Overview

overview

10

Static

static

1

RNSM00285.7z

windows7-x64

10

Analysis

  • max time kernel
    133s
  • max time network
    134s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    19-11-2024 18:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    RNSM00285.7z

  • Size

    4.4MB

  • MD5

    0f3a44d5d6269a72d18e62de45e77381

  • SHA1

    fc3681d29d62e37d26ff13697c764bf1612bb65b

  • SHA256

    86c5188059a4fc949c9698c43e1a59229e0784c97fe70b46f3b49b2e96c107b0

  • SHA512

    16e60bd278822ce6b78d711b96fe26c73b5920433eaa8b476685f2f24e803640fbdb2749b3cad887cce33a4e5fe00db938f8690594d63683c5635f66e107823b

  • SSDEEP

    98304:J3M9IfbLlCUZnMRwQfEjGq7Hx7+RyvWwQORS5:Jc9IfbL4CMREjGkzQd5

Score
10/10
cerbergozibankerdefense_evasiondiscoveryevasionexecutionimpactpersistenceransomwarespywarestealertrojanupx

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+xvjfp.txt

Ransom Note
__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#! NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-4096. More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA-4096 KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://prest54538hnksjn4kjfwdbhwere.hotchunman.com/C880A8F6AE72BE9A 2. http://b4youfred5485jgsa3453f.italazudda.com/C880A8F6AE72BE9A 3. http://5rport45vcdef345adfkksawe.bematvocal.at/C880A8F6AE72BE9A If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser and wait for initialization 3. Type in the address bar: fwgrhsao3aoml7ej.onion/C880A8F6AE72BE9A 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *-*-* Your personal pages: http://prest54538hnksjn4kjfwdbhwere.hotchunman.com/C880A8F6AE72BE9A http://b4youfred5485jgsa3453f.italazudda.com/C880A8F6AE72BE9A http://5rport45vcdef345adfkksawe.bematvocal.at/C880A8F6AE72BE9A *-*-* Your personal page Tor-Browser: fwgrhsao3aoml7ej.ONION/C880A8F6AE72BE9A *-*-* Your personal identification ID: C880A8F6AE72BE9A
URLs

http://prest54538hnksjn4kjfwdbhwere.hotchunman.com/C880A8F6AE72BE9A

http://b4youfred5485jgsa3453f.italazudda.com/C880A8F6AE72BE9A

http://5rport45vcdef345adfkksawe.bematvocal.at/C880A8F6AE72BE9A

http://fwgrhsao3aoml7ej.onion/C880A8F6AE72BE9A

http://fwgrhsao3aoml7ej.ONION/C880A8F6AE72BE9A

Extracted

Path

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+dlefp.txt

Ransom Note
__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#!__!@#!@#! NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA-4096. More information about the encryption keys using RSA-4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA-4096 KEY, both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. Decrypting of your files is only possible with the help of the private key and decrypt program, which is on our secret server. What do I do ? So, there are two ways you can choose: wait for a miracle and get your price doubled, or start obtaining BITCOIN NOW! , and restore your data easy way. If You have really valuable data, you better not waste your time, because there is no other way to get your files, except make a payment. For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below: 1. http://rr7mdgjbjhbefvkhbashrg.ginnypecht.com/C880A8F6AE72BE9A 2. http://kk4dshfjn45tsnkdf34fg.tatiejava.at/C880A8F6AE72BE9A 3. http://94375hfsjhbdfkj5wfg.aladadear.com/C880A8F6AE72BE9A If for some reasons the addresses are not available, follow these steps: 1. Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser and wait for initialization 3. Type in the address bar: fwgrhsao3aoml7ej.onion/C880A8F6AE72BE9A 4. Follow the instructions on the site. ---------------- IMPORTANT INFORMATION------------------------ *** Your personal pages: http://rr7mdgjbjhbefvkhbashrg.ginnypecht.com/C880A8F6AE72BE9A http://kk4dshfjn45tsnkdf34fg.tatiejava.at/C880A8F6AE72BE9A http://94375hfsjhbdfkj5wfg.aladadear.com/C880A8F6AE72BE9A *** Your personal page Tor-Browser: fwgrhsao3aoml7ej.ONION/C880A8F6AE72BE9A *** Your personal identification ID: C880A8F6AE72BE9A
URLs

http://rr7mdgjbjhbefvkhbashrg.ginnypecht.com/C880A8F6AE72BE9A

http://kk4dshfjn45tsnkdf34fg.tatiejava.at/C880A8F6AE72BE9A

http://94375hfsjhbdfkj5wfg.aladadear.com/C880A8F6AE72BE9A

http://fwgrhsao3aoml7ej.onion/C880A8F6AE72BE9A

http://fwgrhsao3aoml7ej.ONION/C880A8F6AE72BE9A

Extracted

Path

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_ReCoVeRy_+aspum.txt

Ransom Note
NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption with RSA4096 More information about the encryption keys using RSA4096 can be found here: http://en.wikipedia.org/wiki/RSA_(cryptosystem) How did this happen ? !!! Specially for your PC was generated personal RSA4096 Key , both public and private. !!! ALL YOUR FILES were encrypted with the public key, which has been transferred to your computer via the Internet. !!! Decrypting of your files is only possible with the help of the private key and decrypt program , which is on our Secret Server What do I do ? So , there are two ways you can choose: wait for a miracle and get your price doubled , or start obtaining BITCOIN NOW !!!!! , and restore your data easy way If You have really valuable data, you better not waste your time, because there is no other way to get your files , except make a payment For more specific instructions, please visit your personal home page, there are a few different addresses pointing to your page below * http://t54ndnku456ngkwsudqer.wallymac.com/D3F9968D41E97A19 * http://po4dbsjbneljhrlbvaueqrgveatv.bonmawp.at/D3F9968D41E97A19 * http://hrfgd74nfksjdcnnklnwefvdsf.materdunst.com/D3F9968D41E97A19 If for some reasons the addresses are not available, follow these steps * Download and install tor-browser: http://www.torproject.org/projects/torbrowser.html.en * After a successful installation, run the browser * Type in the address bar: xlowfznrg4wf7dli.onion/D3F9968D41E97A19 * Follow the instructions on the site IMPORTANT INFORMATION Your personal pages http://t54ndnku456ngkwsudqer.wallymac.com/D3F9968D41E97A19 http://po4dbsjbneljhrlbvaueqrgveatv.bonmawp.at/D3F9968D41E97A19 http://hrfgd74nfksjdcnnklnwefvdsf.materdunst.com/D3F9968D41E97A19
URLs

http://t54ndnku456ngkwsudqer.wallymac.com/D3F9968D41E97A19

http://po4dbsjbneljhrlbvaueqrgveatv.bonmawp.at/D3F9968D41E97A19

http://hrfgd74nfksjdcnnklnwefvdsf.materdunst.com/D3F9968D41E97A19

http://xlowfznrg4wf7dli.onion/D3F9968D41E97A19

Signatures

  • Cerber

    Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.

    ransomwarecerber
  • Cerber family
    cerber
  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi
  • Gozi family
    gozi
  • Modifies firewall policy service 3 TTPs 18 IoCs
    evasion
  • Modifies security service 2 TTPs 22 IoCs
    evasion
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (333) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Adds policy Run key to start application 2 TTPs 2 IoCs
    persistence
  • Contacts a large (676) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Drops startup file 4 IoCs
  • Executes dropped EXE 37 IoCs
  • Loads dropped DLL 39 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unexpected DNS network traffic destination 11 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Drops desktop.ini file(s) 2 IoCs
  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Suspicious use of SetThreadContext 18 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 51 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • NSIS installer 4 IoCs
    installer
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 3 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • NTFS ADS 19 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 10 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 8 IoCs
    evasion
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1184
    • C:\Program Files\7-Zip\7zFM.exe
      "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\RNSM00285.7z"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:2020
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2536
      • C:\Users\Admin\Desktop\00285\HEUR-Trojan-Ransom.Win32.Zerber.gen-0c5f8d77852b7c4799d8b7adf4c4f0d662673feb650e462cbeee169ca480e671.exe
        HEUR-Trojan-Ransom.Win32.Zerber.gen-0c5f8d77852b7c4799d8b7adf4c4f0d662673feb650e462cbeee169ca480e671.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: CmdExeWriteProcessMemorySpam
        • Suspicious behavior: MapViewOfSection
        PID:1728
        • C:\Users\Admin\Desktop\00285\HEUR-Trojan-Ransom.Win32.Zerber.gen-0c5f8d77852b7c4799d8b7adf4c4f0d662673feb650e462cbeee169ca480e671.exe
          HEUR-Trojan-Ransom.Win32.Zerber.gen-0c5f8d77852b7c4799d8b7adf4c4f0d662673feb650e462cbeee169ca480e671.exe
          4⤵
          • Drops startup file
          • Executes dropped EXE
          • Loads dropped DLL
          • Sets desktop wallpaper using registry
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2240
          • C:\Windows\SysWOW64\mshta.exe
            "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_IFX82_README_.hta"
            5⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Modifies Internet Explorer settings
            PID:2516
          • C:\Windows\system32\cmd.exe
            "C:\Windows\system32\cmd.exe"
            5⤵
              PID:1548
              • C:\Windows\system32\taskkill.exe
                taskkill /f /im "HEUR-Trojan-Ransom.Win32.Zerber.gen-0c5f8d77852b7c4799d8b7adf4c4f0d662673feb650e462cbeee169ca480e671.exe"
                6⤵
                • Kills process with taskkill
                PID:2656
              • C:\Windows\system32\PING.EXE
                ping -n 1 127.0.0.1
                6⤵
                • Loads dropped DLL
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:3064
        • C:\Users\Admin\Desktop\00285\Trojan-Ransom.NSIS.Xamyh.nla-a53c8ed79302d9d4519836e40dca67883903c72ad0bd0dd79b2310a6c7a85297.exe
          Trojan-Ransom.NSIS.Xamyh.nla-a53c8ed79302d9d4519836e40dca67883903c72ad0bd0dd79b2310a6c7a85297.exe
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: CmdExeWriteProcessMemorySpam
          • Suspicious behavior: MapViewOfSection
          PID:1096
          • C:\Users\Admin\Desktop\00285\Trojan-Ransom.NSIS.Xamyh.nla-a53c8ed79302d9d4519836e40dca67883903c72ad0bd0dd79b2310a6c7a85297.exe
            Trojan-Ransom.NSIS.Xamyh.nla-a53c8ed79302d9d4519836e40dca67883903c72ad0bd0dd79b2310a6c7a85297.exe
            4⤵
            • Executes dropped EXE
            • Maps connected drives based on registry
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: MapViewOfSection
            PID:2600
            • C:\Windows\SysWOW64\explorer.exe
              explorer.exe
              5⤵
              • Adds policy Run key to start application
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:1260
        • C:\Users\Admin\Desktop\00285\Trojan-Ransom.Win32.Bitman.jur-4d9c22f0576b050911e87c81632c1d2f6d7b3ef0e753057f88798ff341cbb920.exe
          Trojan-Ransom.Win32.Bitman.jur-4d9c22f0576b050911e87c81632c1d2f6d7b3ef0e753057f88798ff341cbb920.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: CmdExeWriteProcessMemorySpam
          • Suspicious use of SetWindowsHookEx
          PID:2060
          • C:\Users\Admin\Desktop\00285\Trojan-Ransom.Win32.Bitman.jur-4d9c22f0576b050911e87c81632c1d2f6d7b3ef0e753057f88798ff341cbb920.exe
            Trojan-Ransom.Win32.Bitman.jur-4d9c22f0576b050911e87c81632c1d2f6d7b3ef0e753057f88798ff341cbb920.exe
            4⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            PID:2980
            • C:\Windows\asgciacggweq.exe
              C:\Windows\asgciacggweq.exe
              5⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:552
              • C:\Windows\asgciacggweq.exe
                C:\Windows\asgciacggweq.exe
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Adds Run key to start application
                • Drops file in Program Files directory
                • System Location Discovery: System Language Discovery
                • Modifies system certificate store
                • System policy modification
                PID:1032
                • C:\Windows\System32\wbem\WMIC.exe
                  "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
                  7⤵
                    PID:2208
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\Desktop\00285\TROJAN~2.EXE
                5⤵
                • System Location Discovery: System Language Discovery
                PID:300
          • C:\Users\Admin\Desktop\00285\Trojan-Ransom.Win32.Bitman.nws-38f69b2e04d20c9ab9d4c940586a3b25ec1332ff1d052d0db4f0dd36f78a4b2c.exe
            Trojan-Ransom.Win32.Bitman.nws-38f69b2e04d20c9ab9d4c940586a3b25ec1332ff1d052d0db4f0dd36f78a4b2c.exe
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: CmdExeWriteProcessMemorySpam
            • Suspicious use of SetWindowsHookEx
            PID:2792
            • C:\Users\Admin\Desktop\00285\Trojan-Ransom.Win32.Bitman.nws-38f69b2e04d20c9ab9d4c940586a3b25ec1332ff1d052d0db4f0dd36f78a4b2c.exe
              Trojan-Ransom.Win32.Bitman.nws-38f69b2e04d20c9ab9d4c940586a3b25ec1332ff1d052d0db4f0dd36f78a4b2c.exe
              4⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:2180
              • C:\Windows\wjhykdpjwqbg.exe
                C:\Windows\wjhykdpjwqbg.exe
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:2832
                • C:\Windows\wjhykdpjwqbg.exe
                  C:\Windows\wjhykdpjwqbg.exe
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Adds Run key to start application
                  • Drops file in Program Files directory
                  • System Location Discovery: System Language Discovery
                  • System policy modification
                  PID:992
                  • C:\Users\Admin\Documents\oienn.exe
                    C:\Users\Admin\Documents\oienn.exe
                    7⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    PID:2640
                    • C:\Windows\System32\vssadmin.exe
                      "C:\Windows\System32\vssadmin.exe" delete shadows /all /Quiet
                      8⤵
                      • Interacts with shadow copies
                      PID:2608
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\Desktop\00285\TROJAN~3.EXE
                5⤵
                • System Location Discovery: System Language Discovery
                PID:2160
          • C:\Users\Admin\Desktop\00285\Trojan-Ransom.Win32.Bitman.rub-4e670f07a66337c99b358866f0d2a636e754c759b126440af5642e572ec9990c.exe
            Trojan-Ransom.Win32.Bitman.rub-4e670f07a66337c99b358866f0d2a636e754c759b126440af5642e572ec9990c.exe
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: CmdExeWriteProcessMemorySpam
            • Suspicious use of SetWindowsHookEx
            PID:2268
            • C:\Users\Admin\Desktop\00285\Trojan-Ransom.Win32.Bitman.rub-4e670f07a66337c99b358866f0d2a636e754c759b126440af5642e572ec9990c.exe
              Trojan-Ransom.Win32.Bitman.rub-4e670f07a66337c99b358866f0d2a636e754c759b126440af5642e572ec9990c.exe
              4⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:2676
              • C:\Windows\ciacggweqinc.exe
                C:\Windows\ciacggweqinc.exe
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:2976
                • C:\Windows\ciacggweqinc.exe
                  C:\Windows\ciacggweqinc.exe
                  6⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • System Location Discovery: System Language Discovery
                  • System policy modification
                  PID:2528
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\Desktop\00285\TROJAN~4.EXE
                5⤵
                • System Location Discovery: System Language Discovery
                PID:684
          • C:\Users\Admin\Desktop\00285\Trojan-Ransom.Win32.Bitman.rvk-75f9104301deb632f82a5ec75508df9dbcc1bd4dbdede4ade22c894835a1cf0c.exe
            Trojan-Ransom.Win32.Bitman.rvk-75f9104301deb632f82a5ec75508df9dbcc1bd4dbdede4ade22c894835a1cf0c.exe
            3⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: CmdExeWriteProcessMemorySpam
            PID:340
            • C:\Users\Admin\Desktop\00285\Trojan-Ransom.Win32.Bitman.rvk-75f9104301deb632f82a5ec75508df9dbcc1bd4dbdede4ade22c894835a1cf0c.exe
              Trojan-Ransom.Win32.Bitman.rvk-75f9104301deb632f82a5ec75508df9dbcc1bd4dbdede4ade22c894835a1cf0c.exe
              4⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:2476
              • C:\Windows\ijcwbnphmnik.exe
                C:\Windows\ijcwbnphmnik.exe
                5⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                PID:1736
                • C:\Windows\ijcwbnphmnik.exe
                  C:\Windows\ijcwbnphmnik.exe
                  6⤵
                  • Drops startup file
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Adds Run key to start application
                  • Drops file in Program Files directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: RenamesItself
                  • System policy modification
                  PID:1144
                  • C:\Windows\System32\wbem\WMIC.exe
                    "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete /nointeractive
                    7⤵
                      PID:2832
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\system32\cmd.exe" /c DEL C:\Users\Admin\Desktop\00285\TR382D~1.EXE
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:2492
            • C:\Users\Admin\Desktop\00285\Trojan-Ransom.Win32.Blocker.bwyj-058b61a9218105bc18a4668e1df0f3b161e62a10a7f07313d631d74bc23292ee.exe
              Trojan-Ransom.Win32.Blocker.bwyj-058b61a9218105bc18a4668e1df0f3b161e62a10a7f07313d631d74bc23292ee.exe
              3⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              PID:2588
              • C:\Users\Admin\Desktop\00285\Trojan-Ransom.Win32.Blocker.bwyj-058b61a9218105bc18a4668e1df0f3b161e62a10a7f07313d631d74bc23292ee.exe
                "C:\Users\Admin\Desktop\00285\Trojan-Ransom.Win32.Blocker.bwyj-058b61a9218105bc18a4668e1df0f3b161e62a10a7f07313d631d74bc23292ee.exe"
                4⤵
                • Modifies security service
                • Sets service image path in registry
                • Executes dropped EXE
                • Adds Run key to start application
                • Suspicious use of SetThreadContext
                • System Location Discovery: System Language Discovery
                • NTFS ADS
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of AdjustPrivilegeToken
                PID:1840
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\system32\cmd.exe"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:2816
            • C:\Users\Admin\Desktop\00285\Trojan-Ransom.Win32.Foreign.nljr-072afe69091f85a2cda00fac06322d62b510b77713966244881ac78e82a9847d.exe
              Trojan-Ransom.Win32.Foreign.nljr-072afe69091f85a2cda00fac06322d62b510b77713966244881ac78e82a9847d.exe
              3⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              PID:2780
              • C:\Windows\SysWOW64\cmd.exe
                cmd /c ""C:\Users\Admin\AppData\Local\Temp\9676\CB3B.bat" "C:\Users\Admin\AppData\Roaming\MICROS~1\Cmncrsrv\Auxiprop.exe" "C:\Users\Admin\Desktop\00285\TRBDC5~1.EXE""
                4⤵
                • System Location Discovery: System Language Discovery
                PID:2292
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /C ""C:\Users\Admin\AppData\Roaming\MICROS~1\Cmncrsrv\Auxiprop.exe" "C:\Users\Admin\Desktop\00285\TRBDC5~1.EXE""
                  5⤵
                  • Loads dropped DLL
                  • System Location Discovery: System Language Discovery
                  PID:2824
                  • C:\Users\Admin\AppData\Roaming\MICROS~1\Cmncrsrv\Auxiprop.exe
                    "C:\Users\Admin\AppData\Roaming\MICROS~1\Cmncrsrv\Auxiprop.exe" "C:\Users\Admin\Desktop\00285\TRBDC5~1.EXE"
                    6⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious behavior: MapViewOfSection
                    PID:1176
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe
                      7⤵
                      • Suspicious use of SetThreadContext
                      • Suspicious behavior: MapViewOfSection
                      PID:1040
            • C:\Users\Admin\Desktop\00285\Trojan-Ransom.Win32.SageCrypt.ahg-3ea6f8f2fbf2eb8935bbc0e34aefadc015b5b6e39947e9d86e7ac54f1a332230.exe
              Trojan-Ransom.Win32.SageCrypt.ahg-3ea6f8f2fbf2eb8935bbc0e34aefadc015b5b6e39947e9d86e7ac54f1a332230.exe
              3⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              PID:2712
              • C:\Users\Admin\Desktop\00285\Trojan-Ransom.Win32.SageCrypt.ahg-3ea6f8f2fbf2eb8935bbc0e34aefadc015b5b6e39947e9d86e7ac54f1a332230.exe
                C:\Users\Admin\Desktop\00285\Trojan-Ransom.Win32.SageCrypt.ahg-3ea6f8f2fbf2eb8935bbc0e34aefadc015b5b6e39947e9d86e7ac54f1a332230.exe
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:1784
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1784 -s 152
                  5⤵
                  • Loads dropped DLL
                  • Program crash
                  PID:2832
            • C:\Users\Admin\Desktop\00285\Trojan-Ransom.Win32.Zerber.ddcg-56cda1c31b0c4e081d3703dbfecfc802a19943ab817824e083c10228419dd177.exe
              Trojan-Ransom.Win32.Zerber.ddcg-56cda1c31b0c4e081d3703dbfecfc802a19943ab817824e083c10228419dd177.exe
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              PID:2796
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 124
                4⤵
                • Loads dropped DLL
                • Program crash
                PID:2196
            • C:\Users\Admin\Desktop\00285\Trojan-Ransom.Win32.Zerber.dfhj-14a4201d2cf744d3a2561141357f54b98105cf8ca1a41deb8f2d756e1ce4b469.exe
              Trojan-Ransom.Win32.Zerber.dfhj-14a4201d2cf744d3a2561141357f54b98105cf8ca1a41deb8f2d756e1ce4b469.exe
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              • Suspicious use of WriteProcessMemory
              PID:2776
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2776 -s 124
                4⤵
                • Loads dropped DLL
                • Program crash
                PID:2496
            • C:\Users\Admin\Desktop\00285\Trojan-Ransom.Win32.Zerber.tbv-73aff729f855cbdb91663c15194de7d2dd262c79eec7bc40c9ea28dddb8996a4.exe
              Trojan-Ransom.Win32.Zerber.tbv-73aff729f855cbdb91663c15194de7d2dd262c79eec7bc40c9ea28dddb8996a4.exe
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              • Suspicious behavior: MapViewOfSection
              PID:2556
              • C:\Users\Admin\Desktop\00285\Trojan-Ransom.Win32.Zerber.tbv-73aff729f855cbdb91663c15194de7d2dd262c79eec7bc40c9ea28dddb8996a4.exe
                Trojan-Ransom.Win32.Zerber.tbv-73aff729f855cbdb91663c15194de7d2dd262c79eec7bc40c9ea28dddb8996a4.exe
                4⤵
                • Executes dropped EXE
                PID:2856
            • C:\Users\Admin\Desktop\00285\Trojan-Ransom.Win32.Zerber.wgh-f8986c6f8be4deb02a198a5527f97b5926926d54c6edd35cec23095df740cc54.exe
              Trojan-Ransom.Win32.Zerber.wgh-f8986c6f8be4deb02a198a5527f97b5926926d54c6edd35cec23095df740cc54.exe
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              • Suspicious behavior: MapViewOfSection
              PID:3040
              • C:\Users\Admin\Desktop\00285\Trojan-Ransom.Win32.Zerber.wgh-f8986c6f8be4deb02a198a5527f97b5926926d54c6edd35cec23095df740cc54.exe
                Trojan-Ransom.Win32.Zerber.wgh-f8986c6f8be4deb02a198a5527f97b5926926d54c6edd35cec23095df740cc54.exe
                4⤵
                • Executes dropped EXE
                PID:2336
            • C:\Users\Admin\Desktop\00285\UDS-Trojan-Ransom.Win32.CryptXXX.sb-7187a58532fe3b97607c8b4a77003e132b72982b03840d54e7988a562e2b9e8b.exe
              UDS-Trojan-Ransom.Win32.CryptXXX.sb-7187a58532fe3b97607c8b4a77003e132b72982b03840d54e7988a562e2b9e8b.exe
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              PID:1756
              • C:\Users\Admin\AppData\Local\Temp\ebjcabfbdfbhj.exe
                C:\Users\Admin\AppData\Local\Temp\ebjcabfbdfbhj.exe 7^4^9^1^2^0^4^1^2^9^5 KExAQzs3Ly8wFypMUTlPR0Q5Lx4mST5QTk5QS0VDOycbKEBAUlJJQDwuFyo8RTs8LiArT1BGP04/S15HRDkvHiZOPk5NRFBfUVFKNGNtcGc5LS9vcXQlPz5PQixST0wsP0dLJ0VFRU0gK0JKQD5ERTs8Hi9AMDskLBkrOzE7LS0fLTsuNikoHy1EMDwrKBsoQCw8KzEcLk5JSj1ROlNdUE5IVDg+UjkXLk5SS0NTOk9YQUxLPz0cLk5JSj1ROlNdTj1MQzQbKEFPRF1VTks7Fyo+VDxeQU1AS0dFQDYcJkdNU1BeQElKUE88UTs1HC5SPzxHR1BOU19RUUo0GyhSRDwwICtDUSg4GStJVExURUxDVlI+SDpOS0VFTD8+QE5OQzweL0VSXUlQR1BATEM9cHFzXBsoTjxTU1JKSEw+Wk5PPFFdRD1YUTQtGSs/SEJFVDwvFypCT1ZDV049TEc6Wj5KOlFXUFBEQjRhWmhqZB4vQE5VRUdIPTteR1A5MS4vKSotJy03MyowMCkbKFBATEM9LTMwMC8pLTAwMCArQ01OSUVLOENdVEVMQzQvKC0wLjAwLTQoKC0zLCw5LzImQEsXKk49NE93dGRubCRwa2hjaGAlLmUwJTIZK0xRSj1kc3JnICxdHDFkJS5lZVxvKionMC8xYGRxYGJnKmBtZG8hMWRJcGdQYGxjRGt2bGNqWmBEYGxhY2RwVl9ebGNudyUuZS8rLTIwJzA3MS0kMF1faHNla21hYGxfZVxgYWkkMGYtMzAwLyktMDAvJS9lNC4yKS0nNzM4LjJXTTBtSmFYIzJiYEJecUZPJ3JGMkZpYGQvKkhI
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:1832
                • C:\Windows\SysWOW64\Wbem\wmic.exe
                  wmic /output:C:\Users\Admin\AppData\Local\Temp\81732039868.txt bios get serialnumber
                  5⤵
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2528
                • C:\Windows\SysWOW64\Wbem\wmic.exe
                  wmic /output:C:\Users\Admin\AppData\Local\Temp\81732039868.txt bios get version
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:1644
                • C:\Windows\SysWOW64\Wbem\wmic.exe
                  wmic /output:C:\Users\Admin\AppData\Local\Temp\81732039868.txt bios get version
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:2988
                • C:\Windows\SysWOW64\Wbem\wmic.exe
                  wmic /output:C:\Users\Admin\AppData\Local\Temp\81732039868.txt bios get version
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:2888
                • C:\Windows\SysWOW64\Wbem\wmic.exe
                  wmic /output:C:\Users\Admin\AppData\Local\Temp\81732039868.txt bios get version
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:1056
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1832 -s 368
                  5⤵
                  • Loads dropped DLL
                  • Program crash
                  PID:1256
            • C:\Users\Admin\Desktop\00285\UDS-Trojan-Ransom.Win32.Zerber.a-272cb77c20e32c4f23d343be8ddbb7378d981e6ef557ea541656452d925ea585.exe
              UDS-Trojan-Ransom.Win32.Zerber.a-272cb77c20e32c4f23d343be8ddbb7378d981e6ef557ea541656452d925ea585.exe
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              PID:676
              • C:\Users\Admin\Desktop\00285\UDS-Trojan-Ransom.Win32.Zerber.a-272cb77c20e32c4f23d343be8ddbb7378d981e6ef557ea541656452d925ea585.exe
                UDS-Trojan-Ransom.Win32.Zerber.a-272cb77c20e32c4f23d343be8ddbb7378d981e6ef557ea541656452d925ea585.exe
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:816
          • C:\Windows\system32\taskmgr.exe
            "C:\Windows\system32\taskmgr.exe" /4
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:2016
          • C:\Windows\system32\cmd.exe
            cmd /C "nslookup myip.opendns.com resolver1.opendns.com > C:\Users\Admin\AppData\Local\Temp\847E.bi1"
            2⤵
              PID:1932
              • C:\Windows\system32\nslookup.exe
                nslookup myip.opendns.com resolver1.opendns.com
                3⤵
                • Loads dropped DLL
                PID:2280
            • C:\Windows\system32\cmd.exe
              cmd /C "echo -------- >> C:\Users\Admin\AppData\Local\Temp\847E.bi1"
              2⤵
                PID:1936
            • C:\Windows\SysWOW64\DllHost.exe
              C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
              1⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of FindShellTrayWindow
              PID:2656
            • C:\Windows\SysWOW64\DllHost.exe
              C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}
              1⤵
              • System Location Discovery: System Language Discovery
              PID:1744
            • C:\Windows\system32\vssvc.exe
              C:\Windows\system32\vssvc.exe
              1⤵
                PID:2160
              • C:\Windows\System32\svchost.exe
                C:\Windows\System32\svchost.exe -k swprv
                1⤵
                  PID:2392

                Network

                MITRE ATT&CK Enterprise v15

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Windows Management Instrumentation

                1
                T1047

                Persistence

                Boot or Logon Autostart Execution

                3
                T1547

                Registry Run Keys / Startup Folder

                3
                T1547.001

                Create or Modify System Process

                2
                T1543

                Windows Service

                2
                T1543.003

                Privilege Escalation

                Boot or Logon Autostart Execution

                3
                T1547

                Registry Run Keys / Startup Folder

                3
                T1547.001

                Create or Modify System Process

                2
                T1543

                Windows Service

                2
                T1543.003

                Defense Evasion

                Direct Volume Access

                1
                T1006

                Impair Defenses

                1
                T1562

                Disable or Modify System Firewall

                1
                T1562.004

                Indicator Removal

                3
                T1070

                File Deletion

                3
                T1070.004

                Modify Registry

                9
                T1112

                Subvert Trust Controls

                1
                T1553

                Install Root Certificate

                1
                T1553.004

                Credential Access

                Credentials from Password Stores

                1
                T1555

                Credentials from Web Browsers

                1
                T1555.003

                Unsecured Credentials

                1
                T1552

                Credentials In Files

                1
                T1552.001

                Discovery

                Network Service Discovery

                1
                T1046

                Peripheral Device Discovery

                1
                T1120

                Query Registry

                1
                T1012

                Remote System Discovery

                1
                T1018

                System Information Discovery

                2
                T1082

                System Location Discovery

                1
                T1614

                System Language Discovery

                1
                T1614.001

                System Network Configuration Discovery

                1
                T1016

                Internet Connection Discovery

                1
                T1016.001

                Lateral Movement

                Collection

                Data from Local System

                1
                T1005

                Command and Control

                Exfiltration

                Impact

                Defacement

                1
                T1491

                Inhibit System Recovery

                2
                T1490

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+dlefp.html
                  Filesize

                  7KB

                  MD5

                  7222db81d97be5efbfad3d9330c9d0e1

                  SHA1

                  718f8b94f9b0da70bc32af10676938f17df4104e

                  SHA256

                  1c7d4638b4819772afa9f477c71c8cc75ec7066c4181ccd548f3e90e6396e0c9

                  SHA512

                  6eae831bf132f7bb868a3d3463fd873c3ddb3f394e9f011fbf10963995b5dd6b24c71ef5df3e3434afb7553e5599cc8b4fd7c31b75d69be57b995230c6f877f6

                  Download Submit

                • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+dlefp.png
                  Filesize

                  67KB

                  MD5

                  e9bf3949b62068099cc208ebab95d916

                  SHA1

                  fc73ede0b5ad6f518094b8d1b463ef5453863c96

                  SHA256

                  ff429fa4a549886ee203f843cc1f9b894f6b46d91882ece83db61e42196f33bf

                  SHA512

                  3d981f7a46c8b7e96afc41fcc39e7d681ca425b1a6019819579810d4035f3d2cd1d603c254c9e279c7d0dcca905edf8bfafd41a40c18f4e9a2173607aac58e3a

                  Download Submit

                • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+dlefp.txt
                  Filesize

                  2KB

                  MD5

                  7f423eaa889b5f421c203b7b6725ff44

                  SHA1

                  5c917970743d7e664dc7ec570dc106bfcf3701b5

                  SHA256

                  d72f8070970e6518576a499ab6922126cdbdf0ba75a59a7dbf0faad4c231e4c0

                  SHA512

                  41c5c82e5f224f57d5a85c7b9172019936123cea21a795d7ce232082da550a6d346be6b3a2bfd796f0ccf2576272901cd80f06fe74488db8ba8813f816ae911d

                  Download Submit

                • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+xvjfp.html
                  Filesize

                  8KB

                  MD5

                  8163c69a270e4e96189e4869a9697209

                  SHA1

                  50b86f3785ad553827c32e4fbc4d7938fd604e3e

                  SHA256

                  94d50db05f43f42e2e7d6663d4554656e3ef44d7fd172a3ccec4301f6904e2f0

                  SHA512

                  69a19f43ca0266600f7171ead77cf7c8ee881fcc5751e0e29b3920933072b1748b036df9dce7141f544d63a1571d2024a828bca522964659cb6edf1a737ffd31

                  Download Submit

                • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+xvjfp.png
                  Filesize

                  68KB

                  MD5

                  69585de1153dbd5363754cb0c3ded477

                  SHA1

                  c63711e3ffdfafa325a83fca11d1c2cb83f77f59

                  SHA256

                  26c5ba3665987c8e8a35de67da6d057b299820d19a7fb252805f832779cf2a1d

                  SHA512

                  16743d5d614bcf671a23dec5c5c6fd5a9bf84818f99d6fabd3999a2f312e3aded19850889760153c823645c2cb9a847dd364b731819c5c547e42bd38a1b9e2a5

                  Download Submit

                • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Recovery+xvjfp.txt
                  Filesize

                  2KB

                  MD5

                  c2c7919c2e042d0b50cfa091f33389fc

                  SHA1

                  977f1a7163a83c0c64308c01bc9bb53c822ed2f8

                  SHA256

                  b95a79cbefa2776e19f24964716778ddcfe962597d79ea4467f1aada7b759cde

                  SHA512

                  6bbb80d032d3f80d5aaf2ebb355c93468bafb8744d4afeab50b5ebae2b687bcc21970c55959017ddecf836f0e4a99b652c1aaf306d14dbfe6b10f0cade455a99

                  Download Submit

                • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_ReCoVeRy_+aspum.html
                  Filesize

                  11KB

                  MD5

                  de49e15073f98d7c8b523a879d15211b

                  SHA1

                  af530bc62698472bb12809bf794ed09cc1f44a55

                  SHA256

                  fc396d73551012b7eec5527e67d887d92821150b785341d84886c4a54c653933

                  SHA512

                  0b5a28ffc7d1da997f8011f88d5c221f5eec419556aa4fd896d1ec301bc9d114daa8bbddbda0ff1e71040d12cf566f9e85e2eeda5f28d95cd0f5fc2849746cb6

                  Download Submit

                • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_ReCoVeRy_+aspum.png
                  Filesize

                  61KB

                  MD5

                  692418cdb429e26b461fede2ace446b4

                  SHA1

                  dfe6dc64bb52b851a4d3d0200417baf2b243d8f6

                  SHA256

                  d1f9359c271ebb49698d2d15aae2c11c8d81a1e116688a27fc0128720c83dc24

                  SHA512

                  122c73f420a5a8bb60eaf6a04fc57c1fa3230415252d7d452e1aa5f75acc8ff2e353f5c5569ae2dc447e4308a6c5819ae32b87675840eb73fa3f81b40980cdf0

                  Download Submit

                • C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\_ReCoVeRy_+aspum.txt
                  Filesize

                  1KB

                  MD5

                  9a57d70c373f00e2952a822be483a3d3

                  SHA1

                  dda1307da5bd51d65790b6a99ab6366e75df92d6

                  SHA256

                  fc76045ee30af36012d9d7dda03fcf164e791e3d82ea3776a91d28c8067c87c0

                  SHA512

                  b2a76141e39680bcfd2bfc7fde57146cddb9c7ae25e06636ffc677b9e4595331a6c296bb649809c26d5a9f7bb7176a1740e6e50d097105b69446943ef6671849

                  Download Submit

                • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt
                  Filesize

                  11KB

                  MD5

                  9c57ed95977c7ec8de0cc60308ff3f38

                  SHA1

                  23235d448c5bd7df0df52593527106520bc9f081

                  SHA256

                  99f615da60183cb26895f5ea1662a58e347d7f07a54cc41c29091360626125f1

                  SHA512

                  619ff483d8b977bb1fb98c137c041dfb936b5691b25b17728c4104427f266f0dadd62505e99ad466723a3ae4ffe19411aba68c2c30cb05774c1ff16aacf22082

                  Download Submit

                • C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt
                  Filesize

                  109KB

                  MD5

                  b9bb9cfad9dcf12c368cd6d9b13aab65

                  SHA1

                  57a2a4533279e58bb0d14aa155ed37d6e80f4d85

                  SHA256

                  09ce3a3bd6c70e7e4e82f62a228cd729af8507cec7cfec1b620e524fa0773572

                  SHA512

                  521ece65b31ade8845cd456f362938b3c105c165af782173613b9579d28898757c11f4f659343236f97026e57437c94ab00d7870fa186029e7896abd4bb43f42

                  Download Submit

                • C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt
                  Filesize

                  173KB

                  MD5

                  77ef8cf92e4c4a9130c65c6fecc8d0b9

                  SHA1

                  c6a2e20f51d2106684c5e9357bcdfcc2e834c43b

                  SHA256

                  eee2c4ca3fa5164dd52925d309bd8c1950d3d67e156b78ee764cee32abe65bbf

                  SHA512

                  808127a820618ae6a62a275479f61194445121a5f8b9c5ca0a2888e9df5722188732ff87934292ea088a34cc8a3b87825c131037cc464b47833de4a6d5edddc2

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\5a410d66\4a6b.tmp
                  Filesize

                  344B

                  MD5

                  b2593ad9a43809cf6aad3923c73d1a4f

                  SHA1

                  468681556d186d5472c5e7a634d7c35260aac48f

                  SHA256

                  e7c1aace32955a1a60dff160a9cea8319ef86c69e8df820e1bb06cce8ae58bc9

                  SHA512

                  535779c654577f12ebe9ffb40aeab8c79be3addfae33614df6c6c417f4101f6cffbfe79de64a168051daaf3031fb16576176d0ef5cc19db86c6a95b27beb278e

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\5a410d66\f84f.tmp
                  Filesize

                  130B

                  MD5

                  6f0a9f565005dbe020c84902ff134642

                  SHA1

                  6c16b9c4abcbec2de19a3746d7fbf6075a1cc0df

                  SHA256

                  205f5b31b1816593dded3a3d1c24a0993f2fe6950429067e87a762f603ceafba

                  SHA512

                  4edcadc6bee25a4c22b60621302693cf656012169dc9a7334aa169894a1ce373bd56ef0947c2430e014fc8d7888496135d6686595405b0a42d9eaf63546e6f64

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\81732039868.txt
                  Filesize

                  66B

                  MD5

                  9025468f85256136f923096b01375964

                  SHA1

                  7fcd174999661594fa5f88890ffb195e9858cc52

                  SHA256

                  d5418014fa8e6e17d8992fd12c0dfecac8a34855603ea58133e87ea09c2130df

                  SHA512

                  92cac37c332e6e276a963d659986a79a79867df44682bfc2d77ed7784ffa5e2c149e5960a83d03ef4cf171be40a73e93a110aaa53b95152fa9a9da6b41d31e51

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\9676\CB3B.bat
                  Filesize

                  112B

                  MD5

                  2fdc227a488d8fa8e4cc0ef27440111b

                  SHA1

                  3a1b0f9b25701345815c6f4a0db646a1ff06eb77

                  SHA256

                  8324eb1a7726c4766dc34d5269b1d4b137005b0c2f3ff094deeca739f9880c06

                  SHA512

                  288d518bcadf82a0b6f4bd2b31b5e3c30ab0da380316a8bfc8390fe5ec255e4c8d615bba6fd007066e8f7423c90ec4bc4d8132c4620d3bd1515e8633b07c0808

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\ebjcabfbdfbhj.exe
                  Filesize

                  764KB

                  MD5

                  02f4478be48200a365d7ec28320a6cd6

                  SHA1

                  01ff2232d933be83a1e85d19692276c37719e1d6

                  SHA256

                  3a1a70b94fae3c80b505e2bc9d86832ff9e2bb68f7d78bc77544e4bdd942afe7

                  SHA512

                  e65ea616cc28327ba54fb6cd7b01ff59ff6461c4f3b7448c11167352fc9c1871d91737c9c1d90cf249c5259127c1291bd4b31fb6491f7e57e8ccf9f82c2cd69a

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\nszA66E.tmp\pecvq.dll
                  Filesize

                  126KB

                  MD5

                  8502136cbab8cfa9e25cca9e757ce2c4

                  SHA1

                  4554e9fc74c3be3baf6eb4e44baeb886694e4757

                  SHA256

                  a6150805e2cc881e85069cd92cc3147fce4536c1e572b7778a40cdebfe9bf2bf

                  SHA512

                  32cb48a50a55efa3f040c2fb581987b4ee5ea63fc65df7a740f04520caf18a85c7fbdefd57be5e53c325c549cd11388b56aabf6932f413b6665a0b54b779f87b

                  Download Submit

                • C:\Users\Admin\Desktop\00285\HEUR-Trojan-Ransom.Win32.Zerber.gen-0c5f8d77852b7c4799d8b7adf4c4f0d662673feb650e462cbeee169ca480e671.exe
                  Filesize

                  230KB

                  MD5

                  a124167b0fa642c42a842f0edbdff10f

                  SHA1

                  ed476e488ffe81eed4e30cbd7794fc572c2d8d8f

                  SHA256

                  0c5f8d77852b7c4799d8b7adf4c4f0d662673feb650e462cbeee169ca480e671

                  SHA512

                  a8b5a070e2d9c51ba8159bc2d97b3a773b380b026c79d15778dbaad522697f93e1179c6c73c31726343f2d58f330af3b85fb53f1f3cb47886ae0df851f7db86b

                  Download Submit

                • C:\Users\Admin\Desktop\00285\Trojan-Ransom.NSIS.Xamyh.nla-a53c8ed79302d9d4519836e40dca67883903c72ad0bd0dd79b2310a6c7a85297.exe
                  Filesize

                  132KB

                  MD5

                  4b73a09f7fd3fdb130280681cea57c4d

                  SHA1

                  7d1600e7f58c4afb1d4f4caefca41aad451aa999

                  SHA256

                  a53c8ed79302d9d4519836e40dca67883903c72ad0bd0dd79b2310a6c7a85297

                  SHA512

                  dee54fb6fd5c1a52fc5088c690a3fa98d65c322fb59d3d0ea11e7547143bf5f01c886cb02dbfaf5a79672904903133ee667a8673e0a28d2f37ae814d09761070

                  Download Submit

                • C:\Users\Admin\Desktop\00285\Trojan-Ransom.Win32.Bitman.jur-4d9c22f0576b050911e87c81632c1d2f6d7b3ef0e753057f88798ff341cbb920.exe
                  Filesize

                  372KB

                  MD5

                  65f9ebbf47b56e35a66d18d0047693f5

                  SHA1

                  041b180e6beacd2075d3fccdb3a2a989f1056dc3

                  SHA256

                  4d9c22f0576b050911e87c81632c1d2f6d7b3ef0e753057f88798ff341cbb920

                  SHA512

                  ee03722ddef6421cd340c2e5397d9038dc665ed783db26745af70d59ecaa8ee5fe6b4af6201a666b389febfb39c46182e3883dda63aba5fbdf5745bf614174c2

                  Download Submit

                • C:\Users\Admin\Desktop\00285\Trojan-Ransom.Win32.Bitman.nws-38f69b2e04d20c9ab9d4c940586a3b25ec1332ff1d052d0db4f0dd36f78a4b2c.exe
                  Filesize

                  608KB

                  MD5

                  c4e2d16b8d9c5ecb546e5cff031f5c69

                  SHA1

                  1486c6cacc8d3603b328f49a18c5407b8160db95

                  SHA256

                  38f69b2e04d20c9ab9d4c940586a3b25ec1332ff1d052d0db4f0dd36f78a4b2c

                  SHA512

                  76d3f146a3c56b7f7ea9fe8eb79a40f9be6e5bee043f05332a9cb11fb7f44171bde598f22e2e3995ee5c4cb3ab342d353fabc42cd589c56fdb23f38c033c79d2

                  Download Submit

                • C:\Users\Admin\Desktop\00285\Trojan-Ransom.Win32.Bitman.rub-4e670f07a66337c99b358866f0d2a636e754c759b126440af5642e572ec9990c.exe
                  Filesize

                  376KB

                  MD5

                  12935dbd00f586ec0b646179af07c349

                  SHA1

                  88004449f0addf604c106400f85b661515c5d7fc

                  SHA256

                  4e670f07a66337c99b358866f0d2a636e754c759b126440af5642e572ec9990c

                  SHA512

                  a3a876ad992265aace84cf154223914609ec159fdbc3dbea28cf16f683bf99c852d3dc554faa1cd09ea6167bca936be57ea96ac3504848d1d9c9a89d6bfee5ab

                  Download Submit

                • C:\Users\Admin\Desktop\00285\Trojan-Ransom.Win32.Bitman.rvk-75f9104301deb632f82a5ec75508df9dbcc1bd4dbdede4ade22c894835a1cf0c.exe
                  Filesize

                  335KB

                  MD5

                  4c9f52d4d20c30c3e226561c6aef9bb9

                  SHA1

                  47fb61e36de672ef6443e2aef4a25fc16802b77a

                  SHA256

                  75f9104301deb632f82a5ec75508df9dbcc1bd4dbdede4ade22c894835a1cf0c

                  SHA512

                  01f98a73035909fd344eec58f052c1b7e63220b6e517eb4347c126996ac5251522ce873a6d3e393687e80c9bcb239a0c90a8546f9434fd5dd689c7ed39275302

                  Download Submit

                • C:\Users\Admin\Desktop\00285\Trojan-Ransom.Win32.Blocker.bwyj-058b61a9218105bc18a4668e1df0f3b161e62a10a7f07313d631d74bc23292ee.exe
                  Filesize

                  968KB

                  MD5

                  e2de97987400de187133606f443bb930

                  SHA1

                  0f21c4baa5e0af53b6858168de677420b13b9252

                  SHA256

                  058b61a9218105bc18a4668e1df0f3b161e62a10a7f07313d631d74bc23292ee

                  SHA512

                  98d7ed1040ed4d7e103fb4f630e1ee64dc04fc32d3d3acdedddf27975679a83d4901a7d3593bbab523f0d64f8dfd1c74c12919de9752d514a3432ad67e41a7b7

                  Download Submit

                • C:\Users\Admin\Desktop\00285\Trojan-Ransom.Win32.Foreign.nljr-072afe69091f85a2cda00fac06322d62b510b77713966244881ac78e82a9847d.exe
                  Filesize

                  472KB

                  MD5

                  5c0cb264e22a4a0890421e09da40795d

                  SHA1

                  74c7ef4aacc18ee3f57154e5f872a1667eaa1531

                  SHA256

                  072afe69091f85a2cda00fac06322d62b510b77713966244881ac78e82a9847d

                  SHA512

                  ef56172e3b86705e2eb7c18fee68a292d8e97575dcbcff78edc2440fb5fefc9d17126d0dc01e4be7332f9a3f22601e0160ea58d9ebdfe61a5718cd3daa29b82e

                  Download Submit

                • C:\Users\Admin\Desktop\00285\Trojan-Ransom.Win32.SageCrypt.ahg-3ea6f8f2fbf2eb8935bbc0e34aefadc015b5b6e39947e9d86e7ac54f1a332230.exe
                  Filesize

                  892KB

                  MD5

                  8517e92f416cd3878828fe15bda5303a

                  SHA1

                  c927a86c38b04c581a3e30c65c5c4233eac20a9e

                  SHA256

                  3ea6f8f2fbf2eb8935bbc0e34aefadc015b5b6e39947e9d86e7ac54f1a332230

                  SHA512

                  1e472d81a81be14212277667b0709af36b0b70b41337162b0d740a726a240e4077c0db95aa7d4722d63372ddb024a109f64bc04f222704ef0e886af9884361bd

                  Download Submit

                • C:\Users\Admin\Desktop\00285\Trojan-Ransom.Win32.Zerber.ddcg-56cda1c31b0c4e081d3703dbfecfc802a19943ab817824e083c10228419dd177.exe
                  Filesize

                  528KB

                  MD5

                  a7d135819fd5e6e1b3c876cdc1b68b7c

                  SHA1

                  99619c574bcf1dc7ebb6d4f9b7ae9f661f35275e

                  SHA256

                  56cda1c31b0c4e081d3703dbfecfc802a19943ab817824e083c10228419dd177

                  SHA512

                  a2941967cc1fd173fc27b86d76a27d3df4c2dcc6a6f183df3a5b1fbc9655d4350b7ed9620310a836201574ba610f2542600472f34ec56dde5d29d0dd6189f768

                  Download Submit

                • C:\Users\Admin\Desktop\00285\Trojan-Ransom.Win32.Zerber.tbv-73aff729f855cbdb91663c15194de7d2dd262c79eec7bc40c9ea28dddb8996a4.exe
                  Filesize

                  291KB

                  MD5

                  b87c41de87a0c50cf3ed8e5d6b541eb1

                  SHA1

                  ae8bed18fc3a8fd859f1d233e9c8e8457ef02d97

                  SHA256

                  73aff729f855cbdb91663c15194de7d2dd262c79eec7bc40c9ea28dddb8996a4

                  SHA512

                  ee7d9ceb955916561fc0ce7494921ac00c22fcdff7bd6366f0be0377c129144f9bc234c6076295dc778e59fb109477c9f331962d106ea63f0dfc026b54b73fbd

                  Download Submit

                • C:\Users\Admin\Desktop\00285\Trojan-Ransom.Win32.Zerber.wgh-f8986c6f8be4deb02a198a5527f97b5926926d54c6edd35cec23095df740cc54.exe
                  Filesize

                  256KB

                  MD5

                  5b9b90e2d444bdc18843438de53dc072

                  SHA1

                  899b51de267427b4ea739a796310db8881ae4ab3

                  SHA256

                  f8986c6f8be4deb02a198a5527f97b5926926d54c6edd35cec23095df740cc54

                  SHA512

                  9c94002b08ead69c27d1b78fea2281e8b59aba08dcc6d5fb8a68e949d6cde81bc9db6c3e808259e3966254b6061f82c5b8cfb0d949e0870de1be38d454b7c980

                  Download Submit

                • C:\Users\Admin\Desktop\00285\UDS-Trojan-Ransom.Win32.CryptXXX.sb-7187a58532fe3b97607c8b4a77003e132b72982b03840d54e7988a562e2b9e8b.exe
                  Filesize

                  558KB

                  MD5

                  84cb3d3e380050624398e78ae3290af0

                  SHA1

                  a35dea47cc2a3aa34cb95644eb24d5a076a6df4f

                  SHA256

                  7187a58532fe3b97607c8b4a77003e132b72982b03840d54e7988a562e2b9e8b

                  SHA512

                  3522ae2c4d4a8579a0408d9761d423fcf631b99239817d31326cf7adabc8e5bf455d22db246872635cdf013c0fedbd83f5b108f065109a2ca1da7b80180bef70

                  Download Submit

                • C:\Users\Admin\Desktop\00285\UDS-Trojan-Ransom.Win32.Zerber.a-272cb77c20e32c4f23d343be8ddbb7378d981e6ef557ea541656452d925ea585.exe
                  Filesize

                  267KB

                  MD5

                  489bc591f75c1eb2857a2bdbc6b38e1b

                  SHA1

                  de2e47713208c592a4acf7cdd7018b3a16e5870f

                  SHA256

                  272cb77c20e32c4f23d343be8ddbb7378d981e6ef557ea541656452d925ea585

                  SHA512

                  df898fb782708284b95a21b6e4435795756b1cf00f549587c7b8e648385a701e9fcf713664c2c7be40f741f2a03bc6be047ee107b9947c6e6a9068b5d348aeb0

                  Download Submit

                • \Users\Admin\AppData\Local\Temp\fossulas.dll
                  Filesize

                  71KB

                  MD5

                  058d2f5ae38c404e635689186e5f17b1

                  SHA1

                  3a40fc2dbb38252567c15db4f62b74a8978cc56b

                  SHA256

                  7570712035a77ac08a7e67749b309838d182d1508b5ef957086b01c774f064bd

                  SHA512

                  86ac3e48387a97114712e5459c16c66f76954089692f1c4f0f3066d6d4f7ed04e763393b13a35db4acbefec5a415c0852801031be8ac84ab7edcbbd0f2cd372f

                  Download Submit

                • \Users\Admin\AppData\Local\Temp\nse9A5E.tmp\System.dll
                  Filesize

                  11KB

                  MD5

                  a4dd044bcd94e9b3370ccf095b31f896

                  SHA1

                  17c78201323ab2095bc53184aa8267c9187d5173

                  SHA256

                  2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc

                  SHA512

                  87335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a

                  Download Submit

                • \Users\Admin\AppData\Local\Temp\nseA2E6.tmp\System.dll
                  Filesize

                  11KB

                  MD5

                  3e6bf00b3ac976122f982ae2aadb1c51

                  SHA1

                  caab188f7fdc84d3fdcb2922edeeb5ed576bd31d

                  SHA256

                  4ff9b2678d698677c5d9732678f9cf53f17290e09d053691aac4cc6e6f595cbe

                  SHA512

                  1286f05e6a7e6b691f6e479638e7179897598e171b52eb3a3dc0e830415251069d29416b6d1ffc6d7dce8da5625e1479be06db9b7179e7776659c5c1ad6aa706

                  Download Submit

                • \Users\Admin\AppData\Local\Temp\nstA5B3.tmp\System.dll
                  Filesize

                  11KB

                  MD5

                  b8992e497d57001ddf100f9c397fcef5

                  SHA1

                  e26ddf101a2ec5027975d2909306457c6f61cfbd

                  SHA256

                  98bcd1dd88642f4dd36a300c76ebb1ddfbbbc5bfc7e3b6d7435dc6d6e030c13b

                  SHA512

                  8823b1904dccfaf031068102cb1def7958a057f49ff369f0e061f1b4db2090021aa620bb8442a2a6ac9355bb74ee54371dc2599c20dc723755a46ede81533a3c

                  Download Submit

                • \Users\Admin\AppData\Local\Temp\nszA66E.tmp\nsisunz.dll
                  Filesize

                  40KB

                  MD5

                  5f13dbc378792f23e598079fc1e4422b

                  SHA1

                  5813c05802f15930aa860b8363af2b58426c8adf

                  SHA256

                  6e87ecb7f62039fbb6e7676422d1a5e75a32b90dde6865dcb68ee658ba8df61d

                  SHA512

                  9270635a5294482f49e0292e26d45dd103b85fe27dc163d44531b095c5f9dbde6b904adaf1a888ba3c112a094380394713c796f5195b2566a20f00b42b6578e5

                  Download Submit

                • \Users\Admin\Desktop\00285\Trojan-Ransom.Win32.Zerber.dfhj-14a4201d2cf744d3a2561141357f54b98105cf8ca1a41deb8f2d756e1ce4b469.exe
                  Filesize

                  440KB

                  MD5

                  749bbb8a528867d22dff43a0d1b7c519

                  SHA1

                  67bf768f035f00e8142cfb44072b97d07a9c7af2

                  SHA256

                  14a4201d2cf744d3a2561141357f54b98105cf8ca1a41deb8f2d756e1ce4b469

                  SHA512

                  2d43bdb31472421cf25a72ff9200de317c75e1aa99c399ce2e1b09565608443522117be2b4f6f5a5570c301d1c877b63ec04691e78231995b2b912c2996a0c0c

                  Download Submit

                • memory/476-232-0x00000000743B0000-0x00000000743B3000-memory.dmp

                  Filesize

                  12KB

                  Download

                • memory/476-198-0x0000000000140000-0x0000000000152000-memory.dmp

                  Filesize

                  72KB

                  Download

                • memory/476-197-0x0000000000140000-0x0000000000152000-memory.dmp

                  Filesize

                  72KB

                  Download

                • memory/476-199-0x0000000000140000-0x0000000000152000-memory.dmp

                  Filesize

                  72KB

                  Download

                • memory/676-183-0x0000000000340000-0x0000000000355000-memory.dmp

                  Filesize

                  84KB

                  Download

                • memory/816-208-0x0000000000400000-0x000000000043A000-memory.dmp

                  Filesize

                  232KB

                  Download

                • memory/816-215-0x0000000000400000-0x000000000043A000-memory.dmp

                  Filesize

                  232KB

                  Download

                • memory/816-202-0x0000000000400000-0x000000000043A000-memory.dmp

                  Filesize

                  232KB

                  Download

                • memory/816-212-0x0000000000400000-0x000000000043A000-memory.dmp

                  Filesize

                  232KB

                  Download

                • memory/816-217-0x0000000000400000-0x000000000043A000-memory.dmp

                  Filesize

                  232KB

                  Download

                • memory/816-229-0x0000000000400000-0x000000000043A000-memory.dmp

                  Filesize

                  232KB

                  Download

                • memory/816-204-0x0000000000400000-0x000000000043A000-memory.dmp

                  Filesize

                  232KB

                  Download

                • memory/816-206-0x0000000000400000-0x000000000043A000-memory.dmp

                  Filesize

                  232KB

                  Download

                • memory/816-210-0x0000000000400000-0x000000000043A000-memory.dmp

                  Filesize

                  232KB

                  Download

                • memory/1184-218-0x0000000002D10000-0x0000000002D22000-memory.dmp

                  Filesize

                  72KB

                  Download

                • memory/1184-193-0x0000000002D10000-0x0000000002D22000-memory.dmp

                  Filesize

                  72KB

                  Download

                • memory/1840-243-0x0000000000400000-0x0000000000421000-memory.dmp

                  Filesize

                  132KB

                  Download

                • memory/1840-139-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1840-151-0x0000000000400000-0x0000000000421000-memory.dmp

                  Filesize

                  132KB

                  Download

                • memory/1840-196-0x0000000000400000-0x0000000000421000-memory.dmp

                  Filesize

                  132KB

                  Download

                • memory/1840-140-0x0000000000400000-0x0000000000421000-memory.dmp

                  Filesize

                  132KB

                  Download

                • memory/1840-149-0x0000000000400000-0x0000000000421000-memory.dmp

                  Filesize

                  132KB

                  Download

                • memory/1840-154-0x0000000000400000-0x0000000000421000-memory.dmp

                  Filesize

                  132KB

                  Download

                • memory/1840-147-0x0000000000400000-0x0000000000421000-memory.dmp

                  Filesize

                  132KB

                  Download

                • memory/1840-143-0x0000000000400000-0x0000000000421000-memory.dmp

                  Filesize

                  132KB

                  Download

                • memory/1840-145-0x0000000000400000-0x0000000000421000-memory.dmp

                  Filesize

                  132KB

                  Download

                • memory/2016-589-0x0000000140000000-0x00000001405E8000-memory.dmp

                  Filesize

                  5.9MB

                  Download

                • memory/2016-584-0x0000000140000000-0x00000001405E8000-memory.dmp

                  Filesize

                  5.9MB

                  Download

                • memory/2016-30-0x0000000140000000-0x00000001405E8000-memory.dmp

                  Filesize

                  5.9MB

                  Download

                • memory/2016-32-0x0000000140000000-0x00000001405E8000-memory.dmp

                  Filesize

                  5.9MB

                  Download

                • memory/2016-31-0x0000000140000000-0x00000001405E8000-memory.dmp

                  Filesize

                  5.9MB

                  Download

                • memory/2240-417-0x0000000000400000-0x0000000000439000-memory.dmp

                  Filesize

                  228KB

                  Download

                • memory/2240-120-0x0000000000400000-0x0000000000439000-memory.dmp

                  Filesize

                  228KB

                  Download

                • memory/2240-116-0x0000000000400000-0x0000000000439000-memory.dmp

                  Filesize

                  228KB

                  Download

                • memory/2240-119-0x0000000000400000-0x0000000000439000-memory.dmp

                  Filesize

                  228KB

                  Download

                • memory/2240-593-0x0000000000400000-0x0000000000439000-memory.dmp

                  Filesize

                  228KB

                  Download

                • memory/2240-225-0x0000000000400000-0x0000000000439000-memory.dmp

                  Filesize

                  228KB

                  Download

                • memory/2240-118-0x0000000000400000-0x0000000000439000-memory.dmp

                  Filesize

                  228KB

                  Download

                • memory/2336-249-0x0000000000400000-0x0000000000431000-memory.dmp

                  Filesize

                  196KB

                  Download

                • memory/2336-189-0x0000000000400000-0x0000000000431000-memory.dmp

                  Filesize

                  196KB

                  Download

                • memory/2336-191-0x0000000000400000-0x0000000000431000-memory.dmp

                  Filesize

                  196KB

                  Download

                • memory/2588-221-0x0000000000400000-0x00000000004F8000-memory.dmp

                  Filesize

                  992KB

                  Download

                • memory/2588-125-0x00000000003F0000-0x00000000003F7000-memory.dmp

                  Filesize

                  28KB

                  Download

                • memory/2600-238-0x0000000000400000-0x0000000000404000-memory.dmp

                  Filesize

                  16KB

                  Download

                • memory/2600-242-0x0000000000400000-0x0000000000404000-memory.dmp

                  Filesize

                  16KB

                  Download

                • memory/2776-70-0x0000000000400000-0x000000000047A000-memory.dmp

                  Filesize

                  488KB

                  Download

                • memory/2776-71-0x0000000000400000-0x000000000047A000-memory.dmp

                  Filesize

                  488KB

                  Download

                • memory/2796-270-0x0000000000400000-0x00000000004A9000-memory.dmp

                  Filesize

                  676KB

                  Download

                • memory/2796-75-0x0000000000400000-0x00000000004A9000-memory.dmp

                  Filesize

                  676KB

                  Download

                • memory/2796-427-0x0000000000400000-0x00000000004A9000-memory.dmp

                  Filesize

                  676KB

                  Download