef029484a165f99e258f546bba2d619b1c6485cb8875ac7a.exe	39
PID 1968 wrote to memory of 868	1968	d351ac17dc0d9476ef029484a165f99e258f546bba2d619b1c6485cb8875ac7a.exe	39
PID 1968 wrote to memory of 868	1968	d351ac17dc0d9476ef029484a165f99e258f546bba2d619b1c6485cb8875ac7a.exe	39

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\d351ac17dc0d9476ef029484a165f99e258f546bba2d619b1c6485cb8875ac7a.exe
"C:\Users\Admin\AppData\Local\Temp\d351ac17dc0d9476ef029484a165f99e258f546bba2d619b1c6485cb8875ac7a.exe"
1⤵
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
  "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\d351ac17dc0d9476ef029484a165f99e258f546bba2d619b1c6485cb8875ac7a.rtf"
  2⤵
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Windows\splwow64.exe
    C:\Windows\splwow64.exe 12288
    3⤵
    PID:1676
- C:\Windows\system32\vssadmin.exe
  vssadmin.exe delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:868

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Proxy

T1090

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Package Cache\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\_DECRYPT_INFO_zlgvgla.html

Filesize
12KB

MD5
fe0fecf0b642cfcdce88940f0256b495

SHA1
f765e87a201164d45bb361f82b513a6f186fbcb6

SHA256
c1f3582807299e3db9b0c03d7614aeb8ca810a8fe71782a4952426b418a74e09

SHA512
c9003ce729dd19b694c086091c0b205affdf09e8a8421501c56805cf75e9d948ad3720ef7bf31ced94376f3f6586ea255a5a20a110e18995eacbed6e7b567b9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4764.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Users\Admin\AppData\Local\Temp\d351ac17dc0d9476ef029484a165f99e258f546bba2d619b1c6485cb8875ac7a.rtf

Filesize
4KB

MD5
2d5020c82de674b48cfd17cc20fcbba2

SHA1
4e317eaeebd839ee5f6eb3925a9fbee819c5349c

SHA256
120becd55248f4a2ccbbc99ba9d3c2932223264a95cd72e9ae7568be61277e9a

SHA512
ffbbdda009237d6825f6cd6f751a41f4f9d716186901ffdbeed56c2d1410245771decd07f591cf56cafdd4bbebd4e4c74f009ff15736d5321635e34ff17d0d8d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

Filesize
20KB

MD5
9c04861e2919b8d4c2015012eaf2fa79

SHA1
cd1ce32db2a723bb90adfe66104e1c338b5bf8eb

SHA256
956b3993a324306e16666b0630193b2f695c96c5636a22b1772cda8c5a361ba9

SHA512
a8bdb28fc3d7a7db455867d3c1dbd428e23e33a297b8cd32ff9e70ca57e544829f6d242a1ad66367d5b89680c5a8332fbc0397584c5aa3c0f547d82a89561e77

Download Submit
C:\Users\Public\Music\Sample Music\_DECRYPT_INFO_zlgvgla.html

Filesize
12KB

MD5
b92b267ef0322eeaff83f7d3b1c0ca35

SHA1
8791b99d3210e5f7419c693cdb17c1ec7f13273b

SHA256
e9012b66f7b6d0a802acacbcc2fbe05075dd4377aaa408198e07c61258fad1f9

SHA512
f7698e00a504750937d641196f98b792ac750e9985a1d30238e8d3be0f2c5af6a2af70bbee1823d747b5b712842dfab7d67493d0b597e5f41c4e24584e9f9378

Download Submit
C:\Users\Public\Recorded TV\Sample Media\_DECRYPT_INFO_zlgvgla.html

Filesize
12KB

MD5
4522f283c82b1643359ffe77ac990038

SHA1
72f965d7367658e6c5235cc97e178e7be97c8355

SHA256
d4b229e00420d8b5766b3ed8654ff4670ab75e9fcde134836e45229c8d9ba5d5

SHA512
02d8eb56519e86057a5c58eab92a45614267350df723b0632ed0e9f6828b22403cd4b199d765c99f24d3d3bc46d0a1cb65023db54168def15bebc9dd579448b8

Download Submit
memory/1968-35-0x0000000003970000-0x0000000003998000-memory.dmp

Filesize
160KB

Download
memory/1968-43-0x0000000003970000-0x0000000003998000-memory.dmp

Filesize
160KB

Download
memory/1968-1-0x0000000002C70000-0x0000000002C71000-memory.dmp

Filesize
4KB

Download
memory/1968-22-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/1968-24-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/1968-27-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/1968-28-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/1968-30-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/1968-29-0x0000000003960000-0x0000000003968000-memory.dmp

Filesize
32KB

Download
memory/1968-33-0x0000000003960000-0x0000000003968000-memory.dmp

Filesize
32KB

Download
memory/1968-34-0x0000000003960000-0x0000000003968000-memory.dmp

Filesize
32KB

Download
memory/1968-0-0x0000000002CF0000-0x0000000002D48000-memory.dmp

Filesize
352KB

Download
memory/1968-38-0x0000000003970000-0x0000000003998000-memory.dmp

Filesize
160KB

Download
memory/1968-40-0x0000000003970000-0x0000000003998000-memory.dmp

Filesize
160KB

Download
memory/1968-42-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/1968-2-0x0000000002CF0000-0x0000000002D48000-memory.dmp

Filesize
352KB

Download
memory/1968-44-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/1968-3-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/1968-160-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/1968-149-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/1968-73-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/1968-82-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/1968-5-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/1968-7-0x0000000000400000-0x0000000000461000-memory.dmp

Filesize
388KB

Download
memory/1968-130-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/2632-72-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/2632-11-0x000000002F3C1000-0x000000002F3C2000-memory.dmp

Filesize
4KB

Download
memory/2632-45-0x0000000070C3D000-0x0000000070C48000-memory.dmp

Filesize
44KB

Download
memory/2632-13-0x0000000070C3D000-0x0000000070C48000-memory.dmp

Filesize
44KB

Download
memory/2632-12-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download