091a2ac2c8e821715490400c991ed7af94a6cb48462c24f4fce5142f93b906a1

Analysis

max time kernel
120s
max time network
155s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
10/06/2024, 11:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VirusShare_764a3a6827e4d04ebbb801e8f5b95f8b.exe
Size

364KB
MD5

764a3a6827e4d04ebbb801e8f5b95f8b
SHA1

6bdba1a36f825e2b6cbe2c71bfa2e31ad148ddcb
SHA256

091a2ac2c8e821715490400c991ed7af94a6cb48462c24f4fce5142f93b906a1
SHA512

2a05444918da6ac9e400c1b7c5f58e60187035b4533be28b4b516f8002edfcd9b1eaa9207b820e26f6cd08c51a7ca8610dd4aa785d3b9ffd2dedd04a8aa197f2
SSDEEP

6144:3M3Ia4g7E/Rd1WjfqMsSW9ZgsQ6LEme81Ip8/V+9jeOLzZXcIwXHX:qIt4EELq7p9ZgeLDc8/VkphcI

Score

10^/10

defense_evasion evasion execution impact ransomware spyware stealer

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\how_recover+let.txt

Ransom Note

________________________1234____________________________________- What happened to your files ? All of your files were protected by a strong encryption with RSA-2048. More information about the encryption keys using RSA-2048 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) What does this mean ? This means that the structure and data within your files have been irrevocably changed, you will not be able to work with them, read them or see them, it is the same thing as losing them forever, but with our help, you can restore them. How did this happen ? Especially for you, on our server was generated the secret key pair RSA-2048 - public and private. All your files were encrypted with the public key, which has been transferred to your computer via the Internet. Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server. What do I do ? ________________________1234____________________________________ Alas, if you do not take the necessary measures for the specified time then the conditions for obtaining the private key will be changed. If you really value your data, then we suggest you do not waste valuable time searching for other solutions because they do not exist. ________________________1234____________________________________ For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://gfhshhf.home7dfg4.com/9A91E272358E14C 2. http://td63hftt.buwve5ton2.com/9A91E272358E14C 3. https://tw7kaqthui5ojcez.onion.to/9A91E272358E14C If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser and wait for initialization. 3. Type in the address bar: tw7kaqthui5ojcez.onion/9A91E272358E14C 4. Follow the instructions on the site. IMPORTANT INFORMATION: Your personal pages: http://gfhshhf.home7dfg4.com/9A91E272358E14C http://td63hftt.buwve5ton2.com/9A91E272358E14C https://tw7kaqthui5ojcez.onion.to/9A91E272358E14C Your personal page (using TOR-Browser): tw7kaqthui5ojcez.onion/9A91E272358E14C Your personal identification number (if you open the site (or TOR-Browser's) directly): 9A91E272358E14C

URLs

http://gfhshhf.home7dfg4.com/9A91E272358E14C

http://td63hftt.buwve5ton2.com/9A91E272358E14C

https://tw7kaqthui5ojcez.onion.to/9A91E272358E14C

http://tw7kaqthui5ojcez.onion/9A91E272358E14C

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 5 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
2476	bcdedit.exe
2880	bcdedit.exe
2980	bcdedit.exe
2996	bcdedit.exe
948	bcdedit.exe

Renames multiple (419) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Deletes itself 1 IoCs

pid	Process
2596	cmd.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\how_recover+let.txt	ssldi-a.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\how_recover+let.html	ssldi-a.exe

Executes dropped EXE 2 IoCs

pid	Process
2672	ssldi-a.exe
2632	ssldi-a.exe

Loads dropped DLL 3 IoCs

pid	Process
2328	VirusShare_764a3a6827e4d04ebbb801e8f5b95f8b.exe
2328	VirusShare_764a3a6827e4d04ebbb801e8f5b95f8b.exe
2672	ssldi-a.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	myexternalip.com

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2044 set thread context of 2328	2044	VirusShare_764a3a6827e4d04ebbb801e8f5b95f8b.exe	28
PID 2672 set thread context of 2632	2672	ssldi-a.exe	32

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_selectionsubpicture.png	ssldi-a.exe
File opened for modification	C:\Program Files\Common Files\SpeechEngines\Microsoft\how_recover+let.html	ssldi-a.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\de-DE\how_recover+let.html	ssldi-a.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_item.png	ssldi-a.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\how_recover+let.txt	ssldi-a.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\icon.png	ssldi-a.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_corner_top_left.png	ssldi-a.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\how_recover+let.txt	ssldi-a.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fy\how_recover+let.html	ssldi-a.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_extractor\how_recover+let.txt	ssldi-a.exe
File opened for modification	C:\Program Files\Windows Media Player\Network Sharing\how_recover+let.txt	ssldi-a.exe
File opened for modification	C:\Program Files\Common Files\System\ado\it-IT\how_recover+let.html	ssldi-a.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_ButtonGraphic.png	ssldi-a.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\how_recover+let.txt	ssldi-a.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\timer_up.png	ssldi-a.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\how_recover+let.html	ssldi-a.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_SelectionSubpicture.png	ssldi-a.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_btn-back-static.png	ssldi-a.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_SelectionSubpicture.png	ssldi-a.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\setting_back.png	ssldi-a.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\how_recover+let.txt	ssldi-a.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToNotesBackground_PAL.wmv	ssldi-a.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7.png	ssldi-a.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\add_down.png	ssldi-a.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\how_recover+let.html	ssldi-a.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\how_recover+let.txt	ssldi-a.exe
File opened for modification	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\ja-JP\how_recover+let.txt	ssldi-a.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-back-static.png	ssldi-a.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\how_recover+let.html	ssldi-a.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\how_recover+let.html	ssldi-a.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\css\how_recover+let.txt	ssldi-a.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground_PAL.wmv	ssldi-a.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\how_recover+let.html	ssldi-a.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\settings.css	ssldi-a.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-shadow.png	ssldi-a.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\pt-BR.pak	ssldi-a.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\css\clock.css	ssldi-a.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\add_over.png	ssldi-a.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\how_recover+let.txt	ssldi-a.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\how_recover+let.txt	ssldi-a.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\how_recover+let.html	ssldi-a.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\ja-JP\how_recover+let.txt	ssldi-a.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_ButtonGraphic.png	ssldi-a.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\how_recover+let.txt	ssldi-a.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\css\how_recover+let.html	ssldi-a.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\how_recover+let.txt	ssldi-a.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\ja-JP\how_recover+let.html	ssldi-a.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\cs\how_recover+let.txt	ssldi-a.exe
File opened for modification	C:\Program Files\Windows Sidebar\en-US\how_recover+let.txt	ssldi-a.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\how_recover+let.txt	ssldi-a.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_SelectionSubpicture.png	ssldi-a.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\how_recover+let.txt	ssldi-a.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\9.png	ssldi-a.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\square.png	ssldi-a.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_divider_right.png	ssldi-a.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\js\settings.js	ssldi-a.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\how_recover+let.txt	ssldi-a.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationRight_ButtonGraphic.png	ssldi-a.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\how_recover+let.html	ssldi-a.exe
File opened for modification	C:\Program Files\Windows Mail\en-US\how_recover+let.html	ssldi-a.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground.wmv	ssldi-a.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\audio_filter\how_recover+let.txt	ssldi-a.exe
File opened for modification	C:\Program Files\Uninstall Information\how_recover+let.html	ssldi-a.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_VideoInset.png	ssldi-a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
1768	vssadmin.exe
1256	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 38 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ec40d2ac9527be43b077356e0fd6260f00000000020000000000106600000001000020000000638ffbda60396258a0e0ad696b5dcb94e27fd7e791151cb7ffc822e91f759825000000000e80000000020000200000007e0a98a126122d3938ecb2ce9baab302b3ed4b2efe970bc046249a42efd487e390000000e39b60ff7edd2a2880ee12372612c59410481eb58ec85664ae2ae458ad81b5c2cebf475287df53ba4c546b4106fbd3ac5487679704455483384630bdc42d791eb8ddcadb4f995953b6c85d5d743432efd28629c99cc155b6e756256325977ca50f7eeb0b0ebfcfc426c493dd8768195ba8f839af35ee8c209c5159684cb2ed429da5e313f4b671092ea4f9cd496e92c540000000635fa2d4a559ed7c888f492c5e289024fea41125b7ac982a8eaffb69efdb1be09815118f13963497858ed75e62c8c341bb364120e1c26c2d7d382a0824deb577	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424181403"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{051A1401-271E-11EF-910D-CE7E212FECBD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ec40d2ac9527be43b077356e0fd6260f00000000020000000000106600000001000020000000ba5cc5548d2b95af66fbfcd05dd81700108a2debd5c97ee5b9ba10c28cd88aca000000000e800000000200002000000012d4998579203c5b919c7622f34577d43388bf8cf0af92115ab24e282f4e6b2f200000009a2252be337f75498951d32053e21732206aab7d2711c18165dec729018464934000000019643babb9f9e10227f5829ef10fcf7d85afc8b9a1bd55b135a0a775ede6ae75f0babbf3e1066982fda99cf619b89d4fbd8b7a2db05faa00944c2fbe0db4cf01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0cc9fd92abbda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	ssldi-a.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	ssldi-a.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	ssldi-a.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	ssldi-a.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2140	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe
2632	ssldi-a.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2328	VirusShare_764a3a6827e4d04ebbb801e8f5b95f8b.exe
Token: SeDebugPrivilege	2632	ssldi-a.exe
Token: SeBackupPrivilege	1564	vssvc.exe
Token: SeRestorePrivilege	1564	vssvc.exe
Token: SeAuditPrivilege	1564	vssvc.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1228	iexplore.exe
1212	DllHost.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1228	iexplore.exe
1228	iexplore.exe
1208	IEXPLORE.EXE
1208	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 2328	2044	VirusShare_764a3a6827e4d04ebbb801e8f5b95f8b.exe	28
PID 2044 wrote to memory of 2328	2044	VirusShare_764a3a6827e4d04ebbb801e8f5b95f8b.exe	28
PID 2044 wrote to memory of 2328	2044	VirusShare_764a3a6827e4d04ebbb801e8f5b95f8b.exe	28
PID 2044 wrote to memory of 2328	2044	VirusShare_764a3a6827e4d04ebbb801e8f5b95f8b.exe	28
PID 2044 wrote to memory of 2328	2044	VirusShare_764a3a6827e4d04ebbb801e8f5b95f8b.exe	28
PID 2044 wrote to memory of 2328	2044	VirusShare_764a3a6827e4d04ebbb801e8f5b95f8b.exe	28
PID 2044 wrote to memory of 2328	2044	VirusShare_764a3a6827e4d04ebbb801e8f5b95f8b.exe	28
PID 2044 wrote to memory of 2328	2044	VirusShare_764a3a6827e4d04ebbb801e8f5b95f8b.exe	28
PID 2044 wrote to memory of 2328	2044	VirusShare_764a3a6827e4d04ebbb801e8f5b95f8b.exe	28
PID 2044 wrote to memory of 2328	2044	VirusShare_764a3a6827e4d04ebbb801e8f5b95f8b.exe	28
PID 2044 wrote to memory of 2328	2044	VirusShare_764a3a6827e4d04ebbb801e8f5b95f8b.exe	28
PID 2328 wrote to memory of 2672	2328	VirusShare_764a3a6827e4d04ebbb801e8f5b95f8b.exe	29
PID 2328 wrote to memory of 2672	2328	VirusShare_764a3a6827e4d04ebbb801e8f5b95f8b.exe	29
PID 2328 wrote to memory of 2672	2328	VirusShare_764a3a6827e4d04ebbb801e8f5b95f8b.exe	29
PID 2328 wrote to memory of 2672	2328	VirusShare_764a3a6827e4d04ebbb801e8f5b95f8b.exe	29
PID 2328 wrote to memory of 2596	2328	VirusShare_764a3a6827e4d04ebbb801e8f5b95f8b.exe	30
PID 2328 wrote to memory of 2596	2328	VirusShare_764a3a6827e4d04ebbb801e8f5b95f8b.exe	30
PID 2328 wrote to memory of 2596	2328	VirusShare_764a3a6827e4d04ebbb801e8f5b95f8b.exe	30
PID 2328 wrote to memory of 2596	2328	VirusShare_764a3a6827e4d04ebbb801e8f5b95f8b.exe	30
PID 2672 wrote to memory of 2632	2672	ssldi-a.exe	32
PID 2672 wrote to memory of 2632	2672	ssldi-a.exe	32
PID 2672 wrote to memory of 2632	2672	ssldi-a.exe	32
PID 2672 wrote to memory of 2632	2672	ssldi-a.exe	32
PID 2672 wrote to memory of 2632	2672	ssldi-a.exe	32
PID 2672 wrote to memory of 2632	2672	ssldi-a.exe	32
PID 2672 wrote to memory of 2632	2672	ssldi-a.exe	32
PID 2672 wrote to memory of 2632	2672	ssldi-a.exe	32
PID 2672 wrote to memory of 2632	2672	ssldi-a.exe	32
PID 2672 wrote to memory of 2632	2672	ssldi-a.exe	32
PID 2672 wrote to memory of 2632	2672	ssldi-a.exe	32
PID 2632 wrote to memory of 2476	2632	ssldi-a.exe	33
PID 2632 wrote to memory of 2476	2632	ssldi-a.exe	33
PID 2632 wrote to memory of 2476	2632	ssldi-a.exe	33
PID 2632 wrote to memory of 2476	2632	ssldi-a.exe	33
PID 2632 wrote to memory of 2880	2632	ssldi-a.exe	35
PID 2632 wrote to memory of 2880	2632	ssldi-a.exe	35
PID 2632 wrote to memory of 2880	2632	ssldi-a.exe	35
PID 2632 wrote to memory of 2880	2632	ssldi-a.exe	35
PID 2632 wrote to memory of 2980	2632	ssldi-a.exe	37
PID 2632 wrote to memory of 2980	2632	ssldi-a.exe	37
PID 2632 wrote to memory of 2980	2632	ssldi-a.exe	37
PID 2632 wrote to memory of 2980	2632	ssldi-a.exe	37
PID 2632 wrote to memory of 2996	2632	ssldi-a.exe	39
PID 2632 wrote to memory of 2996	2632	ssldi-a.exe	39
PID 2632 wrote to memory of 2996	2632	ssldi-a.exe	39
PID 2632 wrote to memory of 2996	2632	ssldi-a.exe	39
PID 2632 wrote to memory of 948	2632	ssldi-a.exe	41
PID 2632 wrote to memory of 948	2632	ssldi-a.exe	41
PID 2632 wrote to memory of 948	2632	ssldi-a.exe	41
PID 2632 wrote to memory of 948	2632	ssldi-a.exe	41
PID 2632 wrote to memory of 1768	2632	ssldi-a.exe	43
PID 2632 wrote to memory of 1768	2632	ssldi-a.exe	43
PID 2632 wrote to memory of 1768	2632	ssldi-a.exe	43
PID 2632 wrote to memory of 1768	2632	ssldi-a.exe	43
PID 2632 wrote to memory of 2140	2632	ssldi-a.exe	50
PID 2632 wrote to memory of 2140	2632	ssldi-a.exe	50
PID 2632 wrote to memory of 2140	2632	ssldi-a.exe	50
PID 2632 wrote to memory of 2140	2632	ssldi-a.exe	50
PID 2632 wrote to memory of 1228	2632	ssldi-a.exe	51
PID 2632 wrote to memory of 1228	2632	ssldi-a.exe	51
PID 2632 wrote to memory of 1228	2632	ssldi-a.exe	51
PID 2632 wrote to memory of 1228	2632	ssldi-a.exe	51
PID 1228 wrote to memory of 1208	1228	iexplore.exe	52
PID 1228 wrote to memory of 1208	1228	iexplore.exe	52

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	ssldi-a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLinkedConnections = "1"	ssldi-a.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\VirusShare_764a3a6827e4d04ebbb801e8f5b95f8b.exe
"C:\Users\Admin\AppData\Local\Temp\VirusShare_764a3a6827e4d04ebbb801e8f5b95f8b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Users\Admin\AppData\Local\Temp\VirusShare_764a3a6827e4d04ebbb801e8f5b95f8b.exe
  "C:\Users\Admin\AppData\Local\Temp\VirusShare_764a3a6827e4d04ebbb801e8f5b95f8b.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Users\Admin\AppData\Roaming\ssldi-a.exe
    C:\Users\Admin\AppData\Roaming\ssldi-a.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2672
  - - C:\Users\Admin\AppData\Roaming\ssldi-a.exe
      C:\Users\Admin\AppData\Roaming\ssldi-a.exe
      4⤵
      Drops startup file
      Executes dropped EXE
      Drops file in Program Files directory
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      System policy modification
      PID:2632
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit.exe /set {current} bootems off
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2476
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit.exe /set {current} advancedoptions off
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2880
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit.exe /set {current} optionsedit off
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2980
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit.exe /set {current} bootstatuspolicy IgnoreAllFailures
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:2996
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit.exe /set {current} recoveryenabled off
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:948
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
        5⤵
        Interacts with shadow copies
        
        PID:1768
    - - C:\Windows\SysWOW64\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Howto_RESTORE_FILES.txt
        5⤵
        Opens file in notepad (likely ransom note)
        
        PID:2140
    - - C:\Program Files\Internet Explorer\iexplore.exe
        
        "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\Howto_RESTORE_FILES.html
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1228
      - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1228 CREDAT:275457 /prefetch:2
        6⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1208
    - - C:\Windows\System32\vssadmin.exe
        
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
        5⤵
        Interacts with shadow copies
        
        PID:1256
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Roaming\ssldi-a.exe
        5⤵
        
        PID:2960
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\AppData\Local\Temp\VIRUSS~1.EXE
    3⤵
    - Deletes itself
    PID:2596

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1564

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Suspicious use of FindShellTrayWindow
PID:1212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\how_recover+let.html

Filesize
6KB

MD5
b6b3a72d29b047d4e8512f83ee0f9167

SHA1
cd53c2a7d45668fecbf4cad3dc8e6623856afd9b

SHA256
a214d5e1472b5ea73a6ffbf6631868d4881024c67c211baedf38a4a7f89e8a34

SHA512
ff11ec617e71095bb430a0a63bd7c36c8790cd5e6388aaeb869b65b8cbc9abc15071b412bdd5399cdfb4bc72f8b7572f97361fc70c13b82f2928f33ef2514a4a

Download Submit
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\how_recover+let.txt

Filesize
2KB

MD5
905f977291858974b80cc93eb0c80702

SHA1
5804b6124e965c40a0ecf59ced2ae9ae15931408

SHA256
d7c4916f25d3904661e96bec0d0e9520b5992eb2d30ff32c5dc447a2e6778d7a

SHA512
c0b514dd685d676468d3489d0eac10157a0fe20830ec7fc0e4be74f1240571365b12cb5fa7b32636a4d28b37abbbf6ef509ba2b3ba8c4a3c059b1086b0e0526f

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
d03a6862316617bca7c47bf27b84f909

SHA1
3cba34f93a855915b92e745c98857036880ab00d

SHA256
c3eceef9f8e5c5c209ac3c5061b3e2e7fb5319b24694f459d5e3040bd5880606

SHA512
78638d93659c51fb0a57b52eb6d29e5ef1e997cdff8f1a3841220a74f9722158d127f67767afcf0ab67a8ac381b0f41d43e4bd99cb58cd0c77206c0c34795e1d

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
1a544cf61e2101fdb331f935e0b9d3f3

SHA1
01827c361584dd193610df9dfe2bfd6149d54061

SHA256
f965f664dde0a3bd6b8b2b05fa2969c928b4dba304f5fceb1a7ac04c643eab47

SHA512
fc4ac838562a2e4f9eba5592305be3f471e49a743c181f5546795adba3edcd9c7eb3cbb00074fb5024f3812ae5948284c5fa11df4bece2961d5c79faa84a981b

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

Filesize
173KB

MD5
bc41336390d6370e81560dd96068fdab

SHA1
3c0149693c06a82241c233da1a3457224aa71b41

SHA256
7033bad240ef77b6fa1998d95e28406a680580a5609c1bdcb35ceaca09fc86ca

SHA512
37a14423898364dc1dab6922875892c10355b3006a39f8efb13fbb0a027cbe34f4e5b2289170607de70da316c4418a3ec50399907105d1a42d17e3923519612a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
55a36aae0cd8eaecb561747cb6f02af7

SHA1
0ebea4591255fa4a323eb5c9513db6dec18f7678

SHA256
b438b0446419848dedd7e65d7fde891a207fbc731a2f5088097dbad022301580

SHA512
a2e1469ae25a2b937f233dc7f5e1d2e414c6cf5cc090b6e3f96b2204354f0a708a0525fb02b922b3f08e16445fe4e9d017b70ea796b2c45617502507f917062d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5bc8a2d562f156486b498da73de9956

SHA1
8b4d1efd98bfbb988d71d3f36ddbb5e8aa85dd4c

SHA256
2aa54f2d27eae61e4bbc4c82b2c7a2d5365ee77e9748986fe12dbbd0605e1d97

SHA512
ff34ff3043608c5d3c30de55bc9ed53bec666dd2cf60d6703393ece8cb6cc76f9534097790cf6f048bece30fa9d539bbfb14e0b986db15cc02fa40a265800ff0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ea39e8c6b6e0a89d1b8ec2682b6ab0b

SHA1
5de0c5729d78d35d8a1b2a3edbdfe868b115cdae

SHA256
a9665a5ea66f54b99b6907a831af4abfb57665294daf2b639f183555804d2eef

SHA512
60b67c22e76c7d82425e67ad371b6f12edbf29c8448117ecccc71bbcbc43803d2a955c3abf68f37adba5fbcf8f0f5afb54702da797ee3e0c0dd5adfec213c94a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1cfe8eef1bbd4e95b2a6d7a70821d8d

SHA1
a4707aa09f7e7daa82328d2197340dcc20a04277

SHA256
ecd007a893d4bd37ae71f100faae8109d1ee5a20e6a9ac2c1ed911cec96b4d06

SHA512
15518cc5d2b4d199c41b8b2a66fadac1a0d5e46d202e841469950f59827cd780e7a9bd0bad1bd9f6e0f9eb66821ec66e4420ea9279881e73d4649f5ecc84dd7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce7636469481772c5ec6833dd6a5b2f3

SHA1
394cd1007e632bf91811efe6b073a07a52120ff9

SHA256
eeb267c1de76c86863c7d6848ee91f0c8d4e9bda57cda07f4e74fc838b8a4f10

SHA512
42372dd1b1d4efabcff4f52397ffe5c78654c96c2147d8c052a8ff3732cda02fcebac39e72feaef0101018f1a49c7a98440b804f30a0807a0b0732d92b5fabd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
afae751260290203519036ee81c918dc

SHA1
d595cc55bde5ae6989fc6afb1fd2b54ac70d8ac6

SHA256
9bade711ea53074015301e909c9951faa19a4a00da7437f4eee7e6c3e43554c4

SHA512
21571f9006bfee457716826fc3f7ecb689891b4dfb21fe539de91f82453c1544a9c9b8db7a35e7a38f1e8f163e5801521c66193380b025c3fb79dcb72efb228a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4018f10e3f7778ff42ee0729de9b291d

SHA1
4da649cd8bf10eee98508a6afd16ee82cac0ef01

SHA256
9bdadf1c7d992f5198c3da0d74b7a301b032baddc3fd723edfb4bac9ade231db

SHA512
bf7993019c2154ea16b6a1675d9e46eec64d44a04e2889c6e7bfad1a063de8cf6376c5c3c9218e2606ed84d49aaab3b05780cde94fbf6ee25062f67448b3eafe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84c4018b3e81b90197183828cadab391

SHA1
7c11cfa4b15768e0538613607e20d439e489afff

SHA256
d37e02835dfc12e2b9c600f5312f53c50a3f91f0db0c07592d88e64a1bd09b35

SHA512
3330cab1151dc879de704eeca33809876269e2c16e5f2ddff7821ed7cd21ec70b05f546fda3dfd1a11c80b83d742a4c67b33f935610c8ecdaa636c3ccaea73db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d2e4cd0bfa61e7a2add4cd709efc4d1a

SHA1
1edd12e062b2dbe6693dba35e0a1099fdb4bf9a9

SHA256
0b6648a684884e86d50d4fbf1e2f7e20aeef7d35af12b794e0e1053f349b1dd9

SHA512
07164d7d52f1f528da6bdd398af21687fe4863779a7b547b68aac560053286085b9944f843d2470d9355326415aa30b70899cfd06c8bf6777b49c21eeccda87b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
554fe944577d29f8076b660c7bbf5775

SHA1
5f8a039e34659ce644fec92625b50c32cd7827aa

SHA256
c08caf5aec895d1f7c6caf0955586aafee62a6af6401503c68f10322f08e1d5e

SHA512
245627309439565e786aafa5020b3c2eacf2bde5f424e74547865dcb7ec7d5d7a5bd4c3fa8be605fddb690553baafb284fd82e55a21fd030b39f44284e62b2bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f5213fc0b9c63900e94ab31e5e81598c

SHA1
0c9dc28a92691c5e6e8bef430138846c764ed499

SHA256
9a20796603f70bec56b623168fdf96b776fc6800880f303f0295de2390e2835c

SHA512
41ea350b7dc7e84f158f593e159d677182a08f2bc644b2f60cec8d7bb4df3f30768747225aeafeadd1938b9b6a11a361f35d8533d852d259c2d4d52cf94be61b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
554cbd839239bc505e0f343fcb18507e

SHA1
093129d179cc8f95acdc67671ddeaad136cb5a09

SHA256
81b5dac9969c957ec399052f947fc67994b42d61b945574d7f2a9a224e4b7e44

SHA512
142d368279a1b7b1bb93d137bf82b9ea55589b245141df02b32a76d251d5f8d57ad9dd3cef9c9b2866037a2baa3edcda554adc88d7bd56102102ede6c0218493

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84694f9f70e313d19f5ddf7c4517e804

SHA1
b97603379925403a0b8da59fda63af0719b50fed

SHA256
0b81996d0f4dbb200620b5f521ad7bcfff01bfee812f47c67d3569d123cdcf83

SHA512
cd3591bffde52675283324c1beaa3c4078c42bdb98993bcb0405a00c4a88b94de3751ba436eb474b84502265a5a9cd7c8b003fe6cc38ec9bea7097ded7a5e763

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bac5c078b99e42fad50484de15b9e3a6

SHA1
3f4995aa916d89919851d5aa77ec944aa9df89d8

SHA256
82a8616e969af576f374397e4278150472b00be92f7524f4ece99bbb0e21ca86

SHA512
8f0127adc60425ccb5fe8598994cad916b3ff08e624c0e877fda034a8b5b1f7141213c1f433c7bf272e81eea6dd736f2dc58e77bdd3754f80f72e733eaae187c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47f761c42eac8e2f5bc77242ec8f7272

SHA1
d9d50cda4aa1e23e23147a2c3fe0ba010c0ba52c

SHA256
51d387b90093db23443cebc3e5cf770fb52f6474a65f8c6c7d882fa7cc112a44

SHA512
7ad48e5bcd9b76b133d31e0c191dc237e8e58fe963b99e527b22b43aca24d4aed054e8d5e72d83204f14475efaf1dad29a2c989e9b26daef0301d62296cbd4fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a7ca3f2b842a73ed62755fea894fd5b

SHA1
d461fceb8ce0bc3a1fdb13208e0a071f77c64095

SHA256
68c066e21548b05086106855c075899868f3a9a410bb8795c9e855c47327e761

SHA512
a5c69cbe921dcc98c8578549b350a6a6c4e383e2bcf2c81207fac6892c0fc616d107b6effa011ce8a3df22a3d321bc8485e087c144f5733a2debb1b7da64a123

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e6e96739d04429fc72cb10543114dba2

SHA1
6ad55925278fc8c3b695803c5220c5c3494ffda5

SHA256
0efd034dfdc3e26d96b916e63bb017131cd7bc91846c6f0ba649265dda178be9

SHA512
8e0393a15e8929de17f8df31f79edd5f33dd48098ded0f2ae7cc7fbe283e9f5bd45c7777db78cefda2bd03456d62f5ed4b549903d317c77f5c70c2ea679b24d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c84e72255bc11fb079174f80940fb34b

SHA1
1b1ca899da6b1bda4b47bf2a3227f412ec1be670

SHA256
be76a76928288e8eeabd214ec878529fac638a60fb2b57844d8a4f84fcd91025

SHA512
1663b77ab80bad319b62676fe06c48afb53ab4ec745c6821594c782a551700b44d15bac49eafa4cc2212fdef52b9a41d50e43ef4ec21fd1a6a2c68000415d6fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9976eea28032b973aec64a412fc8cb60

SHA1
89fd17c4991cb20fee77fdaf97ba8f09e7d41453

SHA256
51dde474eddc35cc8679a7f5de7c99f3dca2fb5d04674d81af930cc1e1811158

SHA512
ae5f49ef4e8071e23630e17e8d7140fa466f0fd1559fa3e00285e6a86aa1ff565ceafc181697723fe4d6a6603cc397b295c69130df9b8686d02dc3fa48a4f6d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6866f64bf25fd7145f12095827f46647

SHA1
f06397e885848e2d4bd50e5d0b10d5e43780291c

SHA256
06d3fb3525c2551e80a8a1e0844418559eeecbf5a506783b8db38c6bcbfffe53

SHA512
84b33911f4342f37e232eb8e1d6b5ba17ec17a297667300683b1125b545044bf2b662b5065de22cb55c1ffab7c773a5a11b7769d4aeaf82236ec99ddde6bd922

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0f7c7c1fe3e88205622c78c6389eb65

SHA1
cde48c1cbdaf8f904df94b7e1ddf1da2a3a353ac

SHA256
b638c7ee78eb0aff5cf481995e7495fe0babba450f0f3e275e3c57568c53636c

SHA512
8a9d687a5d332c338d6758c8aaf6efaaf5cee63a99e49d24debd28b89311a4692f5ec1e4bbd2e973c5d277630d9e3dfbe1a5527ce31257a9bfafae58336fa32b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
f961ee9f08cc9998d4b3d2a30d383b13

SHA1
c4f1cbf2ac99670e032d6f0d118761f62e273cf4

SHA256
704a4f0ee141d01a9ec1ed02583f87ee4f7d6df43e54b67eddbf1075b280bdcc

SHA512
1a5aabf93be128207d7f46de446ddb82a37dfa136619da86e71bdf022bfda09575da265de0ec3ce059e14c2e978224fc05fa5f04b9ea9871b86559b91e57dba9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar81A0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\Desktop\Howto_RESTORE_FILES.bmp

Filesize
3.3MB

MD5
fcf4c328b606262b460577d5194dcc55

SHA1
b4928be7297323f6cdfdb6a046044302623939b9

SHA256
d23549a494e733a9360da42c58aeaa2f3b0af24f97267c41046fe71c5810b596

SHA512
89b0298a613de9d0933b3921bf73ad8f01aee26c1c855f485f4587664f4e16efd01e0a5873bb28b7fedcbfc9a38abfccbb87a9948488fb98e6c180c26b7d94e3

Download Submit
\Users\Admin\AppData\Roaming\ssldi-a.exe

Filesize
364KB

MD5
764a3a6827e4d04ebbb801e8f5b95f8b

SHA1
6bdba1a36f825e2b6cbe2c71bfa2e31ad148ddcb

SHA256
091a2ac2c8e821715490400c991ed7af94a6cb48462c24f4fce5142f93b906a1

SHA512
2a05444918da6ac9e400c1b7c5f58e60187035b4533be28b4b516f8002edfcd9b1eaa9207b820e26f6cd08c51a7ca8610dd4aa785d3b9ffd2dedd04a8aa197f2

Download Submit
memory/1212-4347-0x0000000000160000-0x0000000000162000-memory.dmp

Filesize
8KB

Download
memory/2044-16-0x00000000001B0000-0x00000000001B3000-memory.dmp

Filesize
12KB

Download
memory/2044-0-0x00000000001B0000-0x00000000001B3000-memory.dmp

Filesize
12KB

Download
memory/2328-1-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2328-3-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2328-11-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2328-5-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2328-9-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2328-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2328-15-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2328-18-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2328-19-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2328-29-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2328-7-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2632-50-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2632-4360-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2632-4363-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2632-4350-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2632-4349-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2632-4346-0x0000000003150000-0x0000000003152000-memory.dmp

Filesize
8KB

Download
memory/2632-4338-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2632-921-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2632-726-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2632-55-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2632-54-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2632-52-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2632-51-0x0000000000400000-0x0000000000486000-memory.dmp

Filesize
536KB

Download
memory/2672-28-0x0000000000400000-0x00000000005C0000-memory.dmp

Filesize
1.8MB

Download