Overview

overview

10

Static

static

1

RNSM00433.7z

windows10-2004-x64

10

Analysis

  • max time kernel
    285s
  • max time network
    293s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-10-2024 12:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RNSM00433.7z

  • Size

    35.7MB

  • MD5

    9fbb9ec824a27440e55952383c31ded6

  • SHA1

    109af893f6fa5311d202b88e879eb7356cb7a5d9

  • SHA256

    b3ece445ea196b4992b214680c43f76f9ca182c56f6c07a1362b5045a1be88e9

  • SHA512

    6fab12555b0b2462d2e2640a808d362f286207c471b629c181b8b25f59e0ae889acc0f1045178c84587373f9a5ba3537485716f096c0298ec67f21723be7a8d1

  • SSDEEP

    786432:OkFkaZ1mtXsBZCAuaHNS/XFHfzRXXBqY6fRmdCUn2elo7LlEP:tyWcRK8a0/ZzRXcFgdCUToXlI

Score
10/10
gandcrablockbitsnatchsodinokibiurelasvanillarat$2a$10$dfjplrxudytff.kmytq1rogsxjtjee8emqt65ftxltpjtxpzrhsaq7178backdoordefense_evasiondiscoveryevasionexecutionimpactpersistenceransomwareratspywarestealertrojanupxvmprotect

Malware Config

Extracted

Path

C:\Program Files\Common Files\microsoft shared\ink\ar-SA\!!FAQ for Decryption!!.txt

Ransom Note
Good day. All your files are encrypted. For decryption contact us. Write here [email protected] reserve [email protected] We also inform that your databases, ftp server and file server were downloaded by us to our servers. * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Do not stop process of encryption, because partial encryption cannot be decrypted.

Extracted

Path

C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\Restore-My-Files.txt

Family

lockbit

Ransom Note
All your important files are encrypted! Any attempts to restore your files with the thrid-party software will be fatal for your files! RESTORE YOU DATA POSIBLE ONLY BUYING private key from us. There is only one way to get your files back: 1) Through a standard browser(FireFox, Chrome, Edge, Opera) | 1. Open link http://lockbit-decryptor.top/?8B87A11BCEAB4AA5AD4D982C940D49D8 | 2. Follow the instructions on this page 2) Through a Tor Browser - recommended | 1. Download Tor browser - https://www.torproject.org/ and install it. | 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?8B87A11BCEAB4AA5AD4D982C940D49D8 This link only works in Tor Browser! | 3. Follow the instructions on this page ### Attention! ### # lockbit-decryptor.top may be blocked. We recommend using a Tor browser to access the site # Do not rename encrypted files. # Do not try to decrypt using third party software, it may cause permanent data loss. # Decryption of your files with the help of third parties may cause increased price(they add their fee to our). # Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. # Tor Browser user manual https://tb-manual.torproject.org/about
URLs

http://lockbit-decryptor.top/?8B87A11BCEAB4AA5AD4D982C940D49D8

http://lockbitks2tvnmwk.onion/?8B87A11BCEAB4AA5AD4D982C940D49D8

Extracted

Family

urelas

C2

1.234.83.146

133.242.129.155

218.54.31.226

218.54.30.235

218.54.31.165

Extracted

Family

sodinokibi

Botnet

$2a$10$dfjpLrXuDytfF.kmYtQ1ROgsXjTJEe8EmQT65ftxlTpJtXPZrhsAq

Campaign

7178

Decoy

kamahouse.net

bridgeloanslenders.com

abitur-undwieweiter.de

live-your-life.jp

xn--rumung-bua.online

anteniti.com

marcuswhitten.site

ostheimer.at

joseconstela.com

deepsouthclothingcompany.com

dr-seleznev.com

ecpmedia.vn

aunexis.ch

anthonystreetrimming.com

pocket-opera.de

mooreslawngarden.com

osterberg.fi

extraordinaryoutdoors.com

kamienny-dywan24.pl

fitovitaforum.com
Attributes
  • net

    false

  • pid

    $2a$10$dfjpLrXuDytfF.kmYtQ1ROgsXjTJEe8EmQT65ftxlTpJtXPZrhsAq

  • prc

    avgadmsv

    BackupUpdater

    ocautoupds

    synctime

    thebat

    excel

    isqlplussvc

    ccSetMgr

    SPBBCSvc

    Sage.NA.AT_AU.SysTray

    lmibackupvssservice

    CarboniteUI

    powerpnt

    BackupMaint

    onenote

    klnagent

    sql

    Rtvscan

    xfssvccon

    Smc

    mspub

    encsvc

    LogmeInBackupService

    kavfsscs

    ccSvcHst

    BackupExtender

    NSCTOP

    outlook

    dbsnmp

    mydesktopservice

  • ransom_oneliner

    All of your files are encrypted! Find {EXT}-readme.txt and follow instuctions

  • ransom_template

    ---=== Welcome. Again. ===--- [+] Whats Happen? [+] Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension {EXT}. By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER). [+] Attention!!! [+] Also your private data was downloaded. We will publish it in case you will not get in touch with us asap. [+] What guarantees? [+] Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests. To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee. If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money. [+] How to get access on website? [+] You have two ways: 1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID} 2) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/{UID} Warning: secondary website can be blocked, thats why first variant much better and more available. When you open our website, put the following data in the input form: Key: {KEY} ----------------------------------------------------------------------------------------- !!! DANGER !!! DONT try to change files by yourself, DONT use any third party software for restoring your data or antivirus solutions - its may entail damge of the private key and, as result, The Loss all data. !!! !!! !!! ONE MORE TIME: Its in your interests to get your files back. From our side, we (the best specialists) make everything for restoring, but please should not interfere. !!! !!! !!!

  • sub

    7178

  • svc

    ssistelemetry

    adsync

    svc$

    msseces

    mbamservice

    ssastelemetry

    altaro

    sbamsvc

    ds_notifier

    ntrtscan

    ofcservice

    code42service

    macmnsvc

    memtas

    auservice

    telemetryserver

    tmccsf

    psqlwge

    sppsvc

    viprepplsvc

    azurea

    ds_monitor

    swi_filter

    protectedstorage

    mfemms

    mfevtp

    kaseyaagentendpoint

    ltservice

    dssvc

    altiback

Signatures

  • Detecting the common Go functions and variables names used by Snatch ransomware 3 IoCs
  • GandCrab payload 2 IoCs
  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab
  • Gandcrab family
    gandcrab
  • Lockbit

    Ransomware family with multiple variants released since late 2019.

    ransomwarelockbit
  • Lockbit family
    lockbit
  • Snatch Ransomware

    Ransomware family generally distributed through RDP bruteforce attacks.

    ransomwaresnatch
  • Snatch family
    snatch
  • Sodin,Sodinokibi,REvil

    Ransomware with advanced anti-analysis and privilege escalation functionality.

    ransomwaresodinokibi
  • Sodinokibi family
    sodinokibi
  • Urelas

    Urelas is a trojan targeting card games.

    trojanurelas
  • Urelas family
    urelas
  • VanillaRat

    VanillaRat is an advanced remote administration tool coded in C#.

    ratvanillarat
  • Vanillarat family
    vanillarat
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Detected Nirsoft tools 1 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • Modifies boot configuration data using bcdedit 1 TTPs 3 IoCs
    ransomwareevasion
  • NirSoft WebBrowserPassView 1 IoCs

    Password recovery tool for various web browsers

  • Renames multiple (2378) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Vanilla Rat payload 2 IoCs
    rat
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 4 IoCs
    defense_evasion
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Control Panel 1 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 27 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 60 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00433.7z"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:1808
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2256
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /1
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1040
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4032
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3692
      • C:\Users\Admin\Desktop\00433\HEUR-Trojan-Ransom.MSIL.Blocker.gen-772bf3f4ef4a19ce3fb1bd2be9478cbb387176f396285e9dd2c100e7e2e01135.exe
        HEUR-Trojan-Ransom.MSIL.Blocker.gen-772bf3f4ef4a19ce3fb1bd2be9478cbb387176f396285e9dd2c100e7e2e01135.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4412
      • C:\Users\Admin\Desktop\00433\HEUR-Trojan-Ransom.MSIL.Blocker.gen-a225cd8b8b809388e14eecd40c6bf48a1d0b154ec69cdd864ee610fe7112c9c8.exe
        HEUR-Trojan-Ransom.MSIL.Blocker.gen-a225cd8b8b809388e14eecd40c6bf48a1d0b154ec69cdd864ee610fe7112c9c8.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4704
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4704 -s 1896
          4⤵
          • Program crash
          PID:1424
      • C:\Users\Admin\Desktop\00433\HEUR-Trojan-Ransom.Win32.Cryptor.gen-98bfbdfb6a850a2f3f1e968a1e23c790fee1d8a80dc61f9cdd88394d50091c1b.exe
        HEUR-Trojan-Ransom.Win32.Cryptor.gen-98bfbdfb6a850a2f3f1e968a1e23c790fee1d8a80dc61f9cdd88394d50091c1b.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3548
        • C:\Windows\SYSTEM32\cmd.exe
          cmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6CBC8F64-EC4A-4F4E-9582-FE10EAD0A5BE}'" delete
          4⤵
            PID:1216
            • C:\Windows\System32\wbem\WMIC.exe
              C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{6CBC8F64-EC4A-4F4E-9582-FE10EAD0A5BE}'" delete
              5⤵
                PID:5984
          • C:\Users\Admin\Desktop\00433\HEUR-Trojan-Ransom.Win32.Cuba.gen-33352a38454cfc247bc7465bf177f5f97d7fd0bd220103d4422c8ec45b4d3d0e.exe
            HEUR-Trojan-Ransom.Win32.Cuba.gen-33352a38454cfc247bc7465bf177f5f97d7fd0bd220103d4422c8ec45b4d3d0e.exe
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:312
          • C:\Users\Admin\Desktop\00433\HEUR-Trojan-Ransom.Win32.GandCrypt.gen-6f0a702fe075d823e866a3c261d056e3275b68bd630e0a59b4901695a81c469a.exe
            HEUR-Trojan-Ransom.Win32.GandCrypt.gen-6f0a702fe075d823e866a3c261d056e3275b68bd630e0a59b4901695a81c469a.exe
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3912
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3912 -s 480
              4⤵
              • Program crash
              PID:4540
          • C:\Users\Admin\Desktop\00433\HEUR-Trojan-Ransom.Win32.Lockbit.vho-d5ea463e0719ee2d1705ff305cdd8529bd2ff23dde79c502c4f478937a91f874.exe
            HEUR-Trojan-Ransom.Win32.Lockbit.vho-d5ea463e0719ee2d1705ff305cdd8529bd2ff23dde79c502c4f478937a91f874.exe
            3⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Adds Run key to start application
            • Enumerates connected drives
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Drops file in Program Files directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1516
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
              4⤵
                PID:3588
                • C:\Windows\system32\vssadmin.exe
                  vssadmin delete shadows /all /quiet
                  5⤵
                  • Interacts with shadow copies
                  PID:6816
                • C:\Windows\System32\Wbem\WMIC.exe
                  wmic shadowcopy delete
                  5⤵
                    PID:3716
                  • C:\Windows\system32\bcdedit.exe
                    bcdedit /set {default} bootstatuspolicy ignoreallfailures
                    5⤵
                    • Modifies boot configuration data using bcdedit
                    PID:5848
                  • C:\Windows\system32\bcdedit.exe
                    bcdedit /set {default} recoveryenabled no
                    5⤵
                    • Modifies boot configuration data using bcdedit
                    PID:1224
                  • C:\Windows\system32\wbadmin.exe
                    wbadmin delete catalog -quiet
                    5⤵
                    • Deletes backup catalog
                    PID:4692
              • C:\Users\Admin\Desktop\00433\HEUR-Trojan-Ransom.Win32.Mircop.gen-d2cefef5ad5f20acab4bcfb4544f918b888c8bdae2be54b59889cf3cb6c97d60.exe
                HEUR-Trojan-Ransom.Win32.Mircop.gen-d2cefef5ad5f20acab4bcfb4544f918b888c8bdae2be54b59889cf3cb6c97d60.exe
                3⤵
                • Executes dropped EXE
                • Enumerates connected drives
                • Sets desktop wallpaper using registry
                • System Location Discovery: System Language Discovery
                • Modifies Control Panel
                PID:3728
              • C:\Users\Admin\Desktop\00433\HEUR-Trojan-Ransom.Win32.Snatch.vho-36a4311ef332b0b5db62f8fcabf004fdcfbbde62f791839a8be0314604d814c4.exe
                HEUR-Trojan-Ransom.Win32.Snatch.vho-36a4311ef332b0b5db62f8fcabf004fdcfbbde62f791839a8be0314604d814c4.exe
                3⤵
                • Executes dropped EXE
                • Impair Defenses: Safe Mode Boot
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:532
                • \??\c:\windows\system32\bcdedit.exe
                  c:\windows\Sysnative\bcdedit.exe /set {current} safeboot minimal
                  4⤵
                  • Modifies boot configuration data using bcdedit
                  PID:2584
                • C:\Windows\SysWOW64\shutdown.exe
                  shutdown /r /f /t 00
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:6332
                • \??\c:\windows\SysWOW64\shutdown.exe
                  c:\windows\SysWOW64\shutdown.exe /r /f /t 00
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:7056
                • \??\c:\windows\SysWOW64\shutdown.exe
                  c:\windows\System32\shutdown.exe /r /f /t 00
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:7064
                • \??\c:\windows\system32\shutdown.exe
                  c:\windows\Sysnative\shutdown.exe /r /f /t 00
                  4⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:7072
              • C:\Users\Admin\Desktop\00433\HEUR-Trojan-Ransom.Win32.Sodin.gen-1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e.exe
                HEUR-Trojan-Ransom.Win32.Sodin.gen-1fe9b489c25bb23b04d9996e8107671edee69bd6f6def2fe7ece38a0fb35f98e.exe
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1496
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\System32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe
                  4⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:824
                  • C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe
                    C:\Users\Admin\AppData\Local\Temp\MsMpEng.exe
                    5⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    PID:2836
              • C:\Users\Admin\Desktop\00433\HEUR-Trojan-Ransom.Win32.Stop.gen-f2eb0628c0974c82facf6ae281ef3a5d73e8b1808558e8a0c2b4dd3709593003.exe
                HEUR-Trojan-Ransom.Win32.Stop.gen-f2eb0628c0974c82facf6ae281ef3a5d73e8b1808558e8a0c2b4dd3709593003.exe
                3⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:4820
              • C:\Users\Admin\Desktop\00433\Trojan-Ransom.Win32.Agent.iso-aadde71205336ccdd048f0b5029becbbcd03e741045f406b2fa819b909809202.exe
                Trojan-Ransom.Win32.Agent.iso-aadde71205336ccdd048f0b5029becbbcd03e741045f406b2fa819b909809202.exe
                3⤵
                • Checks computer location settings
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:1484
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /c echo 2D4F861D8DCF8C8F
                  4⤵
                    PID:6404
                • C:\Users\Admin\Desktop\00433\Trojan-Ransom.Win32.AutoIt.zoh-7e9d389353d48d9df51e249ac61e06580f4bb7436f6ef220a4ff232a5ec13f8d.exe
                  Trojan-Ransom.Win32.AutoIt.zoh-7e9d389353d48d9df51e249ac61e06580f4bb7436f6ef220a4ff232a5ec13f8d.exe
                  3⤵
                    PID:2024
                  • C:\Users\Admin\Desktop\00433\Trojan-Ransom.Win32.Blocker.kpuo-99d81d44bc47664fc48947f5b7617dd1457d523ae0d51e9e9bd8307d1a29776d.exe
                    Trojan-Ransom.Win32.Blocker.kpuo-99d81d44bc47664fc48947f5b7617dd1457d523ae0d51e9e9bd8307d1a29776d.exe
                    3⤵
                      PID:3824
                    • C:\Users\Admin\Desktop\00433\Trojan-Ransom.Win32.Blocker.majh-e70dc307eaf88429650359397c74ae88663df1cfc05b8e97f80d0bad758986ee.exe
                      Trojan-Ransom.Win32.Blocker.majh-e70dc307eaf88429650359397c74ae88663df1cfc05b8e97f80d0bad758986ee.exe
                      3⤵
                        PID:2628
                      • C:\Users\Admin\Desktop\00433\Trojan-Ransom.Win32.Crusis.to-324cb383fd7f47c079b162b725215bb4badfd4c0b2e41d330fa38344e59e77ce.exe
                        Trojan-Ransom.Win32.Crusis.to-324cb383fd7f47c079b162b725215bb4badfd4c0b2e41d330fa38344e59e77ce.exe
                        3⤵
                          PID:4580
                        • C:\Users\Admin\Desktop\00433\Trojan-Ransom.Win32.Cryptor.eep-5688f2ea26edc7cc0ac41991b1f8de18b5c27dcb9b8f57c46574b7628086d010.exe
                          Trojan-Ransom.Win32.Cryptor.eep-5688f2ea26edc7cc0ac41991b1f8de18b5c27dcb9b8f57c46574b7628086d010.exe
                          3⤵
                            PID:5728
                          • C:\Users\Admin\Desktop\00433\Trojan-Ransom.Win32.Encoder.kom-f4fc6d16cece4fa588803f99334af36dd33d3c0f2b1f204db53d49d876f459fe.exe
                            Trojan-Ransom.Win32.Encoder.kom-f4fc6d16cece4fa588803f99334af36dd33d3c0f2b1f204db53d49d876f459fe.exe
                            3⤵
                              PID:5868
                            • C:\Users\Admin\Desktop\00433\Trojan-Ransom.Win32.Encoder.mgs-1059e8879dc495dd2239beba0b3533165ffebcab8dd5d194f32cbfa4c200752d.exe
                              Trojan-Ransom.Win32.Encoder.mgs-1059e8879dc495dd2239beba0b3533165ffebcab8dd5d194f32cbfa4c200752d.exe
                              3⤵
                                PID:6248
                              • C:\Users\Admin\Desktop\00433\Trojan-Ransom.Win32.Gen.adag-508dd6f7ed6c143cf5e1ed6a4051dd8ee7b5bf4b7f55e0704d21ba785f2d5add.exe
                                Trojan-Ransom.Win32.Gen.adag-508dd6f7ed6c143cf5e1ed6a4051dd8ee7b5bf4b7f55e0704d21ba785f2d5add.exe
                                3⤵
                                  PID:1600
                                • C:\Users\Admin\Desktop\00433\Trojan-Ransom.Win32.GenericCryptor.cys-7702971989d74ea700b3ac867a5a5ce488cacc657c6f373ef8b43be43e472d67.exe
                                  Trojan-Ransom.Win32.GenericCryptor.cys-7702971989d74ea700b3ac867a5a5ce488cacc657c6f373ef8b43be43e472d67.exe
                                  3⤵
                                    PID:2476
                                  • C:\Users\Admin\Desktop\00433\Trojan-Ransom.Win32.GenericCryptor.czo-3e3383f67ce3ca734e9515d77fc7ea120de11239498831d1fe2303c651debf4a.exe
                                    Trojan-Ransom.Win32.GenericCryptor.czo-3e3383f67ce3ca734e9515d77fc7ea120de11239498831d1fe2303c651debf4a.exe
                                    3⤵
                                      PID:2300
                                    • C:\Users\Admin\Desktop\00433\Trojan-Ransom.Win32.GenericCryptor.czx-6b9dbf223fca7dc3a4bee4657ae33e07c913043e2e71975ec319d26337d2a4b5.exe
                                      Trojan-Ransom.Win32.GenericCryptor.czx-6b9dbf223fca7dc3a4bee4657ae33e07c913043e2e71975ec319d26337d2a4b5.exe
                                      3⤵
                                        PID:1340
                                      • C:\Users\Admin\Desktop\00433\Trojan-Ransom.Win32.Phpw.afn-61575d9d57533eca826ead2a88e4105d11125a30a0bce64489a4f5a0f05278b2.exe
                                        Trojan-Ransom.Win32.Phpw.afn-61575d9d57533eca826ead2a88e4105d11125a30a0bce64489a4f5a0f05278b2.exe
                                        3⤵
                                          PID:4956
                                        • C:\Users\Admin\Desktop\00433\Trojan-Ransom.Win32.Purgen.apq-08b5e7c038cf4a31f6e14168497634c69e5903840bec9b42c15f006831b26499.exe
                                          Trojan-Ransom.Win32.Purgen.apq-08b5e7c038cf4a31f6e14168497634c69e5903840bec9b42c15f006831b26499.exe
                                          3⤵
                                            PID:5632
                                          • C:\Users\Admin\Desktop\00433\Trojan-Ransom.Win32.Sodin.agf-4f6ce92fccafa6d2454a12022e21fbd6adf1a6ec2d45c71de6f8729ec3ad195f.exe
                                            Trojan-Ransom.Win32.Sodin.agf-4f6ce92fccafa6d2454a12022e21fbd6adf1a6ec2d45c71de6f8729ec3ad195f.exe
                                            3⤵
                                              PID:696
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3912 -ip 3912
                                          1⤵
                                            PID:3352
                                          • C:\Windows\system32\vssvc.exe
                                            C:\Windows\system32\vssvc.exe
                                            1⤵
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:4616
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4704 -ip 4704
                                            1⤵
                                              PID:5704
                                            • C:\Windows\system32\LogonUI.exe
                                              "LogonUI.exe" /flags:0x4 /state0:0xa3882055 /state1:0x41c64e6d
                                              1⤵
                                                PID:1568

                                              Network

                                              MITRE ATT&CK Enterprise v15

                                              Reconnaissance

                                              Resource Development

                                              Initial Access

                                              Execution

                                              Command and Scripting Interpreter

                                              1
                                              T1059

                                              Windows Management Instrumentation

                                              1
                                              T1047

                                              Persistence

                                              Boot or Logon Autostart Execution

                                              1
                                              T1547

                                              Registry Run Keys / Startup Folder

                                              1
                                              T1547.001

                                              Privilege Escalation

                                              Boot or Logon Autostart Execution

                                              1
                                              T1547

                                              Registry Run Keys / Startup Folder

                                              1
                                              T1547.001

                                              Defense Evasion

                                              Direct Volume Access

                                              1
                                              T1006

                                              Impair Defenses

                                              1
                                              T1562

                                              Safe Mode Boot

                                              1
                                              T1562.009

                                              Indicator Removal

                                              3
                                              T1070

                                              File Deletion

                                              3
                                              T1070.004

                                              Modify Registry

                                              2
                                              T1112

                                              Credential Access

                                              Credentials from Password Stores

                                              1
                                              T1555

                                              Credentials from Web Browsers

                                              1
                                              T1555.003

                                              Unsecured Credentials

                                              1
                                              T1552

                                              Credentials In Files

                                              1
                                              T1552.001

                                              Discovery

                                              Peripheral Device Discovery

                                              2
                                              T1120

                                              Query Registry

                                              3
                                              T1012

                                              System Information Discovery

                                              4
                                              T1082

                                              System Location Discovery

                                              1
                                              T1614

                                              System Language Discovery

                                              1
                                              T1614.001

                                              Lateral Movement

                                              Collection

                                              Data from Local System

                                              1
                                              T1005

                                              Command and Control

                                              Exfiltration

                                              Impact

                                              Defacement

                                              1
                                              T1491

                                              Inhibit System Recovery

                                              4
                                              T1490

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              • C:\Program Files\7-Zip\!!FAQ for Decryption!!.txt
                                                Filesize

                                                1KB

                                                MD5

                                                6aebef91c3cb27d23eced00745ebd284

                                                SHA1

                                                143da1f9601c6f94cda42e660aa5bf24d05704ae

                                                SHA256

                                                e60fd70c96a085d5e3e11756d62a2f0179c11b33269379ad69f017fe68a5d5a3

                                                SHA512

                                                539ffdff4cbc3788a8b6a9c8f28229af39c37471db55a1c9b89fb75ad6c27140683a12f49c11d45cba88952fd804771deddd97dc63a60df4077fac906e70e02e

                                                Download Submit

                                              • C:\Program Files\7-Zip\7-zip.chm.cuba
                                                Filesize

                                                115KB

                                                MD5

                                                bd395cb5ab5c99b576743d931138bd9f

                                                SHA1

                                                880a6f4344d795e232662b23a4bcd4dd5c5f20a2

                                                SHA256

                                                6d1b5a2d43de5ead4c2cdbf8d8f8e1ff712631d720320850622d3a7f4d683515

                                                SHA512

                                                b5622d817b11f862ce681278c760f28fe0ce233ba970c672d76c151cec7d759effc68510cd411bdbcfed4d48a95108350800a06f6c05e46ab01846050c997a6e

                                                Download Submit

                                              • C:\Program Files\7-Zip\7z.sfx.cuba
                                                Filesize

                                                212KB

                                                MD5

                                                2e7d91cfe66d52d1f8ea9a2f53275e78

                                                SHA1

                                                ce8156582a6f59b54f72e3fc915f07e9187c9827

                                                SHA256

                                                4886f26d4179db0739a010e530ae5a4a92d886f8a641f7966244bf930e315707

                                                SHA512

                                                3a6dee9e923522a41d3cd181f3f35c7df2a4168888d8012425520d0f30c75daf267d4034af9f1d0087745072090de933044a75314ab91258488212577e5d821a

                                                Download Submit

                                              • C:\Program Files\7-Zip\7zCon.sfx.cuba
                                                Filesize

                                                191KB

                                                MD5

                                                4e0cea8f02d8f93112831295d6f41cb7

                                                SHA1

                                                5c31b2d356bdc01c0134af992d496ffffc2bc7be

                                                SHA256

                                                bd6af58385419ef2eea6e4461f98653743d83748f1e27c1bffbb08b384d13cf9

                                                SHA512

                                                a849b653ff93198ee1e76842633529fe50b5da6399518ced5c511db7fd0103820e7757676c6e00ed949be58c4d1c5fac6ba30cd64a06bad001712888c6877bc4

                                                Download Submit

                                              • C:\Program Files\7-Zip\History.txt.cuba
                                                Filesize

                                                59KB

                                                MD5

                                                6dc1afcec76e6a1c8e2900a3fe9203d2

                                                SHA1

                                                4dbfde3d3535075e1581bd52404578b5e485a4ce

                                                SHA256

                                                c06ceebeddf681de8d8bd1cd30b1236ddebc1a1d7908506f3f0527f666d36e9b

                                                SHA512

                                                d43ff03a5840957f626432ca01a90930e2721159985f7061ad7d636044b8120c262c3602e763148323c8e0898f46569857a46a2bc950029425de7b0dba21d48c

                                                Download Submit

                                              • C:\Program Files\7-Zip\Lang\!!FAQ for Decryption!!.txt
                                                Filesize

                                                1KB

                                                MD5

                                                2470a7db6ea4bd56fb6cb6cbf27f0c42

                                                SHA1

                                                fbdf411cda3c7e0a8f4b6fc292594c087e030396

                                                SHA256

                                                d2e6f68d4e67a60e0373ff5f77f7372a9abc2493a23abe76d2d9df2ac509d045

                                                SHA512

                                                a865f14474da8283099cc56d02a6950f7969cb87d3ba9102b4c37fa1aead551fef8aff274832b8bb11e3a8ba32b4b0a50b28383c37546bf68cb07138ebf24d1e

                                                Download Submit

                                              • C:\Program Files\7-Zip\Lang\af.txt.cuba
                                                Filesize

                                                7KB

                                                MD5

                                                a0d233c9e296495394d289eea5d76b41

                                                SHA1

                                                693e7009436e4e4e02b6d46f8aec0063ca012907

                                                SHA256

                                                a21cd8fe4cae37c512f471ef876b9723bd636ed6c6b1ee9d51061a54c09dee3b

                                                SHA512

                                                7c0b68196462b321ab2f293791b17f5b8901f62c886945a7793c90c54e0205ee85e641e06a8442f429b28d787961e7a5af28b709d6ba1d9ccf6168641226d5c4

                                                Download Submit

                                              • C:\Program Files\7-Zip\Lang\an.txt.cuba
                                                Filesize

                                                10KB

                                                MD5

                                                c6fefee01bbbfb1ebbe8f035ef1afad9

                                                SHA1

                                                ad5c203eff6977f895314e723d95546955e79112

                                                SHA256

                                                f9618720db66288a2a4ba45df885f413a85954073eba0b945a70366511abb03e

                                                SHA512

                                                092589f55b51755963c2643764e33af242984c57bd9cde4c9f037ee063ca35ff0b64663f436e9efe82115284186929e5ef6cf42d5b2a562a910bfe3cb232ef06

                                                Download Submit

                                              • C:\Program Files\7-Zip\Lang\ar.txt.cuba
                                                Filesize

                                                15KB

                                                MD5

                                                14a90d213405b6d7623f20283d59638b

                                                SHA1

                                                eeb780c0661f41af0aee7b7bff9798887d51982c

                                                SHA256

                                                bfc6673da3cd706bc50fb2efd7a018f26a4cf8be533f1e809709e66f5f05092b

                                                SHA512

                                                4728390e635f8af8e35f162b12c65f2ce88604c8b7fa88a19839a2b3d8a603c6db256e39c194e247f32187ed5c9d21a0f85525d8e9440365132a9fe422709f96

                                                Download Submit

                                              • C:\Program Files\7-Zip\Lang\ast.txt.cuba
                                                Filesize

                                                7KB

                                                MD5

                                                673c3719b6a6395b01d5665acb02e758

                                                SHA1

                                                95d0865f3b950ae7aa67865d74ace1028655c2ad

                                                SHA256

                                                08cf74118c0f1d9c1e83053d7893e670083c919b40f28854872befd4d97fb0f6

                                                SHA512

                                                fa0c4da97e95e86e3420f4a2a7a2f9a685c99ac943e4f391b555a93d2efc4ca17191851dab91239522bd8437a08316b29fb53cb8504b66f2d40d5c96311f5f64

                                                Download Submit

                                              • C:\Program Files\7-Zip\Lang\az.txt.cuba
                                                Filesize

                                                11KB

                                                MD5

                                                c07138eecd9ae26cdc2c99f9ba314042

                                                SHA1

                                                31e545b8ca25d40dbf30197b0569c0755acdcbb8

                                                SHA256

                                                33f82d2a1acb305a4c6d24e7d24401b793be22ff7193fdd53126342d787dcc5f

                                                SHA512

                                                6f05a27527f4f215688860d30b882096ff6d67f015b21e78c84517b1b8567fb3726a3669dcc17a8ecbb4a0ee59c0edd0c291a997fd0fd608e8a39634cbd31559

                                                Download Submit

                                              • C:\Program Files\7-Zip\Lang\ba.txt.cuba
                                                Filesize

                                                13KB

                                                MD5

                                                50aa3e34c870da7391f97c55ddc94418

                                                SHA1

                                                9e9b15614ea5466e5f47557d49c189bc6d6cd262

                                                SHA256

                                                6bf048e98c2c54323e87bf5f882237483d0916d833a3ee644658d0c3d27a157e

                                                SHA512

                                                7a18457aa9ab3c6a21498e1c6562466c95bd62c0b03b5dfd497b3ea7e826164527acb39d1cb42c8228a0f8a593a340839d0ed53688f72941effc9cd23cf3b516

                                                Download Submit

                                              • C:\Program Files\7-Zip\Lang\be.txt.cuba
                                                Filesize

                                                14KB

                                                MD5

                                                86f109d4deb6e4aac37bf48725c47652

                                                SHA1

                                                1f75c62a40f681a3866bbe677e0fd4dbeb616a1d

                                                SHA256

                                                defd84dfb18e8e6295ca23f009d17a24ea338eda9c6bdf32183d8a52b6b9eaf0

                                                SHA512

                                                835a09d01cbb54f241f025b2493b91db10c100763c39ec78a54efda81f007d97d81de4e3bb655fc9df30faec18d5847945f971349709f7d0998fed00ace3ac20

                                                Download Submit

                                              • C:\Program Files\7-Zip\Lang\bg.txt.cuba
                                                Filesize

                                                15KB

                                                MD5

                                                6c2476db5b6a1b81107dc5a839ac15df

                                                SHA1

                                                36c24d60e20e8455b4553b94a132419e51acf851

                                                SHA256

                                                bc5270e680f7f5c84280ac32ad533fc94b8b2490af8a9082364cf0281461f764

                                                SHA512

                                                d420b7707a66a8e3250cdfe920446682d4c7c379f2de79b9e7b016e4d4a8c7810b88c30f7e7cd7db17751fc6431c37b12c59170f17a23321989318841a5912b8

                                                Download Submit

                                              • C:\Program Files\7-Zip\Lang\bn.txt.cuba
                                                Filesize

                                                17KB

                                                MD5

                                                6a4ff43a15271db28eed4f2c706cf7da

                                                SHA1

                                                e7f6e521b8724a954557742b1813ca50dbe5e514

                                                SHA256

                                                39477a672b66036dfa0eb3314c7362868c5064d97491e58eb2daba1ac7d27669

                                                SHA512

                                                c325e1d17da855f43a7254fdc674ce83b72b0ccfb41494adc36ac94676e84aa6771ab308bab0a234f66d9213609584429fa6232eac0b582e2d109dadceafc0ec

                                                Download Submit

                                              • C:\Program Files\7-Zip\Lang\br.txt.cuba
                                                Filesize

                                                7KB

                                                MD5

                                                402efb7c1f4ee8b6575627e24b255a10

                                                SHA1

                                                9b75fc3e58160dd7c9368810320b16ec3d251766

                                                SHA256

                                                b48c8629e0c13bd83019af5afbf7d94f4d8b715779be7ab057167e6445160cde

                                                SHA512

                                                d038c9b4768b25fe2f163a9b2c212d8bcbd7fb642675874e034acdcadf091e0589dbb910358e68c3b925fa141a32042e016b81601a5cb9ce78c99471135ae17f

                                                Download Submit

                                              • C:\Program Files\7-Zip\Lang\ca.txt.cuba
                                                Filesize

                                                11KB

                                                MD5

                                                cdefe26e20f8ec15435f910bfe90d416

                                                SHA1

                                                d7b6163f69b2cdaafc4c9c07d9f2fa040919ccfd

                                                SHA256

                                                bad4628b2f7092ff122559e0f000121c8b64f1a073ca68fa5521f15c3392d90e

                                                SHA512

                                                58c687b99283e9dee6ff17c55723b34c91d4ffccfb8fe20b74dc9e0f9c572e27f748601e01229cbf8e5ff98cadca5e6f8fc45058a048cb3f9e87c4fd9b60b4a6

                                                Download Submit

                                              • C:\Program Files\7-Zip\Lang\co.txt.cuba
                                                Filesize

                                                13KB

                                                MD5

                                                95d6491694e9d8acb63a0620b708fed2

                                                SHA1

                                                c20ebdac254a5190bf03f7d2ebf025d4a3e8483e

                                                SHA256

                                                f6d432982ff6c00622a7133486de0343db7a517ca3ab256c0a1a95ecab3e763a

                                                SHA512

                                                479a8e15580d57986a2cac3b12dad1f6a759d4324b777cccda929055be0bbcd69724ca79b685f07c73cf9fc2db018137cbc16e596e3e70448caf1e2013e495e9

                                                Download Submit

                                              • C:\Program Files\7-Zip\Lang\cs.txt.cuba
                                                Filesize

                                                11KB

                                                MD5

                                                312520cc5e765428abe9704095e16671

                                                SHA1

                                                4117ec7cabd31ef192c7a63c3b9b983c7ae6f3ac

                                                SHA256

                                                c0d48d614b90fbbb568ddd42cd86c4d7c523d14362ec1541b89d3d135e782db0

                                                SHA512

                                                717dfebb350a53ba1f1eaa63c277e1e1ea1cf86bf357d39b68fb4d6fae853ae55f060b430b4c08f128f3eda888e1d56a0f9e123d8f8e9244428cf4dcad484c06

                                                Download Submit

                                              • C:\Program Files\7-Zip\Lang\cy.txt.cuba
                                                Filesize

                                                7KB

                                                MD5

                                                19405048a36365dcafee6d25caa40a03

                                                SHA1

                                                1f7bd9edda33d4e7861aa7936387a0e876d85bd2

                                                SHA256

                                                0b2a497242e1852746a2564c0e2ee9b764536198552e5d5a96a22693b212d2ae

                                                SHA512

                                                8694dde0d7517cc2ab7ffba7884be5dd83df46bdf362a71ce29909dc13dd25cf27ece4f0f1eb88785ab0ebb7c4facb5bd9433e69bf50130741777e483ddf47c7

                                                Download Submit

                                              • C:\Program Files\7-Zip\Lang\da.txt.cuba
                                                Filesize

                                                10KB

                                                MD5

                                                61a08b877e432d364200d762c2cc1dce

                                                SHA1

                                                8e11174dbf26f2570bd458147739ea125e5ae566

                                                SHA256

                                                6d2a2d1c9b887eb62e8418970a994372826afb2729d9cb2ddfb974e5bbc8ecfe

                                                SHA512

                                                f27223d732387cca8df661af9c411362996deefc553f991c48a4e8e4fa573e683dee48470da30aa1b466b07242252a34dd582aac5c2678fc30d8e3b11b6da077

                                                Download Submit

                                              • C:\Program Files\7-Zip\Lang\de.txt.cuba
                                                Filesize

                                                11KB

                                                MD5

                                                c9cda3df6809265e8dd31f6f59314fc5

                                                SHA1

                                                13622f199b59f1af93c6403fb05abdce007ebc3c

                                                SHA256

                                                065b854c940aa3530c2e0b39a7e828a243dc607c47464a4e64de33ca6a7a0b26

                                                SHA512

                                                e4ce30a2564ca4378e744d89ec5478264b68799dd2dab97c7af0fd926c9ae9f75039d528f9a9eb26aeba08ea56eab3ed2d81a48cf689d65a59ecce2cf5614d32

                                                Download Submit

                                              • C:\Program Files\7-Zip\Lang\el.txt.cuba
                                                Filesize

                                                19KB

                                                MD5

                                                8968617d679abe84dfaca70776cd0791

                                                SHA1

                                                52d2bb8eb26508798dd8b9b6866e456fefa0b259

                                                SHA256

                                                c566ff7ac5c6c8808af8f4791123e65518fca2fe8e6fb083951edd4fa35d483e

                                                SHA512

                                                43303a42fc6b0afc9da21f0aa8dabf723a792072c2e12a8359a460f8791f73f4203725bdc27dcc814826947c9b8ebeb4f813a870d82e002e2894ed1b7de3f41a

                                                Download Submit

                                              • C:\Program Files\7-Zip\Lang\en.ttt.cuba
                                                Filesize

                                                10KB

                                                MD5

                                                27c63684a127cc7f4fbb6e41b97ab0c8

                                                SHA1

                                                94db31795b35be81948e4197b127bdaac9fbed60

                                                SHA256

                                                df590ddbc77592690fd04400948ab1b13ce38fc19f8a802c3b63306f7325f383

                                                SHA512

                                                8bb2296d3e74a1ae79d8271a9609ff4312f78d6b55142fc4e94afc5d0ec7cb4b457178453a2a670a7db3232481e17908b503267629cdd7460b183b8f1717cf9a

                                                Download Submit

                                              • C:\Program Files\7-Zip\Lang\eo.txt.cuba
                                                Filesize

                                                7KB

                                                MD5

                                                cd2d01b9fdffeba1c31b5b3c038ac099

                                                SHA1

                                                30addb67cea47c4b6c73c613728f58934bad8ef5

                                                SHA256

                                                1f9c10404122bec2ad455e114bdc20d93299d28e3efebe8b47f7526fa66eca8c

                                                SHA512

                                                443243678ee25c2212d0dd828f07189096b33f5d26d690ae0ddcbf6d6c526e3cb4e3ede7127354c168e85067eac2a233c09edb43f5060672a378389c3f97bec5

                                                Download Submit

                                              • C:\Program Files\7-Zip\Lang\es.txt.cuba
                                                Filesize

                                                12KB

                                                MD5

                                                b2b6ea71889b28a84c1201c3b746dc61

                                                SHA1

                                                c5338399716336140b9529426ef42b0caee98ef3

                                                SHA256

                                                b99ea6e43aff20d59e89f8e51cb1844b286688c2b799053253c1824ec3207374

                                                SHA512

                                                5f303d4691abbd4b94f5b5bd51dbfb95cdf0a2227a293e53babd83af326c57a2b23d630d49fc1949ce6761bf55d9216359d3d328f6b15c0ac6ce640a9827c949

                                                Download Submit

                                              • C:\Program Files\7-Zip\Lang\et.txt.cuba
                                                Filesize

                                                9KB

                                                MD5

                                                109575e7b5c2168f45091da3252a0024

                                                SHA1

                                                8e78427e20590001b74fcf34c19a229a32764737

                                                SHA256

                                                ded3c63fc4c95947f4f4d7c4639389d5587d63abd88124653e4a5a24384f337d

                                                SHA512

                                                3fe705e7c684d38ba5e76be4a56faa818d8653520fadbf2edc8a9dc1eea2350e24659b0184b638e25eb35234109be38cac1e7c646eb7defa85c9ac5a2a6fa845

                                                Download Submit

                                              • C:\Program Files\7-Zip\Lang\eu.txt.cuba
                                                Filesize

                                                11KB

                                                MD5

                                                322c7e662c8ac094bb5c1b20e3545201

                                                SHA1

                                                5c34d81c5428377a369d5e3ff170d7cc6a91b789

                                                SHA256

                                                45aaaa63aa1fb1657ffa376a9774a0299185b97f82ab5485832cdba4862f8a0c

                                                SHA512

                                                a46c435df3ce589a7ab359d1f98fd7a15496a56ee8c943dee088fa23047cefafff664b6ff6834325a33a0218c6d238e09425a2b931c96f6287a9c8239bf57b34

                                                Download Submit

                                              • C:\Program Files\7-Zip\Lang\ext.txt.cuba
                                                Filesize

                                                10KB

                                                MD5

                                                daedb04372930332056af27a84c14ed3

                                                SHA1

                                                de90a15223775899df7b676e6dff989ba74329c2

                                                SHA256

                                                2fd6349c887eee655ce158503d221960c128ab4e709e01f068a7a4b4456263c7

                                                SHA512

                                                a4f87d0f076a85029c1d97bfeef61087e8f00ea98c72c5d1fbd6529094e280c13e2676f00faedb803ce80a6b17dc4c897730341dec0a7fd595e1eda01e73b46b

                                                Download Submit

                                              • C:\Program Files\7-Zip\Lang\fa.txt.cuba
                                                Filesize

                                                16KB

                                                MD5

                                                223bbefaf48c1ecbf2ffb712b16c7ef4

                                                SHA1

                                                cc5672b63b0468a7c80ae13053d692edc0954cc9

                                                SHA256

                                                8e87b56cce2684b5fd5b3de3e61aee0dd1f95d284d92b6d06f8dbacfe8201e83

                                                SHA512

                                                bc978ae9eb2073e04ea6278f5495c19108dd4059b17731e09ac6fba7a3e00098d42ccdab0889ca1231ca3b94d55e39627ab9ee4536703bfa89beb6ef4e824f93

                                                Download Submit

                                              • C:\Program Files\7-Zip\Lang\fi.txt.cuba
                                                Filesize

                                                11KB

                                                MD5

                                                5ad589a603745d0cd68c7413096b8289

                                                SHA1

                                                e1cc735af33a468a3c9b2169203dc43e817acbd1

                                                SHA256

                                                de7c46f2b174ca42912a55563da82f5d640a413dcb86c517f4aad67a6298866a

                                                SHA512

                                                3b4984007ca4ee799e89b52cac398ffc6014683351b9adbe17c10cfae6064fe14b97419f15febc20ecebfe1004be51464345a3d38b0f6603c20f4944d1cc10ee

                                                Download Submit

                                              • C:\Program Files\7-Zip\Lang\fr.txt.cuba
                                                Filesize

                                                12KB

                                                MD5

                                                f7848dbfa2bc7b2660b8c43d062661a7

                                                SHA1

                                                0b849cde4080df8237cdf75f5cb61f79d5285505

                                                SHA256

                                                d28dab0b03ff1cfd3f75ef68a49616ce6f0aea86c6b388b32edb238d5b88d5e5

                                                SHA512

                                                18b582d6ba28fe978b7f057449b393e454259646647e4c8da502d53a08b35128465fa2b6310576a1a34ccde698b7f662e7822d08b92e881d897eaf523d47dd6a

                                                Download Submit

                                              • C:\Program Files\7-Zip\Lang\fur.txt.cuba
                                                Filesize

                                                9KB

                                                MD5

                                                55353cf40cbd7768629b23c97785c3b8

                                                SHA1

                                                f1f277744922731c8bf0aff89d4222193c0af949

                                                SHA256

                                                37c85dfce9261e5c2cbc4dcca2020f5ae3ee510df14e8530a7159d30c03b2748

                                                SHA512

                                                8a03dd3b2f6a2a3ccff467e413b309922f254dd60505c30c071317c35c283c5135f945190f7ac4d60139642b03e9395a3770ac2b08ea6c84df77c53c34d01740

                                                Download Submit

                                              • C:\Program Files\7-Zip\Lang\fy.txt.cuba
                                                Filesize

                                                8KB

                                                MD5

                                                4fd0716b9c38e45f66ce49119390ab45

                                                SHA1

                                                ed3dbaa0b2f2c857cdeffcfa1bcd499727668326

                                                SHA256

                                                ce7be5ca9a1deb5292088b2f899114a3a6f441daeabbd2053936f1fe6f56e552

                                                SHA512

                                                a1d9c7f7c3b45c9c6feb10fea071a9da33f02d1e436be32804bde4442a98ef392108f5821c41027098b611ff4801f7a141361414b065e07facdd6c102125383a

                                                Download Submit

                                              • C:\Program Files\7-Zip\Lang\ga.txt.cuba
                                                Filesize

                                                10KB

                                                MD5

                                                3acc0b9a13089b13f2c17cab5715601a

                                                SHA1

                                                7de5f7fc392f514fc45f5317616b2ab0cea07428

                                                SHA256

                                                a83d244c83c36eea0b6810bb786bacfda3e45fe670ffcfb553d9c2c6a9ee8536

                                                SHA512

                                                51562a07c1d1a18c89a43af2b93d4b80152fe2e01b59954488a37de49e664c42bd0f1d1d54c74c44b16a15d93dd409638cafe30f9331ec8dfca7234be0664cba

                                                Download Submit

                                              • C:\Program Files\7-Zip\Lang\gl.txt.cuba
                                                Filesize

                                                11KB

                                                MD5

                                                c71eeeab302d0d2f424195ae01d8288e

                                                SHA1

                                                4c334fb8e6b5d2e8c9e8c950363bcb1539ba36b2

                                                SHA256

                                                8f713354292bb8e9822a3e99f5fd291854bcd185e3b9adfec6747c49a69e9c55

                                                SHA512

                                                09c021a4e5af929e33fc512581498fd2a9d6964561024f50358ce08194463cb90bcd1d7e3ea19b47fa2d76b4d52d7ce333849c9455776f5ae13a045687fd9fc4

                                                Download Submit

                                              • C:\Program Files\7-Zip\Lang\gu.txt.cuba
                                                Filesize

                                                19KB

                                                MD5

                                                196e73e2c40db562787a078d71d73654

                                                SHA1

                                                157157a2cf472ae2cbcb23ed291370b2c23a1e1a

                                                SHA256

                                                31dfde8ea94c046b4b7a7224c12d25639f4882583cd8a67f156dd27b2640ec08

                                                SHA512

                                                649b7189e682d3cd9190940331b8f34e7bb04425b602c57e85de3e7381620764ce8a744597d369d108ef99888ce601efbb5e84c616577fd13130ba4458a44f27

                                                Download Submit

                                              • C:\Program Files\7-Zip\Lang\he.txt.cuba
                                                Filesize

                                                13KB

                                                MD5

                                                f04f6dd1bbed9611317f906274c0bb65

                                                SHA1

                                                eeba6fb7d9846a60bea02f671a6f773518db933d

                                                SHA256

                                                26660a233964d1678126d789ee3640a0dd7f21e9c7d9423b51b36d2f6d4e1265

                                                SHA512

                                                636cacd649a7be91ecc3c5085039dc5d8961c8d7c3a19fd5f53e253b96d6fe57ad0a602d40265bd87557ab9bc2ea4b26043faec687a036d23b1e0ef56aa0f33e

                                                Download Submit

                                              • C:\Program Files\7-Zip\Lang\hi.txt.cuba
                                                Filesize

                                                19KB

                                                MD5

                                                a55af22a67db1e587d337eb74b21a81d

                                                SHA1

                                                b1c8eda9c0008a73b9f73d1a6b3f8c4347d376ff

                                                SHA256

                                                95e90776df6ecbec34aef5e23f2b5e04eb8bcddc6c759fc42ce4a8e1276dc024

                                                SHA512

                                                501586618c1ce11c7f6448273031a65df9dcd1acde98a05a9b1c757f5fe967c16f11fb28e9d5f1310518610617747df7c2d3a7dafb11738a732efcc55eeeb0e2

                                                Download Submit

                                              • C:\Program Files\7-Zip\Lang\hr.txt.cuba
                                                Filesize

                                                10KB

                                                MD5

                                                c3f3643bb6318832c4e1a100f96fa1a7

                                                SHA1

                                                c76cfb031faad86e34008d1d8c3f980fb9f9b17a

                                                SHA256

                                                ae658dcbf3569cd4006b43e54b384dfa33f7c344ef862b4d732535f51d076517

                                                SHA512

                                                9741f691af2c6c0e4ced3b695e206152f28fd495e3a27ac79d66378081c88be1bf4e60162928fd620397b3ae5b78d815bf136f0c65963aaae2fd313ea86fa3e1

                                                Download Submit

                                              • C:\Program Files\7-Zip\Lang\hu.txt.cuba
                                                Filesize

                                                12KB

                                                MD5

                                                b7f7ade6d842cd1316c59599957c27ef

                                                SHA1

                                                e3963f99cd5905dbc447baf6b1d879fa1965cca6

                                                SHA256

                                                3a6f516147c48a622401f08e8ed7ab82c78dfc740ee148fd5eb6b858eb0c3b01

                                                SHA512

                                                7d36b39515008614b83a03de928468386228ab4181d5857202040d9e21dd66b3ebd715fec70d0980c7bed5977ce0cd6da47ee5afaf271b94327ab6d320733821

                                                Download Submit

                                              • C:\Program Files\7-Zip\Lang\hy.txt.cuba
                                                Filesize

                                                16KB

                                                MD5

                                                f302c15a6e0be34d3175ec43961f656e

                                                SHA1

                                                9ee5ebc7603455365b7f71ae6018ecda60b10067

                                                SHA256

                                                e7d0b0ba489a73f6e969f37d7e70d9274a33ec82c04c740703cfe107f5630151

                                                SHA512

                                                668b23c4c89fb14b98152c70309f455043f330356e877fba4a2a711b9a345205b23106dd99a79de21cf4007847651bbdbc3691af1c5f2de750d11732c1c32d44

                                                Download Submit

                                              • C:\Program Files\7-Zip\descript.ion.cuba
                                                Filesize

                                                2KB

                                                MD5

                                                f47a1b518f2643c76f6c1882a68f5b15

                                                SHA1

                                                a21140c02593aaea27d50c64e23d3eef19f4757f

                                                SHA256

                                                e2af3e438bdedbe3b310bd07eaf433ee6523f3822625a0abe8ba919d36234cd0

                                                SHA512

                                                78b5695ad531f636726f20fe9da2a9247b58bb7f46bbbd5a7d2271cef9cfc8b184906b6cfc773852e318dea3d84cc26420b7e947aea94254af596f647f877fd2

                                                Download Submit

                                              • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\!!FAQ for Decryption!!.txt
                                                Filesize

                                                462B

                                                MD5

                                                2d98abedc07579cb01fecd5f4b46a099

                                                SHA1

                                                b253443b779329404ba1168eadba0888e5893794

                                                SHA256

                                                feebfb5ad1b2a7c6c7f80d0a41313eb788b9d6087afcd2abc19fe947147c6afc

                                                SHA512

                                                1d8480d8ba4667990477dc08cfa083420a87f02524ae696a5881f18248f6291229ffced8bd4e81b4c3a96189580a4945819754763232549479d4fb72825b1512

                                                Download Submit

                                              • C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\cs\Restore-My-Files.txt
                                                Filesize

                                                1KB

                                                MD5

                                                13db383778fc48bce45e9e798abfe5cf

                                                SHA1

                                                28937dc3bfe182e68e5ba50acb77667ac661843d

                                                SHA256

                                                45fe78f40b08e4efefb6e047e4fc1a3ee3fee074a598ae78720fc893ba20839e

                                                SHA512

                                                3217aa906fdd211c7b0c83f15564de2dca36eda15bb048c5ee36f3f3d863db733fc83c92f80769faa2281aa1481512b7e9d34748b96f13a9a3261da945f4f467

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
                                                Filesize

                                                64KB

                                                MD5

                                                d2fb266b97caff2086bf0fa74eddb6b2

                                                SHA1

                                                2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

                                                SHA256

                                                b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

                                                SHA512

                                                c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                                Filesize

                                                4B

                                                MD5

                                                f49655f856acb8884cc0ace29216f511

                                                SHA1

                                                cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                                SHA256

                                                7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                                SHA512

                                                599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
                                                Filesize

                                                944B

                                                MD5

                                                6bd369f7c74a28194c991ed1404da30f

                                                SHA1

                                                0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

                                                SHA256

                                                878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

                                                SHA512

                                                8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

                                                Download Submit

                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vgv314w2.jqm.ps1
                                                Filesize

                                                60B

                                                MD5

                                                d17fe0a3f47be24a6453e9ef58c94641

                                                SHA1

                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                SHA256

                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                SHA512

                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                Download Submit

                                              • C:\Users\Admin\Desktop\00433\HEUR-Trojan-Ransom.MSIL.Blocker.gen-772bf3f4ef4a19ce3fb1bd2be9478cbb387176f396285e9dd2c100e7e2e01135.exe
                                                Filesize

                                                114KB

                                                MD5

                                                13ac708881a28cef66a4425c456891a3

                                                SHA1

                                                b58fd6e2562c8d2668a9bd95022a0945ac3e2700

                                                SHA256

                                                772bf3f4ef4a19ce3fb1bd2be9478cbb387176f396285e9dd2c100e7e2e01135

                                                SHA512

                                                a945e76df536bd7621e72523aac40b243ec9933d48dc2b50aa8d4a1bde24068e71cec30a649aca447cdf7185e9ab741927685f859e3c9f85871db2f7f73c6a91

                                                Download Submit

                                              • C:\Users\Admin\Desktop\00433\HEUR-Trojan-Ransom.MSIL.Blocker.gen-a225cd8b8b809388e14eecd40c6bf48a1d0b154ec69cdd864ee610fe7112c9c8.exe
                                                Filesize

                                                1.3MB

                                                MD5

                                                d487b46269cd624447f2f97466a16f6c

                                                SHA1

                                                ad864c882e0f1f3b02c198fbe4e37719f30d9e94

                                                SHA256

                                                a225cd8b8b809388e14eecd40c6bf48a1d0b154ec69cdd864ee610fe7112c9c8

                                                SHA512

                                                565a7eaace87c3aa3b97d80f1775ad98eea1a268fd2e2738633ec9be14eaa3b384f741bd211697241767f87814638ebabfc93cb60e06673138416b6c05cd68f2

                                                Download Submit

                                              • C:\Users\Admin\Desktop\00433\HEUR-Trojan-Ransom.Win32.Cryptor.gen-98bfbdfb6a850a2f3f1e968a1e23c790fee1d8a80dc61f9cdd88394d50091c1b.exe
                                                Filesize

                                                190KB

                                                MD5

                                                cc761ff32d8365d76e5a0ae25fdbed9e

                                                SHA1

                                                954d00cc3ad3c2c2495efe94474e66b9107b307f

                                                SHA256

                                                98bfbdfb6a850a2f3f1e968a1e23c790fee1d8a80dc61f9cdd88394d50091c1b

                                                SHA512

                                                d25e9bd1a14ead9ce51ece70c7366dc862614fdd73bf9c290cdf690d939cdce46d66694faa1f449260a41d10776802637f10c8a621d5d32a1c9409ffdd17e47f

                                                Download Submit

                                              • C:\Users\Admin\Desktop\00433\HEUR-Trojan-Ransom.Win32.Cuba.gen-33352a38454cfc247bc7465bf177f5f97d7fd0bd220103d4422c8ec45b4d3d0e.exe
                                                Filesize

                                                160KB

                                                MD5

                                                d8fd19fef4605b4217cb2546c470a918

                                                SHA1

                                                79786955d426945054e6d02050b8f9ada01e39ef

                                                SHA256

                                                33352a38454cfc247bc7465bf177f5f97d7fd0bd220103d4422c8ec45b4d3d0e

                                                SHA512

                                                903a230ca10b445e77057affec44d40160b6606e28ab5d734a8a6434948bf6a51b264a4505451412c0dee63b56cf44d50096e71db3c8d579eb63f9b6bd4465f4

                                                Download Submit

                                              • C:\Users\Admin\Desktop\00433\HEUR-Trojan-Ransom.Win32.GandCrypt.gen-6f0a702fe075d823e866a3c261d056e3275b68bd630e0a59b4901695a81c469a.exe
                                                Filesize

                                                328KB

                                                MD5

                                                8409411ea7576b916b5a17449fb1f38a

                                                SHA1

                                                9634e7737450343629b3e552dcd0a6029286a28e

                                                SHA256

                                                6f0a702fe075d823e866a3c261d056e3275b68bd630e0a59b4901695a81c469a

                                                SHA512

                                                35aa9d2b47c2d7784f20c4bbdfa8fb6861c960814dadd33405113a9c48bc44471227209bf2906b814ba8f6f5ba9ce3abc699c2f2bbff32d6c72b4a17a9aee1ef

                                                Download Submit

                                              • C:\Users\Admin\Desktop\00433\HEUR-Trojan-Ransom.Win32.Mircop.gen-d2cefef5ad5f20acab4bcfb4544f918b888c8bdae2be54b59889cf3cb6c97d60.exe
                                                Filesize

                                                314KB

                                                MD5

                                                3469ddc8a9b9f4b595e8afffc246810c

                                                SHA1

                                                78d4b781c73a95dc5e87fae05c6b830f880ecf62

                                                SHA256

                                                d2cefef5ad5f20acab4bcfb4544f918b888c8bdae2be54b59889cf3cb6c97d60

                                                SHA512

                                                cecda855fc3ed684aff61595f9d05bea628ef5fced77048e0b58258af8cdd47a5f366a29d479013c1e42f56a62f060e6c6e36289c536f3ddbd21b426e22cb5a4

                                                Download Submit

                                              • C:\Users\Admin\Desktop\00433\HEUR-Trojan-Ransom.Win32.Snatch.vho-36a4311ef332b0b5db62f8fcabf004fdcfbbde62f791839a8be0314604d814c4.exe
                                                Filesize

                                                4.2MB

                                                MD5

                                                32de66a467db22cf0f5b65d1a9f4e19c

                                                SHA1

                                                cdb5c200cba7da3f6e80e868ef7df380ac1259c2

                                                SHA256

                                                36a4311ef332b0b5db62f8fcabf004fdcfbbde62f791839a8be0314604d814c4

                                                SHA512

                                                af200cc334c05e5fe0df1d4c76b5ce469d034c0d62288d207b6bb6562579e07dc4510e4bfc4b726cf1a9f82ae8cb69c4630e981f23d05fb85e3be842a34244f1

                                                Download Submit

                                              • \??\c:\users\admin\desktop\00433\heur-trojan-ransom.win32.lockbit.vho-d5ea463e0719ee2d1705ff305cdd8529bd2ff23dde79c502c4f478937a91f874.exe
                                                Filesize

                                                146KB

                                                MD5

                                                b3175331ae74ee277e94d3e0bc982bf4

                                                SHA1

                                                db0731d693a1ac46706825dcb91193ae4efec482

                                                SHA256

                                                d5ea463e0719ee2d1705ff305cdd8529bd2ff23dde79c502c4f478937a91f874

                                                SHA512

                                                38318d3e6461b72c6111e96c4d5aab830e5824b8ef762360d894ea67d9e16b12d54087f7f0fcc8c579824753df039b137294ba6abab0171e294f2c538cc6fa8a

                                                Download Submit

                                              • memory/532-3765-0x0000000000400000-0x000000000082C000-memory.dmp

                                                Filesize

                                                4.2MB

                                                Download

                                              • memory/532-634-0x0000000000400000-0x000000000082C000-memory.dmp

                                                Filesize

                                                4.2MB

                                                Download

                                              • memory/696-4968-0x00000000001B0000-0x00000000001D7000-memory.dmp

                                                Filesize

                                                156KB

                                                Download

                                              • memory/1340-4948-0x0000000000400000-0x0000000000489000-memory.dmp

                                                Filesize

                                                548KB

                                                Download

                                              • memory/2256-51-0x0000022C762B0000-0x0000022C762B1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2256-50-0x0000022C762B0000-0x0000022C762B1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2256-61-0x0000022C762B0000-0x0000022C762B1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2256-58-0x0000022C762B0000-0x0000022C762B1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2256-52-0x0000022C762B0000-0x0000022C762B1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2256-56-0x0000022C762B0000-0x0000022C762B1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2256-60-0x0000022C762B0000-0x0000022C762B1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2256-62-0x0000022C762B0000-0x0000022C762B1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2256-59-0x0000022C762B0000-0x0000022C762B1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2256-57-0x0000022C762B0000-0x0000022C762B1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2300-4946-0x0000000000400000-0x0000000000436000-memory.dmp

                                                Filesize

                                                216KB

                                                Download

                                              • memory/2476-4945-0x0000000000400000-0x0000000000487000-memory.dmp

                                                Filesize

                                                540KB

                                                Download

                                              • memory/3728-493-0x0000000000400000-0x00000000004C8000-memory.dmp

                                                Filesize

                                                800KB

                                                Download

                                              • memory/3728-749-0x0000000000400000-0x00000000004C8000-memory.dmp

                                                Filesize

                                                800KB

                                                Download

                                              • memory/3824-4908-0x0000000000400000-0x000000000042F000-memory.dmp

                                                Filesize

                                                188KB

                                                Download

                                              • memory/3912-316-0x00000000020B0000-0x00000000020C7000-memory.dmp

                                                Filesize

                                                92KB

                                                Download

                                              • memory/3912-140-0x0000000000400000-0x0000000000460000-memory.dmp

                                                Filesize

                                                384KB

                                                Download

                                              • memory/3912-311-0x0000000000400000-0x0000000000460000-memory.dmp

                                                Filesize

                                                384KB

                                                Download

                                              • memory/4032-80-0x00000251C4730000-0x00000251C4752000-memory.dmp

                                                Filesize

                                                136KB

                                                Download

                                              • memory/4032-90-0x00000251C4BF0000-0x00000251C4C34000-memory.dmp

                                                Filesize

                                                272KB

                                                Download

                                              • memory/4032-91-0x00000251C4CC0000-0x00000251C4D36000-memory.dmp

                                                Filesize

                                                472KB

                                                Download

                                              • memory/4032-93-0x00000251C4C80000-0x00000251C4C9E000-memory.dmp

                                                Filesize

                                                120KB

                                                Download

                                              • memory/4412-118-0x0000000005E80000-0x0000000006424000-memory.dmp

                                                Filesize

                                                5.6MB

                                                Download

                                              • memory/4412-110-0x0000000000F90000-0x0000000000FB2000-memory.dmp

                                                Filesize

                                                136KB

                                                Download

                                              • memory/4412-131-0x00000000058D0000-0x0000000005962000-memory.dmp

                                                Filesize

                                                584KB

                                                Download

                                              • memory/4412-237-0x0000000005880000-0x000000000588A000-memory.dmp

                                                Filesize

                                                40KB

                                                Download

                                              • memory/4704-619-0x0000000005380000-0x0000000005396000-memory.dmp

                                                Filesize

                                                88KB

                                                Download

                                              • memory/4704-618-0x0000000005360000-0x000000000537E000-memory.dmp

                                                Filesize

                                                120KB

                                                Download

                                              • memory/4704-109-0x0000000000320000-0x00000000005DA000-memory.dmp

                                                Filesize

                                                2.7MB

                                                Download

                                              • memory/4704-566-0x00000000050C0000-0x0000000005126000-memory.dmp

                                                Filesize

                                                408KB

                                                Download

                                              • memory/4704-555-0x0000000004EE0000-0x0000000004F76000-memory.dmp

                                                Filesize

                                                600KB

                                                Download

                                              • memory/4956-4967-0x0000000000400000-0x0000000001476000-memory.dmp

                                                Filesize

                                                16.5MB

                                                Download

                                              • memory/5632-4966-0x0000000000400000-0x0000000000B8A000-memory.dmp

                                                Filesize

                                                7.5MB

                                                Download

                                              • memory/5728-4912-0x0000000000890000-0x0000000000AB7000-memory.dmp

                                                Filesize

                                                2.2MB

                                                Download