Overview

overview

10

Static

static

10

516475caf3...fd.exe

windows7-x64

10

516475caf3...fd.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    24/01/2025, 04:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    516475caf3fbd1f0c0283572550528f1f9e7b502dce5fb6b89d40f366a150bfd.exe
  • Size 211KB
  • Sample250124-e9fzbs1ngm
  • SHA256 516475caf3fbd1f0c0283572550528f1f9e7b502dce5fb6b89d40f366a150bfd
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
buranzeppelindefense_evasiondiscoveryexecutionimpactpersistenceransomware

Malware Config

Extracted

Path

  • C:\Program Files\Java\jdk1.7.0_80\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

  • buran

Ransom Note
  • !!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] or [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] Your personal ID: 309-C8D-714 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Signatures

  • Buran

    Ransomware-as-a-service based on the VegaLocker family first identified in 2019.

    ransomwareburan
  • Buran family
    buran
  • Detects Zeppelin payload 9 IoCs
  • Zeppelin Ransomware

    Ransomware-as-a-service (RaaS) written in Delphi and first seen in 2019.

    ransomwarezeppelin
  • Zeppelin family
    zeppelin
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (7386) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Deletes itself 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies system certificate store 2 TTPs 5 IoCs
    defense_evasionspywaretrojan
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\516475caf3fbd1f0c0283572550528f1f9e7b502dce5fb6b89d40f366a150bfd.exe
    "C:\Users\Admin\AppData\Local\Temp\516475caf3fbd1f0c0283572550528f1f9e7b502dce5fb6b89d40f366a150bfd.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2324
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\csrss.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\csrss.exe" -start
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2652
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\csrss.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\csrss.exe" -agent 0
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        PID:1716
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\csrss.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\csrss.exe" -agent 1
        3⤵
        • Executes dropped EXE
        PID:2280
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
        3⤵
        • System Location Discovery: System Language Discovery
        PID:540
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1528
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2892
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C wbadmin delete systemstatebackup
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2156
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C wbadmin delete systemstatebackup -keepversions:0
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1752
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C wbadmin delete backup
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2332
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2376
        • C:\Windows\SysWOW64\Wbem\WMIC.exe
          wmic shadowcopy delete
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2612
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2532
        • C:\Windows\SysWOW64\vssadmin.exe
          vssadmin delete shadows /all /quiet
          4⤵
          • System Location Discovery: System Language Discovery
          • Interacts with shadow copies
          PID:2668
      • C:\Windows\SysWOW64\notepad.exe
        notepad.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:876
    • C:\Windows\SysWOW64\notepad.exe
      notepad.exe
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:2796
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2076

Network

        MITRE ATT&CK Enterprise v15

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Windows Management Instrumentation

        1
        T1047

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Defense Evasion

        Direct Volume Access

        1
        T1006

        Indicator Removal

        2
        T1070

        File Deletion

        2
        T1070.004

        Modify Registry

        2
        T1112

        Subvert Trust Controls

        1
        T1553

        Install Root Certificate

        1
        T1553.004

        Credential Access

        Discovery

        Peripheral Device Discovery

        1
        T1120

        Query Registry

        1
        T1012

        System Information Discovery

        2
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Lateral Movement

        Collection

        Command and Control

        Web Service

        1
        T1102

        Exfiltration

        Impact

        Inhibit System Recovery

        2
        T1490

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Vdk10.lng
        • Path C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\Vdk10.lng
        • Size 23KB
        • SHA256 d80916ecec8bf641f19886b58b2be7172419ec9e56ed11a79312d1c362f80ef3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        DisplayLanguageNames.en_GB.txt
        • Path C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB.txt
        • Size 29KB
        • SHA256 f9428b4e13251b203cd8282993e2bd0a738d0d99a71dbfcd5bf382c211c402d7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        DisplayLanguageNames.en_US_POSIX.txt
        • Path C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt
        • Size 29KB
        • SHA256 3dfdf06518a75dee5b8f8220d5526a4603500727e0ba6b81ec46a5e72d309dc1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        SCHEME54.CSS
        • Path C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME54.CSS
        • Size 125KB
        • SHA256 5c34c47aac45bd22266c62220a53406e890a92671b6a0a53bd3b85093103fb77
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        EXLIRMV.XML
        • Path C:\Program Files (x86)\Microsoft Office\Office14\EXLIRMV.XML
        • Size 78KB
        • SHA256 ab0f9acfffd86ddacbe18e6d1040b737baa8009fb0feb28b8db55f9515fe4c29
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        AlertImage_OffMask.bmp
        • Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_OffMask.bmp
        • Size 8KB
        • SHA256 548f0cc87a81e174d242617b20c85b7123373a611e3ac661a4b28f1fdf169f10
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        IPIRMV.XML
        • Path C:\Program Files (x86)\Microsoft Office\Office14\IPIRMV.XML
        • Size 78KB
        • SHA256 995f13e433a00ed3d77446653a8f231a78e2d93e30dc908833fd3e1599fd3112
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Microsoft.Office.InfoPath.xml
        • Path C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\Microsoft.Office.InfoPath.xml
        • Size 249KB
        • SHA256 3dc3caaeaf9425dd6f8411587afc411a550d1352c387890f2a8a3cbae563dc1a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        PPTIRMV.XML
        • Path C:\Program Files (x86)\Microsoft Office\Office14\PPTIRMV.XML
        • Size 79KB
        • SHA256 4f9f5053f9274edbb58dca43cbc9f7438ec9e7936cd1b915ca3171afcced2a3e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        !!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT
        • Path C:\Program Files\Java\jdk1.7.0_80\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT
        • Size 985B
        • SHA256 f0241c659e189307d4bbeed39816e0b5cf9190eb34098b83b10e99006f99dada
        • MD5 SHA1 SHA512
        Submit Download

        feature.properties
        • Path C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\feature.properties
        • Size 7KB
        • SHA256 4daff2da7d9cc289098a5739e80620451ed0378df455a82b0615ffaa6558a375
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        license.html
        • Path C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\license.html
        • Size 7KB
        • SHA256 fe11606a09abacd351eee6e71968bac3c79932e93c429ebc3a3a6cbd70fd4579
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        license.html
        • Path C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\license.html
        • Size 10KB
        • SHA256 26a6604e28b69d3299853fb95e687ba55333694ec7d9a90e5039d6356f673ddb
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        license.html
        • Path C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\license.html
        • Size 10KB
        • SHA256 290351d2eee1c22af9356a98811e4ad3631242ce84099c8924d4d2266be26714
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        license.html
        • Path C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\license.html
        • Size 10KB
        • SHA256 2b72ad2a77378473f522ecc5ff4b7babd5dd57eaf77c26a2ee728ebac821f838
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        epl-v10.html
        • Path C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\epl-v10.html
        • Size 13KB
        • SHA256 66cf1e7538608972b3daf1135a3b7ac0f2617142ba79df9f3e626926ed7b1a22
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        vlc.mo
        • Path C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\vlc.mo
        • Size 586KB
        • SHA256 0b10a6f5925e325deb500a0bc8b565802d96b2cb1501a0345372dc33806a8169
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        vlc.mo
        • Path C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\vlc.mo
        • Size 605KB
        • SHA256 19681cf0eed80d2ca7200327346da6e2d7c8ac7eb22428105b74fe80a45810b9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        vlc.mo
        • Path C:\Program Files\VideoLAN\VLC\locale\it\LC_MESSAGES\vlc.mo
        • Size 612KB
        • SHA256 b2230a1f011fda683f7f52d5ef637d6acd4319239f4a01fd38fd21c63177f4ec
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        vlc.mo
        • Path C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\vlc.mo
        • Size 1.1MB
        • SHA256 485a69002d2fa797d120985532e6b308e08d7fea43c32a2b0956cd3cd48417f0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        vlc.mo
        • Path C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\vlc.mo
        • Size 606KB
        • SHA256 91356b4188bc0458834327d4eaaa81d937dd7cabbf365d4f9fb9481f5b8088c5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        vlc.mo
        • Path C:\Program Files\VideoLAN\VLC\locale\sl\LC_MESSAGES\vlc.mo
        • Size 594KB
        • SHA256 7b07b98ca52017884222954fba5aff9c96c9ca82366578c5b53ae9ce4c672a76
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        vlc.mo
        • Path C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\vlc.mo
        • Size 780KB
        • SHA256 35dc0331259b65a527faa8906f29506f441468d606320724c8a22ce4813c9cf3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
        • Size 2KB
        • SHA256 2f9a549e940c54a86748cc9076a3992a3bc622101c005c2b7cc75b9820493b92
        • MD5 SHA1 SHA512
        Submit Download

        204C1AA6F6114E6A513754A2AB5760FA_268232F9B7ADFD0751C3D83F667CFB78
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\204C1AA6F6114E6A513754A2AB5760FA_268232F9B7ADFD0751C3D83F667CFB78
        • Size 472B
        • SHA256 6eca0195a3b9d0d1feecd3dcef92594a1d9bdb040984b70bbd025a9fd719982a
        • MD5 SHA1 SHA512
        Submit Download

        B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
        • Size 1KB
        • SHA256 f198314ee09f7adc845d9fe2f67e9c06c63430c4b3ee0946d1e5b2a88d8bb997
        • MD5 SHA1 SHA512
        Submit Download

        07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
        • Size 484B
        • SHA256 fffac7da3bb2d2b015e13805fa55934665296f57a5a2ea7214376dde38fd2368
        • MD5 SHA1 SHA512
        Submit Download

        204C1AA6F6114E6A513754A2AB5760FA_268232F9B7ADFD0751C3D83F667CFB78
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\204C1AA6F6114E6A513754A2AB5760FA_268232F9B7ADFD0751C3D83F667CFB78
        • Size 488B
        • SHA256 c02c0226c896d19ee9076240641624270a797db3bd6258c3aa91d33830671f13
        • MD5 SHA1 SHA512
        Submit Download

        94308059B57B3142E455B38A6EB92015
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        • Size 342B
        • SHA256 8cca7b57dff48b249c80c4a4c79a06eb5e0281135661ac5d341a972efe410702
        • MD5 SHA1 SHA512
        Submit Download

        B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
        • Size 482B
        • SHA256 9472c91ed4ec4b95d91c04dfbb805a81e6475bb2a6aa9250064f9b9a45b834ad
        • MD5 SHA1 SHA512
        Submit Download

        K58B24EU.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DJB1KT77\K58B24EU.htm
        • Size 190B
        • SHA256 a563426e24d132cd87b70d9cb5cd3d57c2e1428873a3f3eb94649cf42e37b6a1
        • MD5 SHA1 SHA512
        Submit Download

        XK93ITTZ.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MPUI9R2R\XK93ITTZ.htm
        • Size 18KB
        • SHA256 44b3cbfb57079b2570e5ae94942d8e00ce0291c26317c2649a41101018bab25a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Cab9781.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\Cab9781.tmp
        • Size 70KB
        • SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Tar9793.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\Tar9793.tmp
        • Size 181KB
        • SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        AssertSkip.xlsx.309-C8D-714
        • Path C:\Users\Admin\Desktop\AssertSkip.xlsx.309-C8D-714
        • Size 14KB
        • SHA256 315c83b001673b91e47bb6d8ea3c2ce1eb68bd54565998caf87fdf01354affdb
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ConnectDisable.pptm.309-C8D-714
        • Path C:\Users\Admin\Desktop\ConnectDisable.pptm.309-C8D-714
        • Size 390KB
        • SHA256 c62a730e2621322f613af89abc1e78f39cbe38de33c1c31661f1661cfba0d9bd
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ConvertWatch.MTS.309-C8D-714
        • Path C:\Users\Admin\Desktop\ConvertWatch.MTS.309-C8D-714
        • Size 272KB
        • SHA256 270f0dba43b6c5b723861c0ff12cb8314fa63c742eb3aa8987ab3645311b8b76
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        CopyResume.vsdx.309-C8D-714
        • Path C:\Users\Admin\Desktop\CopyResume.vsdx.309-C8D-714
        • Size 526KB
        • SHA256 1e2097e68cc2c1cebaa9d1a8e9bb81f5011d63f167d95960d7727b744df88af9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        EnableWrite.potx.309-C8D-714
        • Path C:\Users\Admin\Desktop\EnableWrite.potx.309-C8D-714
        • Size 424KB
        • SHA256 e35ab41d3911d2609254e8cb1bc0537006ed04cbde1bb1c5c1f46d2d0823eea9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        FormatApprove.xlsb.309-C8D-714
        • Path C:\Users\Admin\Desktop\FormatApprove.xlsb.309-C8D-714
        • Size 187KB
        • SHA256 ecfd20ed9771a8bfbde80504d07af9558d8f8157bac99c3bfe0c548c16a16849
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        GroupConfirm.kix.309-C8D-714
        • Path C:\Users\Admin\Desktop\GroupConfirm.kix.309-C8D-714
        • Size 255KB
        • SHA256 94b75aa873f2fdebabfb7c5b2651e66e167d3145955f355decbc118835cc701b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ImportDebug.dwfx.309-C8D-714
        • Path C:\Users\Admin\Desktop\ImportDebug.dwfx.309-C8D-714
        • Size 509KB
        • SHA256 bad680c205282eb41d1210d69798cd3d9f87bd82215c009029078ebf5811f530
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        InstallBackup.rm.309-C8D-714
        • Path C:\Users\Admin\Desktop\InstallBackup.rm.309-C8D-714
        • Size 357KB
        • SHA256 ac94505f4ad2154509c273b04403054d5fc8e007f39ce56c25542d0dd162f297
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        InstallEnable.docx.309-C8D-714
        • Path C:\Users\Admin\Desktop\InstallEnable.docx.309-C8D-714
        • Size 475KB
        • SHA256 13c62c21c4cd5900028d0a3b09de60e4f09f6c2232ee0483b7379438ec643447
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        InvokeUnlock.mp4.309-C8D-714
        • Path C:\Users\Admin\Desktop\InvokeUnlock.mp4.309-C8D-714
        • Size 221KB
        • SHA256 acc15abf7b6faee3f0bafb263e3d99d07fc6a96fccb622adaaf84da32bcc6d88
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        JoinEnter.xps.309-C8D-714
        • Path C:\Users\Admin\Desktop\JoinEnter.xps.309-C8D-714
        • Size 441KB
        • SHA256 989f6869311adc82d6eb679c1b40ef517de0f3a0f1a95575d39d9311d3a4da3f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        LimitSuspend.xps.309-C8D-714
        • Path C:\Users\Admin\Desktop\LimitSuspend.xps.309-C8D-714
        • Size 289KB
        • SHA256 043301519ded83f643979f620881bd0d446028a5988c5d1125627b25e5d2aeb1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        RemoveCompress.ex_.309-C8D-714
        • Path C:\Users\Admin\Desktop\RemoveCompress.ex_.309-C8D-714
        • Size 374KB
        • SHA256 de8ee28ef3d1188e982c7b59be0b03db310de7d81abfec714314c114795901de
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        RemoveSync.3gpp.309-C8D-714
        • Path C:\Users\Admin\Desktop\RemoveSync.3gpp.309-C8D-714
        • Size 204KB
        • SHA256 d7d717235e7121399bd73f5bff504b6021243763a98677739a4f8cc5ee13545d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ResetSave.xlsx.309-C8D-714
        • Path C:\Users\Admin\Desktop\ResetSave.xlsx.309-C8D-714
        • Size 14KB
        • SHA256 cf82eca6202db6602c80c480c68d92b6046c69c2b7cba2cf9e8d8a7f03aa9ec6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        SearchSet.M2V.309-C8D-714
        • Path C:\Users\Admin\Desktop\SearchSet.M2V.309-C8D-714
        • Size 323KB
        • SHA256 2be49a494b2b2a9584aaea9067bdbe8d9d2178a1bb260f00ad69fbc169b748e6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        SendStart.dwfx.309-C8D-714
        • Path C:\Users\Admin\Desktop\SendStart.dwfx.309-C8D-714
        • Size 238KB
        • SHA256 bf75a2ccba5036d19d1c8a77911040cf4c7ff02625c1426d0551dc650acf2aac
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        SplitBlock.exe.309-C8D-714
        • Path C:\Users\Admin\Desktop\SplitBlock.exe.309-C8D-714
        • Size 729KB
        • SHA256 93331fc4ca1802180d563646b45dc66ea984351d50b3fb38f58f8eddc352838e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        SuspendResolve.mov.309-C8D-714
        • Path C:\Users\Admin\Desktop\SuspendResolve.mov.309-C8D-714
        • Size 458KB
        • SHA256 85fb583dfbb9550167199e4a4bf309167db328226d3bbbc2a2ef8367bb58aa23
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        SwitchSuspend.svgz.309-C8D-714
        • Path C:\Users\Admin\Desktop\SwitchSuspend.svgz.309-C8D-714
        • Size 306KB
        • SHA256 98fb8319fd57ed91a81c04477610e70996315b21ad8ae747f4f52d054438f241
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        TestRename.ADTS.309-C8D-714
        • Path C:\Users\Admin\Desktop\TestRename.ADTS.309-C8D-714
        • Size 492KB
        • SHA256 a2a2b924f21974b68bd1ecd88c67adefaa20700debc56d765511a61b546446b0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        TraceOut.vsdx.309-C8D-714
        • Path C:\Users\Admin\Desktop\TraceOut.vsdx.309-C8D-714
        • Size 407KB
        • SHA256 e828f9c350891cfdf65841ecb107d4ef7df4e72b781d1e69de41dd7589613baf
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        UpdateGet.mhtml.309-C8D-714
        • Path C:\Users\Admin\Desktop\UpdateGet.mhtml.309-C8D-714
        • Size 340KB
        • SHA256 f09964b691678d9ea12a4d4162ef99b9940dd367b38b36af37c4fc179df4f69a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        vcredist2010_x86.log.html
        • Path C:\vcredist2010_x86.log.html
        • Size 82KB
        • SHA256 53cd835b6fcb599c72ec3d149d477ed6458f8a9c7258789bb776d8ada68e3e94
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        csrss.exe
        • Path \Users\Admin\AppData\Roaming\Microsoft\Windows\csrss.exe
        • Size 211KB
        • SHA256 516475caf3fbd1f0c0283572550528f1f9e7b502dce5fb6b89d40f366a150bfd
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/876-30252-0x00000000000E0000-0x00000000000E1000-memory.dmp
        Download

        memory/1716-29757-0x00000000012E0000-0x0000000001420000-memory.dmp
        Download

        memory/1716-21808-0x00000000012E0000-0x0000000001420000-memory.dmp
        Download

        memory/1716-10851-0x00000000012E0000-0x0000000001420000-memory.dmp
        Download

        memory/1716-30221-0x00000000012E0000-0x0000000001420000-memory.dmp
        Download

        memory/2280-105-0x00000000012E0000-0x0000000001420000-memory.dmp
        Download

        memory/2324-88-0x0000000001370000-0x00000000014B0000-memory.dmp
        Download

        memory/2652-3885-0x00000000012E0000-0x0000000001420000-memory.dmp
        Download

        memory/2652-30253-0x00000000012E0000-0x0000000001420000-memory.dmp
        Download

        memory/2796-66-0x0000000000080000-0x0000000000081000-memory.dmp
        Download

        memory/2796-70-0x00000000000A0000-0x00000000000A1000-memory.dmp
        Download