Overview

overview

10

Static

static

3

VirusShare...93.exe

windows7-x64

10

VirusShare...93.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    29-05-2024 15:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    VirusShare_6653ef20d2a3a6ef656d9c886ebabd93.exe

  • Size

    392KB

  • MD5

    6653ef20d2a3a6ef656d9c886ebabd93

  • SHA1

    bb0cc0b05bb70a3d347faa94fb36a35c771b0692

  • SHA256

    48ff838a7fe98ec2c5bb59a8a76100047abcfa6db824f4982b8e7fdf2110f05d

  • SHA512

    b68b37147ce0d1389d62f5f72ebb616edc7d2ed2aaa484e85f6dc4b6070c9ce973a523e11e311686dc0efb0757fe52dcfa430afb1f48f98ecfdc257c6f3cc360

  • SSDEEP

    3072:viHZTdn6oWzjNtxPPnGau7GMuOYHAifZEeKPi6u7KzrN7ivE5oY4KppRsqYaefiU:QZqPtvGauSM4HAifkGOzrN+HKkalM

Score
10/10
cerbergozibankerdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomwarespywarestealertrojan

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt

Family

cerber

Ransom Note
C E R B E R R A N S O M W A R E ######################################################################### Cannot you find the files you need? Is the content of the files that you looked for not readable? It is normal because the files' names, as well as the data in your files have been encrypted. Great!!! You have turned to be a part of a big community #Cerber_Ransomware. ######################################################################### !!! If you are reading this message it means the software !!! "Cerber Ransomware" has been removed from your computer. ######################################################################### What is encryption? ------------------- Encryption is a reversible modification of information for security reasons but providing full access to it for authorized users. To become an authorized user and keep the modification absolutely reversible (in other words to have a possibility to decrypt your files) you should have an individual private key. But not only it. It is required also to have the special decryption software (in your case "Cerber Decryptor" software) for safe and complete decryption of all your files and data. ######################################################################### Everything is clear for me but what should I do? ------------------------------------------------ The first step is reading these instructions to the end. Your files have been encrypted with the "Cerber Ransomware" software; the instructions ("# DECRYPT MY FILES #.html" and "# DECRYPT MY FILES #.txt") in the folders with your encrypted files are not viruses, they will help you. After reading this text the most part of people start searching in the Internet the words the "Cerber Ransomware" where they find a lot of ideas, recommendations and instructions. It is necessary to realize that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them. !!! Any attempts to get back your files with the third-party tools can !!! be fatal for your encrypted files. The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files. Finally it will be impossible to decrypt your files. When you make a puzzle but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly. You should realize that any intervention of the third-party software to restore files encrypted with the "Cerber Ransomware" software may be fatal for your files. ######################################################################### !!! There are several plain steps to restore your files but if you do !!! not follow them we will not be able to help you, and we will not try !!! since you have read this warning already. ######################################################################### For your information the software to decrypt your files (as well as the private key provided together) are paid products. After purchase of the software package you will be able to: 1. decrypt all your files; 2. work with your documents; 3. view your photos and other media; 4. continue your usual and comfortable work at the computer. If you understand all importance of the situation then we propose to you to go directly to your personal page where you will receive the complete instructions and guarantees to restore your files. ######################################################################### There is a list of temporary addresses to go on your personal page below: _______________________________________________________________________ | | 1. http://cerberhhyed5frqa.xlfp45.win/F8F0-0007-31B7-0291-9045 | | 2. http://cerberhhyed5frqa.slr849.win/F8F0-0007-31B7-0291-9045 | | 3. http://cerberhhyed5frqa.ret5kr.win/F8F0-0007-31B7-0291-9045 | | 4. http://cerberhhyed5frqa.zgf48j.win/F8F0-0007-31B7-0291-9045 | | 5. http://cerberhhyed5frqa.xltnet.win/F8F0-0007-31B7-0291-9045 |_______________________________________________________________________ ######################################################################### What should you do with these addresses? ---------------------------------------- If you read the instructions in TXT format (if you have instruction in HTML (the file with an icon of your Internet browser) then the easiest way is to run it): 1. take a look at the first address (in this case it is http://cerberhhyed5frqa.xlfp45.win/F8F0-0007-31B7-0291-9045); 2. select it with the mouse cursor holding the left mouse button and moving the cursor to the right; 3. release the left mouse button and press the right one; 4. select "Copy" in the appeared menu; 5. run your Internet browser (if you do not know what it is run the Internet Explorer); 6. move the mouse cursor to the address bar of the browser (this is the place where the site address is written); 7. click the right mouse button in the field where the site address is written; 8. select the button "Insert" in the appeared menu; 9. then you will see the address http://cerberhhyed5frqa.xlfp45.win/F8F0-0007-31B7-0291-9045 appeared there; 10. press ENTER; 11. the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address if falling. If for some reason the site cannot be opened check the connection to the Internet; if the site still cannot be opened take a look at the instructions on omitting the point about working with the addresses in the HTML instructions. If you browse the instructions in HTML format: 1. click the left mouse button on the first address (in this case it is http://cerberhhyed5frqa.xlfp45.win/F8F0-0007-31B7-0291-9045); 2. in a new tab or window of your web browser the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address. If for some reason the site cannot be opened check the connection to the Internet. ######################################################################### Unfortunately these sites are short-term since the antivirus companies are interested in you do not have a chance to restore your files but continue to buy their products. Unlike them we are ready to help you always. If you need our help but the temporary sites are not available: 1. run your Internet browser (if you do not know what it is run the Internet Explorer); 2. enter or copy the address https://www.torproject.org/download/download-easy.html.en into the address bar of your browser and press ENTER; 3. wait for the site loading; 4. on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed; 5. run Tor Browser; 6. connect with the button "Connect" (if you use the English version); 7. a normal Internet browser window will be opened after the initialization; 8. type or copy the address ________________________________________________________ | | | http://cerberhhyed5frqa.onion/F8F0-0007-31B7-0291-9045 | |________________________________________________________| in this browser address bar; 9. press ENTER; 10. the site should be loaded; if for some reason the site is not loading wait for a moment and try again. If you have any problems during installation or operation of Tor Browser, please, visit https://www.youtube.com/ and type request in the search bar "install tor browser windows" and you will find a lot of training videos about Tor Browser installation and operation. If TOR address is not available for a long period (2-3 days) it means you are late; usually you have about 2-3 weeks after reading the instructions to restore your files. ######################################################################### Additional information: You will find the instructions for restoring your files in those folders where you have your encrypted files only. The instructions are made in two file formats - HTML and TXT for your convenience. Unfortunately antivirus companies cannot protect or restore your files but they can make the situation worse removing the instructions how to restore your encrypted files. The instructions are not viruses; they have informative nature only, so any claims on the absence of any instruction files you can send to your antivirus company. ######################################################################### Cerber Ransomware Project is not malicious and is not intended to harm a person and his/her information data. The project is created for the sole purpose of instruction regarding information security, as well as certification of antivirus software for their suitability for data protection. Together we make the Internet a better and safer place. ######################################################################### If you look through this text in the Internet and realize that something is wrong with your files but you do not have any instructions to restore your files, please, contact your antivirus support. ######################################################################### Remember that the worst situation already happened and now it depends on your determination and speed of your actions the further life of your files.
URLs

http://cerberhhyed5frqa.xlfp45.win/F8F0-0007-31B7-0291-9045

http://cerberhhyed5frqa.slr849.win/F8F0-0007-31B7-0291-9045

http://cerberhhyed5frqa.ret5kr.win/F8F0-0007-31B7-0291-9045

http://cerberhhyed5frqa.zgf48j.win/F8F0-0007-31B7-0291-9045

http://cerberhhyed5frqa.xltnet.win/F8F0-0007-31B7-0291-9045

http://cerberhhyed5frqa.onion/F8F0-0007-31B7-0291-9045

Extracted

Path

C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.html

Ransom Note
<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>&#067;erber Ransomware</title> <style> a { color: #47c; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #333; font-family: "Helvetica Neue", Helvetica, "Segoe UI", Arial, freesans, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol"; font-size: 16px; line-height: 1.6; margin: 0; padding: 0; } hr { background-color: #e7e7e7; border: 0 none; border-bottom: 1px solid #c7c7c7; height: 5px; margin: 30px 0; } li { padding: 0 0 7px 7px; } ol { padding-left: 3em; } .container { background-color: #fff; border: 1px solid #c7c7c7; margin: 40px; padding: 40px 40px 20px 40px; } .info, .tor { background-color: #efe; border: 1px solid #bda; display: block; padding: 0px 20px; } .logo { font-size: 12px; font-weight: bold; line-height: 1; margin: 0; } .tor { padding: 10px 0; text-align: center; } .warning { background-color: #f5e7e7; border: 1px solid #ebccd1; color: #a44; display: block; padding: 15px 10px; text-align: center; } </style> </head> <body> <div class="container"> <h3>C E R B E R&nbsp;&nbsp;&nbsp;R A N S O M W A R E</h3> <hr> <p>Cannot you find the files you need?<br>Is the content of the files that you looked for not readable?</p> <p>It is normal because the files' names, as well as the data in your files have been encrypted.</p> <p>Great!!!<br>You have turned to be a part of a big community #Cerber_Ransomware.</p> <hr> <p><span class="warning">If you are reading this message it means the software "Cerber Ransomware" has been removed from your computer.</span></p> <hr> <h3>What is encryption?</h3> <p>Encryption is a reversible modification of information for security reasons but providing full access to it for authorized users.</p> <p>To become an authorized user and keep the modification absolutely reversible (in other words to have a possibility to decrypt your files) you should have an individual private key.</p> <p>But not only it.</p> <p>It is required also to have the special decryption software (in your case "Cerber Decryptor" software) for safe and complete decryption of all your files and data.</p> <hr> <h3>Everything is clear for me but what should I do?</h3> <p>The first step is reading these instructions to the end.</p> <p>Your files have been encrypted with the "Cerber Ransomware" software; the instructions ("# DECRYPT MY FILES #.html" and "# DECRYPT MY FILES #.txt") in the folders with your encrypted files are not viruses, they will help you.</p> <p>After reading this text the most part of people start searching in the Internet the words the "Cerber Ransomware" where they find a lot of ideas, recommendations and instructions.</p> <p>It is necessary to realize that we are the ones who closed the lock on your files and we are the only ones who have this secret key to open them.</p> <p><span class="warning">Any attempts to get back your files with the third-party tools can be fatal for your encrypted files.</span></p> <p>The most part of the third-party software change data within the encrypted file to restore it but this causes damage to the files.</p> <p>Finally it will be impossible to decrypt your files.</p> <p>When you make a puzzle but some items are lost, broken or not put in its place - the puzzle items will never match, the same way the third-party software will ruin your files completely and irreversibly.</p> <p>You should realize that any intervention of the third-party software to restore files encrypted with the "Cerber Ransomware" software may be fatal for your files.</p> <hr> <p><span class="warning">There are several plain steps to restore your files but if you do not follow them we will not be able to help you, and we will not try since you have read this warning already.</span></p> <hr> <p>For your information the software to decrypt your files (as well as the private key provided together) are paid products.</p> <p>After purchase of the software package you will be able to:</p> <ol> <li>decrypt all your files;</li> <li>work with your documents;</li> <li>view your photos and other media;</li> <li>continue your usual and comfortable work at the computer.</li> </ol> <p>If you understand all importance of the situation then we propose to you to go directly to your personal page where you will receive the complete instructions and guarantees to restore your files.</p> <hr> <div class="info"> <p>There is a list of temporary addresses to go on your personal page below:</p> <ol> <li><a href="http://cerberhhyed5frqa.xlfp45.win/F8F0-0007-31B7-0291-9045" target="_blank">http://cerberhhyed5frqa.xlfp45.win/F8F0-0007-31B7-0291-9045</a></li> <li><a href="http://cerberhhyed5frqa.slr849.win/F8F0-0007-31B7-0291-9045" target="_blank">http://cerberhhyed5frqa.slr849.win/F8F0-0007-31B7-0291-9045</a></li> <li><a href="http://cerberhhyed5frqa.ret5kr.win/F8F0-0007-31B7-0291-9045" target="_blank">http://cerberhhyed5frqa.ret5kr.win/F8F0-0007-31B7-0291-9045</a></li> <li><a href="http://cerberhhyed5frqa.zgf48j.win/F8F0-0007-31B7-0291-9045" target="_blank">http://cerberhhyed5frqa.zgf48j.win/F8F0-0007-31B7-0291-9045</a></li> <li><a href="http://cerberhhyed5frqa.xltnet.win/F8F0-0007-31B7-0291-9045" target="_blank">http://cerberhhyed5frqa.xltnet.win/F8F0-0007-31B7-0291-9045</a></li> </ol> </div> <hr> <h3>What should you do with these addresses?</h3> <p>If you read the instructions in TXT format (if you have instruction in HTML (the file with an icon of your Internet browser) then the easiest way is to run it):</p> <ol> <li>take a look at the first address (in this case it is <a href="http://cerberhhyed5frqa.xlfp45.win/F8F0-0007-31B7-0291-9045" target="_blank">http://cerberhhyed5frqa.xlfp45.win/F8F0-0007-31B7-0291-9045</a>);</li> <li>select it with the mouse cursor holding the left mouse button and moving the cursor to the right;</li> <li>release the left mouse button and press the right one;</li> <li>select "Copy" in the appeared menu;</li> <li>run your Internet browser (if you do not know what it is run the Internet Explorer);</li> <li>move the mouse cursor to the address bar of the browser (this is the place where the site address is written);</li> <li>click the right mouse button in the field where the site address is written;</li> <li>select the button "Insert" in the appeared menu;</li> <li>then you will see the address <a href="http://cerberhhyed5frqa.xlfp45.win/F8F0-0007-31B7-0291-9045" target="_blank">http://cerberhhyed5frqa.xlfp45.win/F8F0-0007-31B7-0291-9045</a> appeared there;</li> <li>press ENTER;</li> <li>the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address if falling.</li> </ol> <p>If for some reason the site cannot be opened check the connection to the Internet; if the site still cannot be opened take a look at the instructions on omitting the point about working with the addresses in the HTML instructions.</p> <p>If you browse the instructions in HTML format:</p> <ol> <li>click the left mouse button on the first address (in this case it is <a href="http://cerberhhyed5frqa.xlfp45.win/F8F0-0007-31B7-0291-9045" target="_blank">http://cerberhhyed5frqa.xlfp45.win/F8F0-0007-31B7-0291-9045</a>);</li> <li>in a new tab or window of your web browser the site should be loaded; if it is not loaded repeat the same instructions with the second address and continue until the last address.</li> </ol> <p>If for some reason the site cannot be opened check the connection to the Internet.</p> <hr> <p>Unfortunately these sites are short-term since the antivirus companies are interested in you do not have a chance to restore your files but continue to buy their products.</p> <p>Unlike them we are ready to help you always.</p> <p>If you need our help but the temporary sites are not available:</p> <ol> <li>run your Internet browser (if you do not know what it is run the Internet Explorer);</li> <li>enter or copy the address <a href="https://www.torproject.org/download/download-easy.html.en" target="_blank">https://www.torproject.org/download/download-easy.html.en</a> into the address bar of your browser and press ENTER;</li> <li>wait for the site loading;</li> <li>on the site you will be offered to download Tor Browser; download and run it, follow the installation instructions, wait until the installation is completed;</li> <li>run Tor Browser;</li> <li>connect with the button "Connect" (if you use the English version);</li> <li>a normal Internet browser window will be opened after the initialization;</li> <li>type or copy the address <span class="tor">http://cerberhhyed5frqa.onion/F8F0-0007-31B7-0291-9045</span> in this browser address bar;</li> <li>press ENTER;</li> <li>the site should be loaded; if for some reason the site is not loading wait for a moment and try again.</li> </ol> <p>If you have any problems during installation or operation of Tor Browser, please, visit <a href="https://www.youtube.com/results?search_query=install+tor+browser+windows" target="_blank">https://www.youtube.com/</a> and type request in the search bar "install tor browser windows" and you will find a lot of training videos about Tor Browser installation and operation.</p> <p>If TOR address is not available for a long period (2-3 days) it means you are late; usually you have about 2-3 weeks after reading the instructions to restore your files.</p> <hr> <h3>Additional information:</h3> <p>You will find the instructions for restoring your files in those folders where you have your encrypted files only.</p> <p>The instructions are made in two file formats - HTML and TXT for your convenience.</p> <p>Unfortunately antivirus companies cannot protect or restore your files but they can make the situation worse removing the instructions how to restore your encrypted files.</p> <p>The instructions are not viruses; they have informative nature only, so any claims on the absence of any instruction files you can send to your antivirus company.</p> <hr> <p>Cerber Ransomware Project is not malicious and is not intended to harm a person and his/her information data.</p> <p>The project is created for the sole purpose of instruction regarding information security, as well as certification of antivirus software for their suitability for data protection.</p> <p>Together we make the Internet a better and safer place.</p> <hr> <p>If you look through this text in the Internet and realize that something is wrong with your files but you do not have any instructions to restore your files, please, contact your antivirus support.</p> <hr> <p>Remember that the worst situation already happened and now it depends on your determination and speed of your actions the further life of your files.</p> </div> </body> </html>

Signatures

  • Cerber

    Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

    ransomwarecerber
  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi
  • Contacts a large (16394) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Adds policy Run key to start application 2 TTPs 2 IoCs
    persistence
  • Deletes itself 1 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies Control Panel 4 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Runs ping.exe 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 47 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\VirusShare_6653ef20d2a3a6ef656d9c886ebabd93.exe
    "C:\Users\Admin\AppData\Local\Temp\VirusShare_6653ef20d2a3a6ef656d9c886ebabd93.exe"
    1⤵
    • Adds policy Run key to start application
    • Drops startup file
    • Loads dropped DLL
    • Adds Run key to start application
    • Modifies Control Panel
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2060
    • C:\Users\Admin\AppData\Roaming\{B1742F51-9A6E-9153-98B4-65A8CA63BBDA}\DisplaySwitch.exe
      "C:\Users\Admin\AppData\Roaming\{B1742F51-9A6E-9153-98B4-65A8CA63BBDA}\DisplaySwitch.exe"
      2⤵
      • Adds policy Run key to start application
      • Drops startup file
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Sets desktop wallpaper using registry
      • Modifies Control Panel
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of UnmapMainImage
      • Suspicious use of WriteProcessMemory
      PID:3008
      • C:\Windows\system32\vssadmin.exe
        "C:\Windows\system32\vssadmin.exe" delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:2592
      • C:\Windows\system32\wbem\wmic.exe
        "C:\Windows\system32\wbem\wmic.exe" shadowcopy delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1676
      • C:\Windows\System32\bcdedit.exe
        "C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled no
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:2732
      • C:\Windows\System32\bcdedit.exe
        "C:\Windows\System32\bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailures
        3⤵
        • Modifies boot configuration data using bcdedit
        PID:1812
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.html
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2132
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2132 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2496
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2132 CREDAT:537601 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2228
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\# DECRYPT MY FILES #.txt
        3⤵
          PID:960
        • C:\Windows\System32\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\# DECRYPT MY FILES #.vbs"
          3⤵
            PID:2692
          • C:\Windows\system32\cmd.exe
            /d /c taskkill /t /f /im "DisplaySwitch.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Roaming\{B1742F51-9A6E-9153-98B4-65A8CA63BBDA}\DisplaySwitch.exe" > NUL
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1828
            • C:\Windows\system32\taskkill.exe
              taskkill /t /f /im "DisplaySwitch.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2252
            • C:\Windows\system32\PING.EXE
              ping -n 1 127.0.0.1
              4⤵
              • Runs ping.exe
              PID:1832
        • C:\Windows\SysWOW64\cmd.exe
          /d /c taskkill /t /f /im "VirusShare_6653ef20d2a3a6ef656d9c886ebabd93.exe" > NUL & ping -n 1 127.0.0.1 > NUL & del "C:\Users\Admin\AppData\Local\Temp\VirusShare_6653ef20d2a3a6ef656d9c886ebabd93.exe" > NUL
          2⤵
          • Deletes itself
          • Suspicious use of WriteProcessMemory
          PID:2540
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /t /f /im "VirusShare_6653ef20d2a3a6ef656d9c886ebabd93.exe"
            3⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2740
          • C:\Windows\SysWOW64\PING.EXE
            ping -n 1 127.0.0.1
            3⤵
            • Runs ping.exe
            PID:2496
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2664
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:232
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:232 CREDAT:275457 /prefetch:2
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2268
      • C:\Windows\SysWOW64\DllHost.exe
        C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}
        1⤵
          PID:2536

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\# DECRYPT MY FILES #.html
          Filesize

          12KB

          MD5

          9acfa5a09789f013c9eae681dbddbbb3

          SHA1

          39439dad079222c78750d4690092a9341194e35d

          SHA256

          5b7866f03d40b89dc03642c62f50634bbd791ae302b1d5edb3e154d2e71be3bb

          SHA512

          4f41eab62d5b0212f9f9d6293dd82679b22c8983e8f3ae09e742181201f2a49dd6c526393841b73f1d255a654c467b3f6f097e3126c3dd5b65e900a314c40613

          Download Submit
        • C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.txt
          Filesize

          10KB

          MD5

          ed8389aeea4807eb5e2157bb33573ccc

          SHA1

          cad2c0914c451215f320eab92bc00fe87f7ee9f2

          SHA256

          48b354906afe9c0ec31e1c4a580e3cba26bcceafe23cd1fc2e82a5f8e8525c3c

          SHA512

          2f8652870d5f989c55ccabb436f34cf47f5e9fdece99210b2c01272258039640284c24d14b7af8532d2638d47d7d6631fc50d0b51ba4939e65fc65c40f902546

          Download Submit
        • C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.url
          Filesize

          85B

          MD5

          e1c621542687542936dff6ccb3dae7ba

          SHA1

          1f8dddda5a7a22cef58799273ca540a7df20fb8a

          SHA256

          eb12992612cffd64ddc758f638465b6747c2d2fb957fcaaa1adbdae6e6dacab8

          SHA512

          ad82bc151d20ce7233b7d856504c9402cdf0165d07ceea4673ad4b5def55dfdc764a839298c4623879d61af363371e3cbf2c825785cc414270dbc1697fec2f37

          Download Submit
        • C:\MSOCache\All Users\{90140000-0116-0409-1000-0000000FF1CE}-C\# DECRYPT MY FILES #.vbs
          Filesize

          219B

          MD5

          35a3e3b45dcfc1e6c4fd4a160873a0d1

          SHA1

          a0bcc855f2b75d82cbaae3a8710f816956e94b37

          SHA256

          8ad5e0f423ce1ff13f45a79746813f0f1d56993d7f125ab96f3d93fb54bdc934

          SHA512

          6d8e68b969ef67903aff526e983b0fb496678e4c819139e560a11f754a36c4b5770ac2ecf3fc1d9cb5aaa84f80363b4f55553255569503893192911b80d9d853

          Download Submit
        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
          Filesize

          914B

          MD5

          e4a68ac854ac5242460afd72481b2a44

          SHA1

          df3c24f9bfd666761b268073fe06d1cc8d4f82a4

          SHA256

          cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

          SHA512

          5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

          Download Submit
        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
          Filesize

          70KB

          MD5

          49aebf8cbd62d92ac215b2923fb1b9f5

          SHA1

          1723be06719828dda65ad804298d0431f6aff976

          SHA256

          b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

          SHA512

          bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

          Download Submit
        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
          Filesize

          1KB

          MD5

          a266bb7dcc38a562631361bbf61dd11b

          SHA1

          3b1efd3a66ea28b16697394703a72ca340a05bd5

          SHA256

          df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

          SHA512

          0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

          Download Submit
        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
          Filesize

          252B

          MD5

          368cc4cc4e4ba43f27d209f8fcb65b99

          SHA1

          1a79d738ba290de2a262cfcbd56a917e774150ab

          SHA256

          6da382ad7ffe9b2a76bb99a2f4db1d07f145299ac55400840dc3f920ca706708

          SHA512

          52132a5c9d83b8aea3e923c2ff0efc62401e7a4fe547ed2f8eed3d93a035da6c4bbfcabab456326d064e597ba9959bb5931109441a2ab130336a050fefaae563

          Download Submit
        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          342B

          MD5

          46bd4aa3490fe975f02b15c46841302f

          SHA1

          7a4e6c949d998860ae54d6651e2abe765e89a5e8

          SHA256

          5acfeb16eb2d86bea94a3f45eb488f341e1cccab97cff06e386d59ddc3619159

          SHA512

          7a83778c367a55fe2afea933cd3b190fc3d1639f9e81e1d68666f59172b91389fda850e569044e78dd57d4bb2e678161742998cc6080b32f064d981619dc10ae

          Download Submit
        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          342B

          MD5

          6bb8c2a0dfabd128468644573abc91eb

          SHA1

          37c1153067644e813ff8feea1dfd04155fb4de63

          SHA256

          7e861ffe3e0ea1a423fdd3e801c9d86723565b55d6d3f13260975c30708b1d3c

          SHA512

          5e7c67f14ca2a438fa9da07d1f077b814f6e93b31f2ccd5c05b142f502cfe02e46a9794ad14d318d76c91acb28aae2dc887c8256094e83242495726e4d19a59d

          Download Submit
        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          342B

          MD5

          ba6df00dc23d031df1cb75382a73602a

          SHA1

          4c29c5368f3c2ed8b2a1e6f6c55b16c55f7b7e6c

          SHA256

          b55e9c004e571522fc53f5ff041175a88780eac69208ccff3c7d862df202dbbc

          SHA512

          2fa115d241aa74d2053903897cd51edcb745909f0fa3a70abed651a2c86a7bdd9b9e83a8addf742be110a23c0175642138635e9a0f14e05e28ee138946b77ffb

          Download Submit
        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          342B

          MD5

          9bb47479b626e744fb6ef7efa8a52fdd

          SHA1

          387cd348eb785545d725c68df32f24433d921409

          SHA256

          7b24dcc2f7e4e66176436f2d99616237ad3ebd7f9110839e2b267abc6e6974d6

          SHA512

          b761c60232c882ddba662aa41f788184a0fc1abeb44e0d85869e1225f2da57521cd67f70f458b5b7aa086aaee63b2e5b4a572d3197555e472fb476d0854ee9e4

          Download Submit
        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          342B

          MD5

          f32c26b285bfaabf4294a61ff6cca8b5

          SHA1

          9078c9aa7b212abd240b09b733051489fc6d8d33

          SHA256

          d31b36a36dedc34518643dacc0f132a56001c2b4528c0d7e1c55a692b2dfb9d2

          SHA512

          a152b44701b2f9e2a7f66c2c41492c402a7b4a352e1e205040d2a43b83e5738ee55cb8e03d756d27acb1e7e8feae7d3fde5ff31caff925bf17d80e75e901b19f

          Download Submit
        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          342B

          MD5

          3702124a06a13e21ed95eac2318850b6

          SHA1

          0e152bd5ca40ed2ad877822ca5b712e9819b22a1

          SHA256

          de3eed3caa972515281c7ffe907cda9836c842f2a99521601d50dac404f62274

          SHA512

          afc2f62c61b0c3c219a29d6784f08076cfdc6f762dc15d1e25473ac9dded87b7ffd69498e8c4d5e4b42cdf0f8eaeda3e059157a64e6bf03d4afbbc92a889eec3

          Download Submit
        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          342B

          MD5

          653bce59b681cac40d9bc73f81ec1fc5

          SHA1

          5176058331fe51bca55330d2538f4cc6327e0749

          SHA256

          6fad2287901a0c61b18d0f71363dfd790869c18d3cdec902d0cc002ac55e718a

          SHA512

          ad0cce5240531bd9043c46ed762909552aadd2e55f425c5f2efb167ce31e0f300b85f1a52ff6139bdfa7f47eda34e5372c3b1f99933d525d96ede6ee5b46eddb

          Download Submit
        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          342B

          MD5

          fe2a747910c6dbb143c4d1a371f59f88

          SHA1

          8ce82272e2b3df4fc90eb7be8fe0c06bcfd6a6de

          SHA256

          9b706ca370a7d9bb6e0c8f8cd06f59553204f81fcaea28e38ea34b51e74e2fab

          SHA512

          b3d6e4d6986a6569d31aa8e4246590153d78369b604cef5cacb48f64872f71af0b62222fd8429783f6bf8d48e4145aea40de2a920766c946e59f6c413f94d468

          Download Submit
        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          342B

          MD5

          20c4ee9c266b3385163dde903e8a0481

          SHA1

          4dd7c65f9367d116f52a0bee30d4ed5d16e6a2d0

          SHA256

          073bbbdf3ef1c07a02c2b4ffe1b705cbbfcd5c3b6b5741e9ac67ad9ee0d0afd5

          SHA512

          9027a765e2c3246c933439312b3e631bb4cd4c1f01625cb2fdf7dfc38c75499e58bbaece8a43e20c5ace6f02ce945565c8b93fff990b47662e8a4e29b9c0b779

          Download Submit
        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          342B

          MD5

          c68ae38e68d5eb9a1c8ae3134575dcb7

          SHA1

          64259e82333026f5790d554803793ddd452e4c8d

          SHA256

          c177e4d693affcd116e68231a2eefe0c585eb0c2c580dbce1622feeef2e554ed

          SHA512

          38d9aca0ac908c7a1cdf6ae9342599a1947d23c0e87fad191e14f8acc38185232d9369eed6cef69e651b0688668fbf6ae0738ba30227ded58b1bd0e905bdabaf

          Download Submit
        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          342B

          MD5

          a2043de39cdbf517797b9a4f3ae6e244

          SHA1

          ce5a13e3e6677742e68fd047fdd8e6e6e934c0d7

          SHA256

          3c8b3c428d7aa45b807b22307f393c3d5eedbb7859cf400110754b5ca277fa38

          SHA512

          34ff69aca3f1af2a127cde8f665a1025237e1a6d8a276b26089f808cccdcf2cd3b94dc0f4fad5b50ca9b6343b71463f461f36f06c40bd00ba4f059d36735f1e0

          Download Submit
        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          342B

          MD5

          0c45eb550af9fbedea434243cc2c23e1

          SHA1

          3eb8c22b158db2e18acf589ec7b6b3c2e380827a

          SHA256

          402cf29b76f75c6987a42bae0f9103019615a57667b4258d6d60270c39120b50

          SHA512

          3957e0bfb8625258edcbc4b7fdc728bbda91b39c1ff957e0b09be08d6f2532aa3ae7e32208acbbe0bc259e3498ed9cb2f08ea8fd46d8bd3e76f08a937a1c493f

          Download Submit
        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          342B

          MD5

          6a8b8870b98ce9ff2272d76a6d8c7350

          SHA1

          b47c550277d10807bdd66345a5488ec9ae377475

          SHA256

          6f8ee3d9e443ca1ba83fe42cf5ed1f556d24ff7ba7711b3718a1e04be7f24604

          SHA512

          63af49780474062916810d5ae44283bbe629d0351b0d0110d5d451d9b3bd3bf0c19638e3267c319326fe08e246601d90e1f84264fec56fb2ac995b4ff5ccf241

          Download Submit
        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
          Filesize

          342B

          MD5

          eb7378c19e69ee20d1923e68601bb748

          SHA1

          f3050cfff2bd677a5e848128deaab49cb445c8c9

          SHA256

          6e88051817035c25bc0ca9949309ca086c98df15459c0d514c58341a5477a959

          SHA512

          514db4a1766abfe8da0322618cec11fb690b748507d74e3d4ae87a742e754aa4126575cd886f31161490cbb76d8be58fdc5b2b0b5033b808d3e0334ffe345fef

          Download Submit
        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
          Filesize

          242B

          MD5

          a042209ce4acefdc452cd756e06d3b1b

          SHA1

          b0f90c8e82f48f46ddc485a63089eeb875beca6b

          SHA256

          2e480c67c08371b58437504651404070f617b112457e555ef783f22759b63011

          SHA512

          e87d7427b711539faac3e342556894e0a3269579e6be0ae74c6f2315b8deabe934af2dce378f72d705e3a8269f755695f42bf3f3bd760c7ca9f052847fe1b234

          Download Submit
        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
          Filesize

          242B

          MD5

          a8a229d0f0dc36749d50b39999fec8eb

          SHA1

          52102d1372028b4bb0b56d57cf142a9167f7cbb5

          SHA256

          2a03e76f91c121e596a7403845074fbcc7b4eb26c4370af4f57b5bc26bc11f8b

          SHA512

          9aac3e94b6f9a2572aa3489b56e2a6f501f8db459a7eb91a3dc740bed20e3ac6e83659f8d65151649416686067089497f97c6d98bd9235c6d2ddd008dfa6977f

          Download Submit
        • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{E274A3C1-1DD1-11EF-87B3-6E1D43634CD3}.dat
          Filesize

          5KB

          MD5

          1fc59bf6f532d722a22179f9ac51fc31

          SHA1

          f363ff7372651a7a46bfe353d578f3a0e58f2560

          SHA256

          c13f728d375fbdcd7f77c7b64f2f2db4a47fb7b4b6ca2aef87b9ff216695d380

          SHA512

          99d66f0c0a15f079b09037b3bc4931705548f15b64666161a5c10711810716d0fc557c3fa708e46986046f21df319f50b8a7a8dc5f63180e2b991fdabe3bf87e

          Download Submit
        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4Z80JE5\favicon[1].ico
          Filesize

          4KB

          MD5

          da597791be3b6e732f0bc8b20e38ee62

          SHA1

          1125c45d285c360542027d7554a5c442288974de

          SHA256

          5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

          SHA512

          d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

          Download Submit
        • C:\Users\Admin\AppData\Local\Temp\Tar12DB.tmp
          Filesize

          181KB

          MD5

          4ea6026cf93ec6338144661bf1202cd1

          SHA1

          a1dec9044f750ad887935a01430bf49322fbdcb7

          SHA256

          8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

          SHA512

          6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

          Download Submit
        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\DisplaySwitch.lnk
          Filesize

          1KB

          MD5

          816587686dfe810f46b3c6d0fc140ee7

          SHA1

          954a91b461301949686276bdc9610444f096add9

          SHA256

          10e0c5bcff7f58c0e032a1027abc43fd75b0c2621ad62a11f81309987213ec76

          SHA512

          10887975d9fac811d1df2c98e7013705b6188d614631dc25d0857bf4852c6b2c915f38b3fabc3a6f6da296a2f1cbb4bed59bf8b1d6eab9549a9d1a5c1e01b39f

          Download Submit
        • \Users\Admin\AppData\Roaming\{B1742F51-9A6E-9153-98B4-65A8CA63BBDA}\DisplaySwitch.exe
          Filesize

          392KB

          MD5

          6653ef20d2a3a6ef656d9c886ebabd93

          SHA1

          bb0cc0b05bb70a3d347faa94fb36a35c771b0692

          SHA256

          48ff838a7fe98ec2c5bb59a8a76100047abcfa6db824f4982b8e7fdf2110f05d

          SHA512

          b68b37147ce0d1389d62f5f72ebb616edc7d2ed2aaa484e85f6dc4b6070c9ce973a523e11e311686dc0efb0757fe52dcfa430afb1f48f98ecfdc257c6f3cc360

          Download Submit
        • memory/2060-1-0x0000000000400000-0x0000000000420000-memory.dmp
          Filesize

          128KB

          Download
        • memory/2060-2-0x0000000000400000-0x0000000000420000-memory.dmp
          Filesize

          128KB

          Download
        • memory/2060-20-0x0000000000400000-0x0000000000420000-memory.dmp
          Filesize

          128KB

          Download
        • memory/2060-0-0x00000000001B0000-0x00000000001CF000-memory.dmp
          Filesize

          124KB

          Download
        • memory/3008-474-0x0000000000400000-0x0000000000420000-memory.dmp
          Filesize

          128KB

          Download
        • memory/3008-478-0x0000000000400000-0x0000000000420000-memory.dmp
          Filesize

          128KB

          Download
        • memory/3008-501-0x0000000000400000-0x0000000000420000-memory.dmp
          Filesize

          128KB

          Download
        • memory/3008-497-0x0000000000400000-0x0000000000420000-memory.dmp
          Filesize

          128KB

          Download
        • memory/3008-468-0x0000000000400000-0x0000000000420000-memory.dmp
          Filesize

          128KB

          Download
        • memory/3008-470-0x0000000000400000-0x0000000000420000-memory.dmp
          Filesize

          128KB

          Download
        • memory/3008-472-0x0000000000400000-0x0000000000420000-memory.dmp
          Filesize

          128KB

          Download
        • memory/3008-495-0x0000000000400000-0x0000000000420000-memory.dmp
          Filesize

          128KB

          Download
        • memory/3008-510-0x0000000003920000-0x0000000003922000-memory.dmp
          Filesize

          8KB

          Download
        • memory/3008-476-0x0000000000400000-0x0000000000420000-memory.dmp
          Filesize

          128KB

          Download
        • memory/3008-479-0x0000000000400000-0x0000000000420000-memory.dmp
          Filesize

          128KB

          Download
        • memory/3008-499-0x0000000000400000-0x0000000000420000-memory.dmp
          Filesize

          128KB

          Download
        • memory/3008-1116-0x0000000000400000-0x0000000000420000-memory.dmp
          Filesize

          128KB

          Download
        • memory/3008-39-0x0000000000400000-0x0000000000420000-memory.dmp
          Filesize

          128KB

          Download
        • memory/3008-26-0x0000000000400000-0x0000000000420000-memory.dmp
          Filesize

          128KB

          Download
        • memory/3008-25-0x0000000000400000-0x0000000000420000-memory.dmp
          Filesize

          128KB

          Download
        • memory/3008-24-0x0000000000400000-0x0000000000420000-memory.dmp
          Filesize

          128KB

          Download
        • memory/3008-483-0x0000000000400000-0x0000000000420000-memory.dmp
          Filesize

          128KB

          Download
        • memory/3008-485-0x0000000000400000-0x0000000000420000-memory.dmp
          Filesize

          128KB

          Download
        • memory/3008-16-0x0000000000400000-0x0000000000420000-memory.dmp
          Filesize

          128KB

          Download
        • memory/3008-488-0x0000000000400000-0x0000000000420000-memory.dmp
          Filesize

          128KB

          Download
        • memory/3008-490-0x0000000000400000-0x0000000000420000-memory.dmp
          Filesize

          128KB

          Download
        • memory/3008-492-0x0000000000400000-0x0000000000420000-memory.dmp
          Filesize

          128KB

          Download