Overview

overview

10

Static

static

1

RNSM00393.7z

windows10-2004-x64

10

Analysis

  • max time kernel
    82s
  • max time network
    169s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-11-2024 22:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RNSM00393.7z

  • Size

    42.9MB

  • MD5

    c669c4fc12893f651e89581f9988813c

  • SHA1

    ecc05197cfa3d2dbfb34826c8593807445b1f963

  • SHA256

    fa1da5867ebac2dddcf4b73fd40052b86847b66dd90019ab3f1f4d3f228b8739

  • SHA512

    304dfc4f7d143ae65a49848510367a65ccd1756c9b58c5e28ca33981cc9885803115ed310024ae33ef80bce1b3b82d74d0727005c3df3090d0165651d97d4db2

  • SSDEEP

    786432:sEpOmv03qjWHKUuSdZVZFhxZYTBudpPsuoVgThdqNiF+j85BMxw/zoy+aG7O9gci:sEUbqjQzuSdZVXhxStudJzoVg9Q8F+jN

Score
10/10
cryptbotdharmadjvugandcrabstormkittybackdoordefense_evasiondiscoveryevasionexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Extracted

Family

cryptbot

C2

bibinene06.top

moraass11.top

Extracted

Family

djvu

C2

http://cjto.top/nddddhsspen6/get.php

Attributes
  • extension

    .moss

  • offline_id

    JfQF2MdGDbN6Jyv88cdFwKcakT7HML8XzQtzmYt1

  • payload_url

    http://cjto.top/files/penelop/updatewin1.exe

    http://cjto.top/files/penelop/updatewin2.exe

    http://cjto.top/files/penelop/updatewin.exe

    http://cjto.top/files/penelop/3.exe

    http://cjto.top/files/penelop/4.exe

    http://cjto.top/files/penelop/5.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-7596obcC8h Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0255Wdasde

rsa_pubkey.plain

Signatures

  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot
  • CryptBot payload 9 IoCs
  • Cryptbot family
    cryptbot
  • Detected Djvu ransomware 3 IoCs
  • Dharma

    Dharma is a ransomware that uses security software installation to hide malicious activities.

    ransomwaredharma
  • Dharma family
    dharma
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu
  • Djvu family
    djvu
  • GandCrab payload 2 IoCs
  • Gandcrab

    Gandcrab is a Trojan horse that encrypts files on a computer.

    ransomwarebackdoorgandcrab
  • Gandcrab family
    gandcrab
  • StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty
  • StormKitty payload 3 IoCs
  • Stormkitty family
    stormkitty
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
    evasion
  • Checks BIOS information in registry 2 TTPs 6 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 13 IoCs
  • Identifies Wine through registry keys 2 TTPs 3 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 2 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 4 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 7 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 3 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00393.7z"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:3912
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /4
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2496
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /1
      2⤵
      • Drops startup file
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1704
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4412
    • C:\Windows\system32\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1068
      • C:\Users\Admin\Desktop\00393\HEUR-Trojan-Ransom.MSIL.Blocker.gen-309d2137aeb704f62360370cadceb1812d81790f23399ca9f229e88d94971fb6.exe
        HEUR-Trojan-Ransom.MSIL.Blocker.gen-309d2137aeb704f62360370cadceb1812d81790f23399ca9f229e88d94971fb6.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:5044
        • C:\Users\Admin\AppData\Roaming\ServicesHost.exe
          "C:\Users\Admin\AppData\Roaming\ServicesHost.exe"
          4⤵
            PID:7272
        • C:\Users\Admin\Desktop\00393\HEUR-Trojan-Ransom.MSIL.Encoder.gen-e0a681902f4f331582670e535a7d1eb3d6eff18d3fbed3ffd2433f898219576f.exe
          HEUR-Trojan-Ransom.MSIL.Encoder.gen-e0a681902f4f331582670e535a7d1eb3d6eff18d3fbed3ffd2433f898219576f.exe
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4668
        • C:\Users\Admin\Desktop\00393\HEUR-Trojan-Ransom.MSIL.Gen.gen-f3645997b7c66390311eec5630208e5a4e9df7cc6e8cc6b0ecbd988605eef499.exe
          HEUR-Trojan-Ransom.MSIL.Gen.gen-f3645997b7c66390311eec5630208e5a4e9df7cc6e8cc6b0ecbd988605eef499.exe
          3⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:3888
        • C:\Users\Admin\Desktop\00393\HEUR-Trojan-Ransom.Win32.Blocker.pef-240e1573bc56a760ce9e5ba36c43e94d573c464ac3ce50b4400a1d4ba43f2404.exe
          HEUR-Trojan-Ransom.Win32.Blocker.pef-240e1573bc56a760ce9e5ba36c43e94d573c464ac3ce50b4400a1d4ba43f2404.exe
          3⤵
          • Checks computer location settings
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:720
          • C:\Users\Admin\AppData\Local\Temp\zbhnd.exe
            "C:\Users\Admin\AppData\Local\Temp\zbhnd.exe"
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2692
        • C:\Users\Admin\Desktop\00393\HEUR-Trojan-Ransom.Win32.Crypren.gen-87be242c76c959d2f30288245e2221856f667d918a306b100046f9264146dc19.exe
          HEUR-Trojan-Ransom.Win32.Crypren.gen-87be242c76c959d2f30288245e2221856f667d918a306b100046f9264146dc19.exe
          3⤵
          • Drops startup file
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops desktop.ini file(s)
          • Drops file in System32 directory
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3540
          • C:\Windows\system32\cmd.exe
            "C:\Windows\system32\cmd.exe"
            4⤵
              PID:3236
              • C:\Windows\system32\mode.com
                mode con cp select=1251
                5⤵
                  PID:5136
                • C:\Windows\system32\vssadmin.exe
                  vssadmin delete shadows /all /quiet
                  5⤵
                  • Interacts with shadow copies
                  PID:3428
              • C:\Windows\system32\cmd.exe
                "C:\Windows\system32\cmd.exe"
                4⤵
                  PID:11004
                  • C:\Windows\system32\mode.com
                    mode con cp select=1251
                    5⤵
                      PID:5804
                    • C:\Windows\system32\vssadmin.exe
                      vssadmin delete shadows /all /quiet
                      5⤵
                      • Interacts with shadow copies
                      PID:5504
                  • C:\Windows\System32\mshta.exe
                    "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
                    4⤵
                      PID:11784
                    • C:\Windows\System32\mshta.exe
                      "C:\Windows\System32\mshta.exe" "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta"
                      4⤵
                        PID:13088
                    • C:\Users\Admin\Desktop\00393\HEUR-Trojan-Ransom.Win32.Encoder.gen-b5941db3b04e8ddfbc5b8f52a12862e8203a54eda666b6ad685b566b0b1faba4.exe
                      HEUR-Trojan-Ransom.Win32.Encoder.gen-b5941db3b04e8ddfbc5b8f52a12862e8203a54eda666b6ad685b566b0b1faba4.exe
                      3⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:2028
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\game.bat" "
                        4⤵
                        • System Location Discovery: System Language Discovery
                        • Suspicious use of WriteProcessMemory
                        PID:3628
                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\VirtualNES.exe
                          VirtualNES.exe Adventure Island 3.nes
                          5⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of SetWindowsHookEx
                          PID:2672
                    • C:\Users\Admin\Desktop\00393\HEUR-Trojan-Ransom.Win32.GandCrypt.gen-7e111ee1fed7c4739c4fd3a8ca32a4d44a6714ee26708449e9312da254747166.exe
                      HEUR-Trojan-Ransom.Win32.GandCrypt.gen-7e111ee1fed7c4739c4fd3a8ca32a4d44a6714ee26708449e9312da254747166.exe
                      3⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:3160
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 480
                        4⤵
                        • Program crash
                        PID:3664
                    • C:\Users\Admin\Desktop\00393\HEUR-Trojan-Ransom.Win32.Generic-1164f88212d87ff034707797c82c6d59a9f17f72bb641cf7dc83771e2c599074.exe
                      HEUR-Trojan-Ransom.Win32.Generic-1164f88212d87ff034707797c82c6d59a9f17f72bb641cf7dc83771e2c599074.exe
                      3⤵
                      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                      • Checks BIOS information in registry
                      • Executes dropped EXE
                      • Identifies Wine through registry keys
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1904
                    • C:\Users\Admin\Desktop\00393\HEUR-Trojan-Ransom.Win32.Stop.gen-65b988f2abe4047f8940e2e98131e8d9b7eda217afca673ed99fd9adb6ab1008.exe
                      HEUR-Trojan-Ransom.Win32.Stop.gen-65b988f2abe4047f8940e2e98131e8d9b7eda217afca673ed99fd9adb6ab1008.exe
                      3⤵
                      • Executes dropped EXE
                      • System Location Discovery: System Language Discovery
                      PID:4172
                      • C:\Windows\SysWOW64\icacls.exe
                        icacls "C:\Users\Admin\AppData\Local\0b1ef4c2-f2de-4270-8962-6183cb1c9d12" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                        4⤵
                        • Modifies file permissions
                        PID:6944
                      • C:\Users\Admin\Desktop\00393\HEUR-Trojan-Ransom.Win32.Stop.gen-65b988f2abe4047f8940e2e98131e8d9b7eda217afca673ed99fd9adb6ab1008.exe
                        "C:\Users\Admin\Desktop\00393\HEUR-Trojan-Ransom.Win32.Stop.gen-65b988f2abe4047f8940e2e98131e8d9b7eda217afca673ed99fd9adb6ab1008.exe" --Admin IsNotAutoStart IsNotTask
                        4⤵
                          PID:7340
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 2080
                          4⤵
                          • Program crash
                          PID:5180
                      • C:\Users\Admin\Desktop\00393\Trojan-Ransom.Win32.Blocker.mqac-e39883848200cdeaadf1630d957ee7604f42828de65d754379d186767cc96318.exe
                        Trojan-Ransom.Win32.Blocker.mqac-e39883848200cdeaadf1630d957ee7604f42828de65d754379d186767cc96318.exe
                        3⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • System Location Discovery: System Language Discovery
                        PID:3552
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 1216
                          4⤵
                          • Program crash
                          PID:2828
                      • C:\Users\Admin\Desktop\00393\Trojan-Ransom.Win32.Cryptor.drf-3ec819dfd426552acf4f0aa813135aec8a53a6f9d0883cd91de949990a18128d.exe
                        Trojan-Ransom.Win32.Cryptor.drf-3ec819dfd426552acf4f0aa813135aec8a53a6f9d0883cd91de949990a18128d.exe
                        3⤵
                        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                        • Checks BIOS information in registry
                        • Executes dropped EXE
                        • Identifies Wine through registry keys
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • System Location Discovery: System Language Discovery
                        • Checks processor information in registry
                        PID:1332
                      • C:\Users\Admin\Desktop\00393\Trojan-Ransom.Win32.Encoder.kgw-7bf88c29a699bee4f5820fc4c575bd326845e25523c62db03efa80d253261fab.exe
                        Trojan-Ransom.Win32.Encoder.kgw-7bf88c29a699bee4f5820fc4c575bd326845e25523c62db03efa80d253261fab.exe
                        3⤵
                          PID:5256
                        • C:\Users\Admin\Desktop\00393\Trojan-Ransom.Win32.Gen.yjd-931dff77886dfdc1de5850939c4947eb0f84ff73fde56cb5eed8882334865097.exe
                          Trojan-Ransom.Win32.Gen.yjd-931dff77886dfdc1de5850939c4947eb0f84ff73fde56cb5eed8882334865097.exe
                          3⤵
                            PID:5240
                          • C:\Users\Admin\Desktop\00393\Trojan-Ransom.Win32.Phpw.zg-dc4c72b5c43cf93b2be3a7b490f54758174fe4af15f9d9d470723079ec8814cb.exe
                            Trojan-Ransom.Win32.Phpw.zg-dc4c72b5c43cf93b2be3a7b490f54758174fe4af15f9d9d470723079ec8814cb.exe
                            3⤵
                              PID:7508
                            • C:\Users\Admin\Desktop\00393\Trojan-Ransom.Win32.PornoAsset.dagf-41761a8269465f9922a9a7a13f159a6c3091433d5891b49c839bcf286c85bafe.exe
                              Trojan-Ransom.Win32.PornoAsset.dagf-41761a8269465f9922a9a7a13f159a6c3091433d5891b49c839bcf286c85bafe.exe
                              3⤵
                                PID:7532
                              • C:\Users\Admin\Desktop\00393\Trojan-Ransom.Win32.Rector.vju-7b3b61a8297a4e42545649365420ed6782a9b07db2faf991c574a2247652f3e5.exe
                                Trojan-Ransom.Win32.Rector.vju-7b3b61a8297a4e42545649365420ed6782a9b07db2faf991c574a2247652f3e5.exe
                                3⤵
                                  PID:6388
                                  • C:\Users\Admin\Desktop\00393\Trojan-Ransom.Win32.Rector.vju-7b3b61a8297a4e42545649365420ed6782a9b07db2faf991c574a2247652f3e5.exe
                                    Trojan-Ransom.Win32.Rector.vju-7b3b61a8297a4e42545649365420ed6782a9b07db2faf991c574a2247652f3e5.exe
                                    4⤵
                                      PID:5800
                                  • C:\Users\Admin\Desktop\00393\VHO-Trojan-Ransom.Win32.Convagent.gen-fd0db123c10a3750ea976ca7fc91a84679f1dda151e756a181b70f033ac33b7d.exe
                                    VHO-Trojan-Ransom.Win32.Convagent.gen-fd0db123c10a3750ea976ca7fc91a84679f1dda151e756a181b70f033ac33b7d.exe
                                    3⤵
                                      PID:5816
                                    • C:\Users\Admin\Desktop\00393\VHO-Trojan-Ransom.Win32.Cryptor.gen-ea08290069cbe60107293e4275d5e1970f178177495bdd433cf50d69c1f4d99b.exe
                                      VHO-Trojan-Ransom.Win32.Cryptor.gen-ea08290069cbe60107293e4275d5e1970f178177495bdd433cf50d69c1f4d99b.exe
                                      3⤵
                                        PID:5456
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3160 -ip 3160
                                    1⤵
                                      PID:4220
                                    • C:\Windows\system32\AUDIODG.EXE
                                      C:\Windows\system32\AUDIODG.EXE 0x2ec 0x4e0
                                      1⤵
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1632
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 3552 -ip 3552
                                      1⤵
                                        PID:5084
                                      • \??\c:\windows\system32\calc.exe
                                        c:\windows\system32\calc.exe
                                        1⤵
                                          PID:5192
                                        • C:\Windows\system32\vssvc.exe
                                          C:\Windows\system32\vssvc.exe
                                          1⤵
                                            PID:6800
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4172 -ip 4172
                                            1⤵
                                              PID:6600

                                            Network

                                            MITRE ATT&CK Enterprise v15

                                            Reconnaissance

                                            Resource Development

                                            Initial Access

                                            Execution

                                            Windows Management Instrumentation

                                            1
                                            T1047

                                            Persistence

                                            Boot or Logon Autostart Execution

                                            1
                                            T1547

                                            Registry Run Keys / Startup Folder

                                            1
                                            T1547.001

                                            Privilege Escalation

                                            Boot or Logon Autostart Execution

                                            1
                                            T1547

                                            Registry Run Keys / Startup Folder

                                            1
                                            T1547.001

                                            Defense Evasion

                                            Direct Volume Access

                                            1
                                            T1006

                                            File and Directory Permissions Modification

                                            1
                                            T1222

                                            Indicator Removal

                                            2
                                            T1070

                                            File Deletion

                                            2
                                            T1070.004

                                            Modify Registry

                                            1
                                            T1112

                                            Virtualization/Sandbox Evasion

                                            2
                                            T1497

                                            Credential Access

                                            Credentials from Password Stores

                                            1
                                            T1555

                                            Credentials from Web Browsers

                                            1
                                            T1555.003

                                            Unsecured Credentials

                                            1
                                            T1552

                                            Credentials In Files

                                            1
                                            T1552.001

                                            Discovery

                                            Peripheral Device Discovery

                                            1
                                            T1120

                                            Query Registry

                                            6
                                            T1012

                                            System Information Discovery

                                            5
                                            T1082

                                            System Location Discovery

                                            1
                                            T1614

                                            System Language Discovery

                                            1
                                            T1614.001

                                            Virtualization/Sandbox Evasion

                                            2
                                            T1497

                                            Lateral Movement

                                            Collection

                                            Data from Local System

                                            1
                                            T1005

                                            Command and Control

                                            Web Service

                                            1
                                            T1102

                                            Exfiltration

                                            Impact

                                            Inhibit System Recovery

                                            2
                                            T1490

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems32.dll.id-7AC1849B.[telegram_@spacedatax].ROGER
                                              Filesize

                                              2.7MB

                                              MD5

                                              2b2bce9a33b6253520de39e399bdb3c0

                                              SHA1

                                              36782f7592e36d47a9d2ac3f5bd8b586b86c7a7b

                                              SHA256

                                              6526204f3844661aaa8a568218e127eab87e57e83b38c2739e1c64a4f25cdaf4

                                              SHA512

                                              b2a6ef89fa076c45acd2983a092c32fabc833ad91368c9a34fecc54714355ca16ff80a4b4ae42313ac82dc2c4ea6627e2b959f65f7669b91c91c5cd8e54d1b67

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
                                              Filesize

                                              64KB

                                              MD5

                                              d2fb266b97caff2086bf0fa74eddb6b2

                                              SHA1

                                              2f0061ce9c51b5b4fbab76b37fc6a540be7f805d

                                              SHA256

                                              b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a

                                              SHA512

                                              c3ba95a538c1d266beb83334af755c34ce642a4178ab0f2e5f7822fd6821d3b68862a8b58f167a9294e6d913b08c1054a69b5d7aec2efdb3cf9796ed84de21a8

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                              Filesize

                                              4B

                                              MD5

                                              f49655f856acb8884cc0ace29216f511

                                              SHA1

                                              cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                              SHA256

                                              7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                              SHA512

                                              599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
                                              Filesize

                                              944B

                                              MD5

                                              6bd369f7c74a28194c991ed1404da30f

                                              SHA1

                                              0f8e3f8ab822c9374409fe399b6bfe5d68cbd643

                                              SHA256

                                              878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d

                                              SHA512

                                              8fc5f073dc9fa1e1ae47c60a5f06e0a48709fd6a4302dffaa721858409e7bde64bc6856d3fb28891090516d1a7afc542579de287778b5755eafe75cc67d45d93

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Adventure Island 3.nes
                                              Filesize

                                              256KB

                                              MD5

                                              cb461ebe2ca2c9f6e89b9502abaf648e

                                              SHA1

                                              6463127b4c9c31e6a0f5a068b6f283a9f03dd5e9

                                              SHA256

                                              63741ae44731d285cd1fc499178b64e960e64d7f1445f41ddc76bb5b71bd1899

                                              SHA512

                                              73d03931ad368142cdfc3242278373cd2e805b35edacef88a7da41158dedbdf1a2f3a1da327cdcc6358a6d67929cdb07277175890f90eea7ac73db4387e16109

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Archivos\TecnologiaForever© 2018.txt
                                              Filesize

                                              7KB

                                              MD5

                                              5790a1ba99f4b7f0831fb01ca63d338a

                                              SHA1

                                              51e7ca923d496ea365b30c81c1058214d4855e64

                                              SHA256

                                              1ddc8308be1a149047cf8cab3ef1efbe6ca9178e832a86d72ac34c577f633514

                                              SHA512

                                              a9386f59f053db2bd533a2bf4498c22c5fb245b731ef2471919f831996c32d5de928600a310736e4302a42594f5a97e56e3520ce05a1c400a85c69f7b519ba2c

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Archivos\»ClicHere«.vbs
                                              Filesize

                                              1KB

                                              MD5

                                              e3b99c2952bf3ba87d2af70d5ce51f30

                                              SHA1

                                              82973f951aa6208584bf6cb5d0874d4c49ddec71

                                              SHA256

                                              2c3bc42104e19657f93ddb265ed370a80330ab21cad4662018e6739971f5bb7a

                                              SHA512

                                              9f7427f39fed591aa35d34e3b8d62c74c984ba96ef09a2873e30b16807cbcb11a333912684f49ef6e99327372cb1b99fcd2ae9ddd74b1ef782de374291846b86

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Archivos\â• $_DONACION_$â•£.vbs
                                              Filesize

                                              495B

                                              MD5

                                              9ae0142a83ec040f96ecaba1c16b65e5

                                              SHA1

                                              183282d929bddbcaa901756f20de27d0950ef088

                                              SHA256

                                              3f11775157365025f50aa1fd8d9e9bf5e566fe1427ac1fd0a196d689652075d9

                                              SHA512

                                              0685c8bfb628115c021437a9e3eac77f01c4d593201656025d63110bd9e7f1324e4d25b7de13f85dc2f924847526b0e4f96903450d02e12f6bd01e0fe86dd9b6

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\CheatCode\Castlevania (E).gen
                                              Filesize

                                              163B

                                              MD5

                                              52a28809e0a6b6ed3954fb31bccecec1

                                              SHA1

                                              cf7fcf02252e449477fc55b1e8b1459c988a90fc

                                              SHA256

                                              b20ee28d84754a7b2be177b6142265dd32a2b7aeb37555117c928e4c03edf677

                                              SHA512

                                              aa1a87f7953a1c7953ba01e9277765b050c71e27844860e26a16984694d44dcf1187a0309d47b92d7e8ab1d0e8d6514442c5bebde067ceeac35806b6cfc30c44

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\CheatCode\SpartanX.vct
                                              Filesize

                                              156B

                                              MD5

                                              2cc5ec1bbe2a92a34848a51c11704832

                                              SHA1

                                              9a2a08a1df224351a6dde1c1bf14bab21f056018

                                              SHA256

                                              546bfbecfa8d8cb4a5aa4b59180230667ebd95affeef6f2b9368d0c8908d704e

                                              SHA512

                                              9fbe4556942b22f6910e5c058a2f8db4ea1dcea7b44b4b17dee5f72ca1933a11389042f7b9d5a2eb953935edf66e3441f3664e52d35a60e0eef194f889b35088

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\CheatCode\Super Mario Bros (E).gen
                                              Filesize

                                              185B

                                              MD5

                                              08b694b9208b5249e0486f0988843d07

                                              SHA1

                                              7c0ec2c413850f306d2ff0d17733ab3725914178

                                              SHA256

                                              1226be6fe6dd71e209cb369cb2f150ec352fc30a4b6affc690e0920bff81bde9

                                              SHA512

                                              311f3730ffbd053a91ab22e480b2ba98d9aae9c4932f4405f092d45344a9ef19ac8e5be11fb86cf5b09a07d555278af740d0075a1f0314984094565b2148669a

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Doc\AVIconv_E.txt
                                              Filesize

                                              2KB

                                              MD5

                                              3f3b8a712502de3e35f49351048a25d0

                                              SHA1

                                              8e02ee34acacfae1088892e5993802861079e3ca

                                              SHA256

                                              c9c3a54ad3cb6e2b28acccb8f93d9e1d35f91c7860a11a48800119cf2a93b659

                                              SHA512

                                              e7cac7427f384c28dbc89ad9551e89c4043dc77040bea4d6de990bf52ea245b35fa4e9dad252e73757689c4838f7a29e86b0e75618c989bfcde1492882d32e63

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Doc\Cheat_E.txt
                                              Filesize

                                              2KB

                                              MD5

                                              3c9f6a28f7171845ed57d00d6a62abd4

                                              SHA1

                                              947d18112bfb801dc3cd48ebb6979dd6856a2594

                                              SHA256

                                              ede4768f9552741d3f58f73346b06df84a191567104fcbfc4bf87210573b05ff

                                              SHA512

                                              984c301b843c7701819ea3030039da5dbde63d55765f6052d5fdf5c2caa178601bb2193dde87d9028c51d504f21de5ebe044ebf7cc6c06600a23596ea56d1dab

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Doc\ExtSound_E.txt
                                              Filesize

                                              2KB

                                              MD5

                                              4a7a75434136c74671b876215aafc5f3

                                              SHA1

                                              2cd9d9557a6a6f6ece0106bc42bde9480eb8a5df

                                              SHA256

                                              fa7793ea2b2f18d9f721d47fd26ec2a9badd06bcef1abcc46b4ade0b9f1d5f66

                                              SHA512

                                              31bb9b54414a4014ef423cb7915e287a4a774d1d34bae2a7361e89cce17aff9e30199cf953f0f8a2e2f180915a2421f73b4534a77462271442841eb6e5bd86e0

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Doc\History_E.txt
                                              Filesize

                                              48KB

                                              MD5

                                              3ccb04331a9d9261f0d333093962ea28

                                              SHA1

                                              8803fc291c82058a55d68965c229e67dd24a53dc

                                              SHA256

                                              ce87248a960bbd8c35f1d3f3a7db8220083eb537ebbc58f8cc9148f2ce696be3

                                              SHA512

                                              dc0996b2b796ca25dfcb498bd1f5f54c608e830e355caa2558906bcb02c736c0e0c8d0ae61feae9697d1ea4d7498398d21a1e867e2ba6652f2a6540e41c2a7ed

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Doc\Mappers.txt
                                              Filesize

                                              3KB

                                              MD5

                                              823cd2ae1e4ac8ac2bb280f9ccad3d25

                                              SHA1

                                              2dc730c94410997b8c57474310d480bf27deef50

                                              SHA256

                                              7efcfd0fa6b595ac370b14a24a7fa34b7f72b1ad491fbb72a1ea67134e79718d

                                              SHA512

                                              e2746df27a86d9bca332daa9630161f8f3b76a9c33c48a87af9523f880bb35d81911eb1e63f383c68d79c977dc4c97ac9807dcd7f12ed6dbe4d4d7f51ea78b62

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Doc\NetPlay_E.txt
                                              Filesize

                                              7KB

                                              MD5

                                              e95ea10b40e1c449685a42e26aa791e6

                                              SHA1

                                              bdffbd986f7a13c76f81c2940cced5d85983a5f7

                                              SHA256

                                              0c4b75d10a823a89c45db705048c84920464115c0619608aea873ad512f34a45

                                              SHA512

                                              4793e154e13425650699ba6ddd0dc94309a230bc2793360c44751199edf601e480aa6ec52a9de57e792cd187b2af69f9f06f0961336126f402fd22137c6b75a8

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Doc\Readme_E.txt
                                              Filesize

                                              36KB

                                              MD5

                                              de4fb5fd5521d596fcf39dc22608c544

                                              SHA1

                                              69449d49823d8ffd90559bc2df79839719ca5a21

                                              SHA256

                                              9838e3207d227d71b3eb13317ae19ada6a1f487fbc1283c00b9ea570d33a4bc7

                                              SHA512

                                              a88ba8fc6ab22f7a266a84370c18ed96108ff0734bd29b4a6d0081065f4c72f5530c41329bbee0ee50a8c350a892536d26d1ca3f76de76fdc4b8abd3d7983f82

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\English.vlp
                                              Filesize

                                              72KB

                                              MD5

                                              2c8aea8253301911c5d3972fdbe253b9

                                              SHA1

                                              baac1a411ddc736392feefad97903f0cafa44f00

                                              SHA256

                                              7a3f0ac7aa2b277de15eb935162c0ef096c157468e79c42ce94736289c7a7c39

                                              SHA512

                                              1decde58f5bdd4a9a4b0b910283a2968c586e6ee7a8f759eb93eb0915323b5c1c48bf7c380e275c34f7df28c30ee8588d94db16d98b8d8fe93d600343156b67d

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\VirtuaNES.ini
                                              Filesize

                                              9KB

                                              MD5

                                              0d2170d18c07b87b9d471c99b454c7d0

                                              SHA1

                                              6648b10cbb22426d1a27627dc6314ed764c84160

                                              SHA256

                                              fb319571e7e12fdbbd9dabb5dd8460ab18f0dfc6a98ccc403f4eeb750240bb6e

                                              SHA512

                                              a39a2b031fc2ee76386320b8126ee8e463a125fc854cee48c5e46229ba91e37031fe286a493fd33cba88ecf8c4efbead54258d538891ba257cab4862268c5e8a

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\VirtualNES.exe
                                              Filesize

                                              744KB

                                              MD5

                                              f9c7c80681ac40d1836c8ec1bf59dc24

                                              SHA1

                                              25fa98ae13be80b9f7c996b10adbca9232a73b92

                                              SHA256

                                              8039687a5274b46763677deb477d00b22466824d93d52db1306efaf05aa80f20

                                              SHA512

                                              cc4e0a68b3a29a2fb9b9c29a5bf1aca6fc85684ff5b5b83dd2fcaebe02863b6eb47891d0b817721ebe9c0c2e896bb008da663d7a0401604e75a256d4f176309a

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\game.bat
                                              Filesize

                                              37B

                                              MD5

                                              52280031a0d63a26de344b293a64ace3

                                              SHA1

                                              c9a33575c01b7904f5bab228d0597da4fe5c4ef6

                                              SHA256

                                              fb1c1bb62f5f11824c306bc6d70798ed4c73b954e9d898e73e422c6fd86c3adb

                                              SHA512

                                              c5a3cc523c8657dd274296c4d0573d69d0d3a44ccc283677074626818dbc09b6551d5f577a65c9fe61c99485c27af1a694860ba2305f7c4bd415e9377de56a26

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\state\Addams_family.st0
                                              Filesize

                                              16KB

                                              MD5

                                              6ab94fff31e28752ff225f5c83bb2123

                                              SHA1

                                              7d2b9fde60fd026156eb2a646408773d33faef3c

                                              SHA256

                                              61c192e6d7e5067217c3fc16d818a8410d30a85be2f358b2b3add28767eced00

                                              SHA512

                                              9bde2127ddc3d75db8a221459fca7dac569bbb106b6b6ac28943e138a36001d415d9b25d2959b33e43968489a3ec12e1d6500ea47ca27c483fea58965af72348

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\state\Adventure Island 2.st0
                                              Filesize

                                              16KB

                                              MD5

                                              028e5eb1baaf933e011207339d409d71

                                              SHA1

                                              c3060c985a0f3a2c929f34ff127c4183b32bc2f5

                                              SHA256

                                              d9dd572fe8c864bcb39112e8c856d20cd2c7d99756dcbde240d4832759dc93cf

                                              SHA512

                                              4fea2162260881446bed4aba492ff2415301ec0213bb492db426b6f11b905a93c67ca566f10640c9a0412c8d5fce06e3351d8d5aefeac8a6c4020a6725bee967

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\state\Tennis.st0
                                              Filesize

                                              16KB

                                              MD5

                                              ecbdd402bd08435285064c0639086551

                                              SHA1

                                              0095d824084f3be410505fadc7156355ecd4816f

                                              SHA256

                                              87cde38f8c6f640f596e87e50a99193ecae0477f40311d83e0f152ed6bb0de25

                                              SHA512

                                              6b2dea67fe103d93bc8f3f1ca4503843053e1ebdc328b80bf37604426b84c262403bc04fad159acdcf6da02bfc3af65d9468b0aa64c5e605f799f200b67fa949

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\state\Theflintstones.st0
                                              Filesize

                                              16KB

                                              MD5

                                              70a0d4bd4bc1d9766d4faed9f0fb12b1

                                              SHA1

                                              f88e7e5f5c7c994062a5421f3bac4d1e1b87ef99

                                              SHA256

                                              2a8bd388bdd56c123c137ce6ff65f3d16d930834052ecba0b7eba1f3b68da110

                                              SHA512

                                              bff6431257772f45bdba7da80bd2a15a2e5a95121efffeafbed4ff93854d87bcec331f8f00b4f2861f2294a574441ca370de8cf8d07d780b093998ae8a4f09e1

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\state\Trojan.st0
                                              Filesize

                                              24KB

                                              MD5

                                              2965c0074004097bbe93842fcf6e2357

                                              SHA1

                                              4a53d7947eff5de82e3a4361cce3c9664784333e

                                              SHA256

                                              1920931d425b51e04d02f66176e4de70d288c75a08426a8c8e9f4adbf5b8e444

                                              SHA512

                                              826d6806834fd0cf87aaab0042c620715d47497a50ef4ef83b253add20ad6726c312c2872c06591ac184728ff2c617673364cbea9cf7f3747364a22596bb59b5

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n2n0xfci.qxi.ps1
                                              Filesize

                                              60B

                                              MD5

                                              d17fe0a3f47be24a6453e9ef58c94641

                                              SHA1

                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                              SHA256

                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                              SHA512

                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\i0AeJEy\Pa4R0Sej5t5IKH.zip
                                              Filesize

                                              69KB

                                              MD5

                                              324f1dcce63f31ba271f261543bbf569

                                              SHA1

                                              9fea99622314abd49b677acb0633741ecc763209

                                              SHA256

                                              61b3200767b96493a4101dbc9966519b95d14fcafb66d239c3a9409cc3f8c59d

                                              SHA512

                                              da4ca9616573cc59521417600a7c0fe1bba1a84a349dae1470b0a2057411236a3d03f4b19fbf357f3aa29a509c8ece584d86b0ae2c5484a0e2100865276f09fa

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\i0AeJEy\_Files\_Information.txt
                                              Filesize

                                              7KB

                                              MD5

                                              66cd43b11eb7385dbcf1ced416035e12

                                              SHA1

                                              687097f01e3c65f7af833433fe7854ca10e7496b

                                              SHA256

                                              f74624be00c9993f17013e3d89ee0861763a9f13b7c41e4d625d0d31767a3552

                                              SHA512

                                              1f0b8693ea2b3d68f3617e01fd1d5bd600b740457e4c5891517d5958679c29b5c122a958a1e032c5bdff925b4696754b2fd5f167085c4f5c63bd346461cc235b

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\i0AeJEy\_Files\_Screen_Desktop.jpeg
                                              Filesize

                                              81KB

                                              MD5

                                              b97396afcff7eb4f14746e804802b968

                                              SHA1

                                              415796a87bb2ae7c1c3d084872c05f6f6f6b8a02

                                              SHA256

                                              472690fec1ad6b6542cc7397fb8b8c99da8acf41b2a85527926c13ce40875785

                                              SHA512

                                              c9cfdef4f6d23477e08e797b05f5e45b737195bc61d13404689819697ba5150c5f2416670fb035a07ca37c4b6fc849c9c5f96fb632430a9bf6fc1ee7071d363c

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\i0AeJEy\files_\system_info.txt
                                              Filesize

                                              8KB

                                              MD5

                                              e894240462464601fa70efd347dd8ec4

                                              SHA1

                                              b2f33083e004552ea65d8aef21f204b1bede95b7

                                              SHA256

                                              b06e0287485743915973e8f2c613a3374a8ef269fdd6cedbbbc7c51c93b8c31e

                                              SHA512

                                              b037d0529c98527526ecad2add333f2ef566b91a1c9a06e46b86e15fe830d4504b873d5d9337cb560ef6765c59099022ad441959b32198a492c96a66c2aab0e4

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\zbhnd.exe
                                              Filesize

                                              72KB

                                              MD5

                                              cf424dd2eeb5e11885fc835447703a87

                                              SHA1

                                              9c38f63027d2b65a4c51d9fbfbcb338e3cf1168a

                                              SHA256

                                              3dbe6c9df5a248a339f4e3905d8166ccdb14a4189580ebd575a8adb6e9ed41b8

                                              SHA512

                                              bc664e447f536d0695ea2f8c9e9bae56f9b5bee5249b0f4f5a100d455e0dd3ced0fab5dfde1f81c3ea2a0f06a604ed190f7c89162fa3f18bc9587f6a96013726

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\{04630BCA-6F24-4525-88BA-8F467DFBDD37}.png.Nibiru
                                              Filesize

                                              2KB

                                              MD5

                                              719b78b93398493eaa400fcaa020b6ba

                                              SHA1

                                              20a53fe647f8af72cbbcabf7ee61c23ef411504e

                                              SHA256

                                              b8ad46d1518283273af57e513efdd282948db43be3df9aa269afe07bd8c10ac1

                                              SHA512

                                              19aca20b53bc9cf72dae20375d5434800ae35e2c174c816d7bd76b2c7ee599a432d5aa31002fb238f9d56fea3e6ad54e276fb9fd68e718b2305d076913dcd13a

                                              Download Submit

                                            • C:\Users\Admin\AppData\Local\Temp\{0E320A65-72A8-40FC-8BE8-22E5621BCA25}.png.Nibiru
                                              Filesize

                                              16B

                                              MD5

                                              cabbd6e4945771eb211ea3b4704c3b46

                                              SHA1

                                              3d1ccf3ed2e7165c52e9d50679f340445051ee68

                                              SHA256

                                              161721f9e825da030de98130a7267418b7fc7fb2f0aadae7dc0c9b25a8bed7e3

                                              SHA512

                                              fd8a43967b028f9fcbc94cd8072ca4cec1c32e9e5e0816d789e2158e4ed62d907b9b269cf098141fb5c681880e931bc011cb9e1439beff90505945904756f11c

                                              Download Submit

                                            • C:\Users\Admin\AppData\Roaming\ServicesHost.exe
                                              Filesize

                                              30.6MB

                                              MD5

                                              1621135ac03ec0f180d778e0660f8e67

                                              SHA1

                                              94c946b8b35e8e7d2415389a682536d45f8f8c20

                                              SHA256

                                              f7a4780d710f7b4efca968eca506ba992d383f04d881bee8b97fc66579be7154

                                              SHA512

                                              06edc845e6d362ca66ab9bd28763da34ce83d538c131ba0f3e4f45b2edb046572f20dc3a9e0f249b09fdafaf754948e3bd45be005a9c778e0c84e56073f559e8

                                              Download Submit

                                            • C:\Users\Admin\Desktop\00393\HEUR-Trojan-Ransom.MSIL.Blocker.gen-309d2137aeb704f62360370cadceb1812d81790f23399ca9f229e88d94971fb6.exe
                                              Filesize

                                              29.8MB

                                              MD5

                                              2ec04fe14b2eedc4892fa22510e9ca86

                                              SHA1

                                              db78e8932611fba70fb0467c89be6ff451850709

                                              SHA256

                                              309d2137aeb704f62360370cadceb1812d81790f23399ca9f229e88d94971fb6

                                              SHA512

                                              a5a8aea88575ece2f8765dcfc08c82e42a3ea0a7b52136b60cd6bb533634efa5be431fadcbdd455a8dbe1c2d73074199ca3a7ad48302bcae1bcc185d983f6079

                                              Download Submit

                                            • C:\Users\Admin\Desktop\00393\HEUR-Trojan-Ransom.MSIL.Encoder.gen-e0a681902f4f331582670e535a7d1eb3d6eff18d3fbed3ffd2433f898219576f.exe
                                              Filesize

                                              121KB

                                              MD5

                                              49d9d587a88074016a2042bdb42b9441

                                              SHA1

                                              5659837b54f1c48318025051c8541aa915b80aac

                                              SHA256

                                              e0a681902f4f331582670e535a7d1eb3d6eff18d3fbed3ffd2433f898219576f

                                              SHA512

                                              ad8a1f71eeea4dea8073886563191bce9aff27a5c0f28e1f23362787f8a759635996a0434d73792351f30bcbfbe17c455aa4774ff366cc6a79e18c7fc7e3c65d

                                              Download Submit

                                            • C:\Users\Admin\Desktop\00393\HEUR-Trojan-Ransom.MSIL.Gen.gen-f3645997b7c66390311eec5630208e5a4e9df7cc6e8cc6b0ecbd988605eef499.exe
                                              Filesize

                                              720KB

                                              MD5

                                              05225e6bf88496f42871145c68a56b76

                                              SHA1

                                              342bda75db80a8ca5b915612944a417f562792e2

                                              SHA256

                                              f3645997b7c66390311eec5630208e5a4e9df7cc6e8cc6b0ecbd988605eef499

                                              SHA512

                                              3f6bc3b746c1b00d1a279249dff82c07c63a30cd8a8abd1ab4d06742d7edbf6b7c875cb9e5ba2a48f64358b96a900d3467023a77f8eaa0f35cf328d256f759f4

                                              Download Submit

                                            • C:\Users\Admin\Desktop\00393\HEUR-Trojan-Ransom.Win32.Blocker.pef-240e1573bc56a760ce9e5ba36c43e94d573c464ac3ce50b4400a1d4ba43f2404.exe
                                              Filesize

                                              72KB

                                              MD5

                                              6e2f1bf0fb99dd0d683f8e9b54bff2d3

                                              SHA1

                                              33d1451d30864dc3bd7332a05d808263e346a7b1

                                              SHA256

                                              240e1573bc56a760ce9e5ba36c43e94d573c464ac3ce50b4400a1d4ba43f2404

                                              SHA512

                                              d43ac718ebaf32864f01c0b2485b12b63c8a444ee969afd97273585372f03b33aefd1bae52cf402d25446c3f5f27652df6f75a863356e2c0e116e745988cd82a

                                              Download Submit

                                            • C:\Users\Admin\Desktop\00393\HEUR-Trojan-Ransom.Win32.Crypren.gen-87be242c76c959d2f30288245e2221856f667d918a306b100046f9264146dc19.exe
                                              Filesize

                                              180KB

                                              MD5

                                              ea59aebcc5588a41fdb9929349bf74af

                                              SHA1

                                              ddb409120441833252210b193785a15fbd381c5e

                                              SHA256

                                              87be242c76c959d2f30288245e2221856f667d918a306b100046f9264146dc19

                                              SHA512

                                              67e9c412db7c7aac590312f6407b1a7f6dac697b0325aed5c8501d033d8b866aa839c9720e60f38a85e409f8d99857004e615e91e04dca919919aaf35ac52232

                                              Download Submit

                                            • C:\Users\Admin\Desktop\00393\HEUR-Trojan-Ransom.Win32.Encoder.gen-b5941db3b04e8ddfbc5b8f52a12862e8203a54eda666b6ad685b566b0b1faba4.exe
                                              Filesize

                                              976KB

                                              MD5

                                              f3699b7b1bab29788fa470cd38c4c70e

                                              SHA1

                                              563eb07031dd1d697d6ff932904c0930ca6ce5f9

                                              SHA256

                                              b5941db3b04e8ddfbc5b8f52a12862e8203a54eda666b6ad685b566b0b1faba4

                                              SHA512

                                              eb30d1d66788681d7d2bad7af50c0695460e6571a99c023d2424cfd5410de7ab7fda386d2551bb2314c0abebcc97a0b084345db7ab01077558deaf861a8180c2

                                              Download Submit

                                            • C:\Users\Admin\Desktop\00393\HEUR-Trojan-Ransom.Win32.GandCrypt.gen-7e111ee1fed7c4739c4fd3a8ca32a4d44a6714ee26708449e9312da254747166.exe
                                              Filesize

                                              321KB

                                              MD5

                                              0bd62253820fab9473c9ca96d17c3bf8

                                              SHA1

                                              9605fd973b67fba2cbc71a044eb14fa95d1b481e

                                              SHA256

                                              7e111ee1fed7c4739c4fd3a8ca32a4d44a6714ee26708449e9312da254747166

                                              SHA512

                                              e8a307c20a5120feaedb35a68ad3d3e42544ec078e50cc465c2d46a737cf511f38a6af28d3d52ca7dc9805a0c010d1d4b463e5b55ea9de1280f137ad3904a457

                                              Download Submit

                                            • C:\Users\Admin\Desktop\00393\HEUR-Trojan-Ransom.Win32.Stop.gen-65b988f2abe4047f8940e2e98131e8d9b7eda217afca673ed99fd9adb6ab1008.exe
                                              Filesize

                                              687KB

                                              MD5

                                              7cfc5575759906a2de75c972578d9204

                                              SHA1

                                              b911a17da3c8ce87fdc3bc1c2caca9d3439b7202

                                              SHA256

                                              65b988f2abe4047f8940e2e98131e8d9b7eda217afca673ed99fd9adb6ab1008

                                              SHA512

                                              a21cb93ed920a7bfd8d860e0ef93cfab7bc3079c69d095b15affc75e636823e94c163dd0c3981dc48ac5d13b0161ff87794853ecbca6ed59bea2889d8d9c0540

                                              Download Submit

                                            • C:\Users\Admin\Desktop\00393\Trojan-Ransom.Win32.Blocker.mqac-e39883848200cdeaadf1630d957ee7604f42828de65d754379d186767cc96318.exe
                                              Filesize

                                              5.0MB

                                              MD5

                                              b5d58a934ba2c208dcfce8c7e1b50591

                                              SHA1

                                              b62934882c9b19519cc74fc713f59b3eb8977a75

                                              SHA256

                                              e39883848200cdeaadf1630d957ee7604f42828de65d754379d186767cc96318

                                              SHA512

                                              82a347b9db4a7300a4af43455171fd15e6a6c4afd255f1de05bad308a4957595dd805bdf42d81be5d99ae62ab126957824dd682c4e0b8fa6e7ef238fc9f79d1a

                                              Download Submit

                                            • C:\Users\Admin\Desktop\00393\Trojan-Ransom.Win32.Cryptor.drf-3ec819dfd426552acf4f0aa813135aec8a53a6f9d0883cd91de949990a18128d.exe
                                              Filesize

                                              2.2MB

                                              MD5

                                              20e58b35ab2282c5862c3cc33c467943

                                              SHA1

                                              8fb41048f0195abd4a65fdfcec6b40639a80e113

                                              SHA256

                                              3ec819dfd426552acf4f0aa813135aec8a53a6f9d0883cd91de949990a18128d

                                              SHA512

                                              3e4469d3ed20705dcbd1ed4b0059ca54dcb68f9d93a37cd0e37223bc83ba1ebf764c65c7dce8aa397188fdaa58cd39d40624d3aa94e54aa3b8c424b71aaf5dcc

                                              Download Submit

                                            • C:\Users\Admin\Desktop\00393\Trojan-Ransom.Win32.Encoder.kgw-7bf88c29a699bee4f5820fc4c575bd326845e25523c62db03efa80d253261fab.exe
                                              Filesize

                                              2.9MB

                                              MD5

                                              5f8ba9ef3c2d07bbf28b0f280635e78f

                                              SHA1

                                              36322b3ecc6b1dc9330d25a1c30239ab1962fa99

                                              SHA256

                                              7bf88c29a699bee4f5820fc4c575bd326845e25523c62db03efa80d253261fab

                                              SHA512

                                              6a89ab4f375760bb29a00bc0ba6226f0f1bac744a0f8a5c3091ceb83bb29a1b722c7b0bff2cd4ad06267fc74bbf1e750a003d6a108a7ad48b89ea7a3bc29e772

                                              Download Submit

                                            • C:\Users\Admin\Desktop\00393\Trojan-Ransom.Win32.Gen.yjd-931dff77886dfdc1de5850939c4947eb0f84ff73fde56cb5eed8882334865097.exe
                                              Filesize

                                              368KB

                                              MD5

                                              164ad812a317942673055724eb89d2b6

                                              SHA1

                                              bf639ce74a8b6127464acc48b976d8c3790cc41a

                                              SHA256

                                              931dff77886dfdc1de5850939c4947eb0f84ff73fde56cb5eed8882334865097

                                              SHA512

                                              83e8e46a4230ec447bb5122041dda2507f639bbb9a8f76bd6a517a4a2a191cc4df72be78dc6d0be93af836367659ff665c6f55fd9d0b7a5c7f103a96aa0f3e78

                                              Download Submit

                                            • C:\Users\Admin\Desktop\00393\Trojan-Ransom.Win32.Phpw.zg-dc4c72b5c43cf93b2be3a7b490f54758174fe4af15f9d9d470723079ec8814cb.exe
                                              Filesize

                                              2.0MB

                                              MD5

                                              1926454ee445dd6ac13e611f6e3f7741

                                              SHA1

                                              e11aaca3123dc4fb63c5397bd8af76f2cd97e3e8

                                              SHA256

                                              dc4c72b5c43cf93b2be3a7b490f54758174fe4af15f9d9d470723079ec8814cb

                                              SHA512

                                              b196ba643c5d01ef64373f621de97fedf9cd42aa585efac36910c283bc0eb4f3b1226931361c0cc55a9dc6b52ecdc7236f97590dfcebf252dec8078d8353201d

                                              Download Submit

                                            • \??\c:\users\admin\desktop\00393\heur-trojan-ransom.win32.generic-1164f88212d87ff034707797c82c6d59a9f17f72bb641cf7dc83771e2c599074.exe
                                              Filesize

                                              3.7MB

                                              MD5

                                              c7f78e8eedb4e98f60438d8b3539caf0

                                              SHA1

                                              1d2ddfba9f6c23a2c25b848b757898547cd84ae7

                                              SHA256

                                              1164f88212d87ff034707797c82c6d59a9f17f72bb641cf7dc83771e2c599074

                                              SHA512

                                              1f8b943627e177ab32efe813f01a175c73576045f5942755e61611d71a22c618f7ae37d54bfddccc006820655f6a789bd7459b4d6ca5938a0f699edbed17ad2d

                                              Download Submit

                                            • memory/720-94-0x0000000000400000-0x0000000000409000-memory.dmp

                                              Filesize

                                              36KB

                                              Download

                                            • memory/720-119-0x0000000000400000-0x0000000000409000-memory.dmp

                                              Filesize

                                              36KB

                                              Download

                                            • memory/1332-1338-0x0000000000BF0000-0x0000000001124000-memory.dmp

                                              Filesize

                                              5.2MB

                                              Download

                                            • memory/1332-26054-0x0000000000BF0000-0x0000000001124000-memory.dmp

                                              Filesize

                                              5.2MB

                                              Download

                                            • memory/1332-28452-0x0000000000BF0000-0x0000000001124000-memory.dmp

                                              Filesize

                                              5.2MB

                                              Download

                                            • memory/1332-21621-0x0000000000BF0000-0x0000000001124000-memory.dmp

                                              Filesize

                                              5.2MB

                                              Download

                                            • memory/1332-16435-0x0000000000BF0000-0x0000000001124000-memory.dmp

                                              Filesize

                                              5.2MB

                                              Download

                                            • memory/1332-7357-0x0000000000BF0000-0x0000000001124000-memory.dmp

                                              Filesize

                                              5.2MB

                                              Download

                                            • memory/1332-4762-0x0000000000BF0000-0x0000000001124000-memory.dmp

                                              Filesize

                                              5.2MB

                                              Download

                                            • memory/1332-4763-0x0000000000BF0000-0x0000000001124000-memory.dmp

                                              Filesize

                                              5.2MB

                                              Download

                                            • memory/1332-2441-0x0000000000BF0000-0x0000000001124000-memory.dmp

                                              Filesize

                                              5.2MB

                                              Download

                                            • memory/1704-58-0x000001B9C14D0000-0x000001B9C14D1000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/1704-51-0x000001B9C14D0000-0x000001B9C14D1000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/1704-61-0x000001B9C14D0000-0x000001B9C14D1000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/1704-60-0x000001B9C14D0000-0x000001B9C14D1000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/1704-50-0x000001B9C14D0000-0x000001B9C14D1000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/1704-57-0x000001B9C14D0000-0x000001B9C14D1000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/1704-56-0x000001B9C14D0000-0x000001B9C14D1000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/1704-49-0x000001B9C14D0000-0x000001B9C14D1000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/1704-59-0x000001B9C14D0000-0x000001B9C14D1000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/1904-212-0x0000000009E00000-0x0000000009EE2000-memory.dmp

                                              Filesize

                                              904KB

                                              Download

                                            • memory/1904-2442-0x0000000000BF0000-0x0000000000FA4000-memory.dmp

                                              Filesize

                                              3.7MB

                                              Download

                                            • memory/1904-204-0x0000000000BF0000-0x0000000000FA4000-memory.dmp

                                              Filesize

                                              3.7MB

                                              Download

                                            • memory/1904-208-0x0000000000BF0000-0x0000000000FA4000-memory.dmp

                                              Filesize

                                              3.7MB

                                              Download

                                            • memory/1904-209-0x0000000000BF0000-0x0000000000FA4000-memory.dmp

                                              Filesize

                                              3.7MB

                                              Download

                                            • memory/2496-46-0x000001D0C2CD0000-0x000001D0C2CD1000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2496-38-0x000001D0C2CD0000-0x000001D0C2CD1000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2496-44-0x000001D0C2CD0000-0x000001D0C2CD1000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2496-45-0x000001D0C2CD0000-0x000001D0C2CD1000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2496-47-0x000001D0C2CD0000-0x000001D0C2CD1000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2496-48-0x000001D0C2CD0000-0x000001D0C2CD1000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2496-36-0x000001D0C2CD0000-0x000001D0C2CD1000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2496-37-0x000001D0C2CD0000-0x000001D0C2CD1000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2496-42-0x000001D0C2CD0000-0x000001D0C2CD1000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2496-43-0x000001D0C2CD0000-0x000001D0C2CD1000-memory.dmp

                                              Filesize

                                              4KB

                                              Download

                                            • memory/2692-867-0x0000000000400000-0x0000000000409000-memory.dmp

                                              Filesize

                                              36KB

                                              Download

                                            • memory/2692-117-0x0000000000400000-0x0000000000409000-memory.dmp

                                              Filesize

                                              36KB

                                              Download

                                            • memory/3160-179-0x00000000020A0000-0x00000000020B7000-memory.dmp

                                              Filesize

                                              92KB

                                              Download

                                            • memory/3160-178-0x0000000000400000-0x000000000045F000-memory.dmp

                                              Filesize

                                              380KB

                                              Download

                                            • memory/3540-1117-0x0000000000400000-0x00000000007EA000-memory.dmp

                                              Filesize

                                              3.9MB

                                              Download

                                            • memory/3552-2702-0x0000000000680000-0x0000000000B7C000-memory.dmp

                                              Filesize

                                              5.0MB

                                              Download

                                            • memory/3552-1337-0x0000000000680000-0x0000000000B7C000-memory.dmp

                                              Filesize

                                              5.0MB

                                              Download

                                            • memory/3552-221-0x0000000000680000-0x0000000000B7C000-memory.dmp

                                              Filesize

                                              5.0MB

                                              Download

                                            • memory/3552-220-0x0000000000680000-0x0000000000B7C000-memory.dmp

                                              Filesize

                                              5.0MB

                                              Download

                                            • memory/3888-100-0x0000000000E70000-0x0000000000F2C000-memory.dmp

                                              Filesize

                                              752KB

                                              Download

                                            • memory/3888-106-0x0000000005BD0000-0x0000000005C26000-memory.dmp

                                              Filesize

                                              344KB

                                              Download

                                            • memory/3888-103-0x0000000005A20000-0x0000000005AB2000-memory.dmp

                                              Filesize

                                              584KB

                                              Download

                                            • memory/3888-105-0x00000000059A0000-0x00000000059AA000-memory.dmp

                                              Filesize

                                              40KB

                                              Download

                                            • memory/4172-22216-0x0000000000400000-0x0000000000869000-memory.dmp

                                              Filesize

                                              4.4MB

                                              Download

                                            • memory/4172-4772-0x0000000000400000-0x0000000000869000-memory.dmp

                                              Filesize

                                              4.4MB

                                              Download

                                            • memory/4172-16897-0x0000000000400000-0x0000000000869000-memory.dmp

                                              Filesize

                                              4.4MB

                                              Download

                                            • memory/4412-78-0x000002715AD70000-0x000002715AD8E000-memory.dmp

                                              Filesize

                                              120KB

                                              Download

                                            • memory/4412-76-0x000002715ADB0000-0x000002715AE26000-memory.dmp

                                              Filesize

                                              472KB

                                              Download

                                            • memory/4412-75-0x0000027159E00000-0x0000027159E44000-memory.dmp

                                              Filesize

                                              272KB

                                              Download

                                            • memory/4412-66-0x0000027159D80000-0x0000027159DA2000-memory.dmp

                                              Filesize

                                              136KB

                                              Download

                                            • memory/4668-98-0x0000000000C60000-0x0000000000C86000-memory.dmp

                                              Filesize

                                              152KB

                                              Download

                                            • memory/4668-99-0x0000000005590000-0x000000000562C000-memory.dmp

                                              Filesize

                                              624KB

                                              Download

                                            • memory/4668-102-0x0000000005C90000-0x0000000006234000-memory.dmp

                                              Filesize

                                              5.6MB

                                              Download

                                            • memory/5044-104-0x0000000000350000-0x000000000212A000-memory.dmp

                                              Filesize

                                              29.9MB

                                              Download

                                            • memory/5044-219-0x000000001E110000-0x000000001F4BA000-memory.dmp

                                              Filesize

                                              19.7MB

                                              Download

                                            • memory/5240-3528-0x0000000000ED0000-0x0000000000ED6000-memory.dmp

                                              Filesize

                                              24KB

                                              Download

                                            • memory/5240-3394-0x0000000001420000-0x000000000149C000-memory.dmp

                                              Filesize

                                              496KB

                                              Download

                                            • memory/5240-3391-0x00000000005D0000-0x0000000000630000-memory.dmp

                                              Filesize

                                              384KB

                                              Download

                                            • memory/5456-16427-0x0000000000400000-0x0000000000454000-memory.dmp

                                              Filesize

                                              336KB

                                              Download

                                            • memory/5800-7188-0x0000000002CE0000-0x0000000002EEC000-memory.dmp

                                              Filesize

                                              2.0MB

                                              Download

                                            • memory/5800-17895-0x0000000000400000-0x0000000000729000-memory.dmp

                                              Filesize

                                              3.2MB

                                              Download

                                            • memory/5800-7184-0x0000000002CE0000-0x0000000002EEC000-memory.dmp

                                              Filesize

                                              2.0MB

                                              Download

                                            • memory/5800-6850-0x0000000000400000-0x0000000000729000-memory.dmp

                                              Filesize

                                              3.2MB

                                              Download

                                            • memory/5816-14490-0x0000000002530000-0x0000000002548000-memory.dmp

                                              Filesize

                                              96KB

                                              Download

                                            • memory/5816-14351-0x0000000002120000-0x000000000213A000-memory.dmp

                                              Filesize

                                              104KB

                                              Download

                                            • memory/6388-16437-0x0000000000400000-0x0000000000729000-memory.dmp

                                              Filesize

                                              3.2MB

                                              Download

                                            • memory/6388-6785-0x0000000000400000-0x0000000000729000-memory.dmp

                                              Filesize

                                              3.2MB

                                              Download

                                            • memory/7272-27057-0x0000000003240000-0x0000000003252000-memory.dmp

                                              Filesize

                                              72KB

                                              Download

                                            • memory/7508-10180-0x0000000000500000-0x0000000000C3D000-memory.dmp

                                              Filesize

                                              7.2MB

                                              Download

                                            • memory/7508-7462-0x0000000000500000-0x0000000000C3D000-memory.dmp

                                              Filesize

                                              7.2MB

                                              Download

                                            • memory/7508-26942-0x0000000000500000-0x0000000000C3D000-memory.dmp

                                              Filesize

                                              7.2MB

                                              Download

                                            • memory/7508-22014-0x0000000000500000-0x0000000000C3D000-memory.dmp

                                              Filesize

                                              7.2MB

                                              Download

                                            • memory/7508-16436-0x0000000000500000-0x0000000000C3D000-memory.dmp

                                              Filesize

                                              7.2MB

                                              Download

                                            • memory/7508-4768-0x0000000000500000-0x0000000000C3D000-memory.dmp

                                              Filesize

                                              7.2MB

                                              Download

                                            • memory/7532-4969-0x000000002F080000-0x000000002F1C6000-memory.dmp

                                              Filesize

                                              1.3MB

                                              Download

                                            • memory/7532-4773-0x000000002F080000-0x000000002F1C6000-memory.dmp

                                              Filesize

                                              1.3MB

                                              Download