Overview

overview

10

Static

static

10

516475caf3...fd.exe

windows7-x64

10

516475caf3...fd.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    94s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/01/2025, 04:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    516475caf3fbd1f0c0283572550528f1f9e7b502dce5fb6b89d40f366a150bfd.exe
  • Size 211KB
  • Sample250124-e9fzbs1ngm
  • SHA256 516475caf3fbd1f0c0283572550528f1f9e7b502dce5fb6b89d40f366a150bfd
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
buranzeppelindefense_evasiondiscoveryexecutionimpactpersistenceransomware

Malware Config

Extracted

Path

  • C:\Program Files\Crashpad\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT

  • buran

Ransom Note
  • !!! ALL YOUR FILES ARE ENCRYPTED !!! All your files, documents, photos, databases and other important files are encrypted. You are not able to decrypt it by yourself! The only method of recovering files is to purchase an unique private key. Only we can give you this key and only we can recover your files. To be sure we have the decryptor and it works you can send an email: [email protected] or [email protected] and decrypt one file for free. But this file should be of not valuable! Do you really want to restore your files? Write to email: [email protected] Reserved email: [email protected] Your personal ID: E8E-1E5-D95 Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam.

Signatures

  • Buran

    Ransomware-as-a-service based on the VegaLocker family first identified in 2019.

    ransomwareburan
  • Buran family
    buran
  • Detects Zeppelin payload 12 IoCs
  • Zeppelin Ransomware

    Ransomware-as-a-service (RaaS) written in Delphi and first seen in 2019.

    ransomwarezeppelin
  • Zeppelin family
    zeppelin
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (6068) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\516475caf3fbd1f0c0283572550528f1f9e7b502dce5fb6b89d40f366a150bfd.exe
    "C:\Users\Admin\AppData\Local\Temp\516475caf3fbd1f0c0283572550528f1f9e7b502dce5fb6b89d40f366a150bfd.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1284
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe" -start
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3660
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe" -agent 0
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        PID:2248
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe" -agent 1
        3⤵
        • Executes dropped EXE
        PID:740
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1296
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C bcdedit /set {default} recoveryenabled no
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3680
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C wbadmin delete catalog -quiet
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3772
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C wbadmin delete systemstatebackup
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2464
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C wbadmin delete systemstatebackup -keepversions:0
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2412
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C wbadmin delete backup
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4020
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C wmic shadowcopy delete
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3236
        • C:\Windows\SysWOW64\Wbem\WMIC.exe
          wmic shadowcopy delete
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:5024
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C vssadmin delete shadows /all /quiet
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4148
      • C:\Windows\SysWOW64\notepad.exe
        notepad.exe
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4596
    • C:\Windows\SysWOW64\notepad.exe
      notepad.exe
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:672
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4256

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        aic_file_icons_retina_thumb_highContrast_bow.png
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_retina_thumb_highContrast_bow.png
        • Size 52KB
        • SHA256 11286fe53f534c8c269991a73270bf1290e8db731c75262f37a68a2388306cff
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        aic_file_icons_retina_thumb_highContrast_wob.png
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\aic_file_icons_retina_thumb_highContrast_wob.png
        • Size 52KB
        • SHA256 1dd2a4a84cdab14833f74aa284abef4745bbf08b2354ef3c587bbd85a1f58b93
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        aic_file_icons.png
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\aic_file_icons.png
        • Size 52KB
        • SHA256 51da7d34b3549ed40b66628b5400e608c8fb6f392d34e752d80865e95e660ad0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ui-strings.js
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\fr-ma\ui-strings.js
        • Size 34KB
        • SHA256 5ac37928e04224552fa23102d3e1e7edc034700a3e0e22877f1d21b1b79d7c79
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ui-strings.js
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\fr-ma\ui-strings.js
        • Size 10KB
        • SHA256 992ea26010f6ab9902f8ca88ef061f7789d1f24fbf3a7a1a9188670de10f5be7
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ui-strings.js
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\en-il\ui-strings.js
        • Size 5KB
        • SHA256 76f581fe3f30b18d68d21b6438f13502cb3a84150a396f0a705070fe9e665c2c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ui-strings.js
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\fr-ma\ui-strings.js
        • Size 6KB
        • SHA256 b7998995ee0c318d90501be4b7896383be0bc7539a0377d54dc5f74834bfb268
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        illustrations_retina.png
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\illustrations_retina.png
        • Size 20KB
        • SHA256 b510227c569572c9f62070c64bd638034eb252a2fd6321610162ca70eeb93fef
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        exportpdf-tool-view.js
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\exportpdf-tool-view.js
        • Size 395KB
        • SHA256 b72adc504a2e4f64e98505e22938013bd568767a5901ebad319bd63b22728885
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        convertpdf-rna-selector.js
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\rhp\convertpdf-rna-selector.js
        • Size 176KB
        • SHA256 a32c978d7da1eac922b66836aadb1472eb60053c25d46fbdb7e800668d01e6af
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ui-strings.js
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-ma\ui-strings.js
        • Size 12KB
        • SHA256 4477b32436d7bb33d66fccc530d5d9211bed6bd3fad47e7fec4c1f0adecad07b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        icons.png
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\icons.png
        • Size 9KB
        • SHA256 bb298a8021c398b27a42aafab18ef8853dfa2c914783b8e71a1025974f416143
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        icons_ie8.gif
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\icons_ie8.gif
        • Size 9KB
        • SHA256 2793e04099175b1bd01e36fcd77b730765bf81b6e5060a0a0de35af71fb4e961
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        icons_retina.png
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\icons_retina.png
        • Size 16KB
        • SHA256 753a2dd21dddd3f0ac2d7d99fb28c449504b43b4ba428d7f332f0f9610bfe05a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ui-strings.js
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-il\ui-strings.js
        • Size 6KB
        • SHA256 363c2fd758d1c9cc3ea6fe4f970dee0e8a89490085346b3cdc6d9769e3de1281
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ui-strings.js
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fr-ma\ui-strings.js
        • Size 7KB
        • SHA256 aa42ad6493a9b1575417d4a7626bd373e7d64b7f6051926f9b86e2e8cf161e2e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        selector.js
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\selector.js
        • Size 48KB
        • SHA256 86647fdeaca0467c3de0194750086ac198edd76952d958f156832f423edecb2b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MobileAcrobatCard_Light.pdf
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Light.pdf
        • Size 381KB
        • SHA256 43d8b34a0fa933318d71c805e484677490e70a1ea550600bd0738c20665c2c51
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MobileScanCard_Light.pdf
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Light.pdf
        • Size 56KB
        • SHA256 22e4c208c71768102ef9e369aa8a9e996a198f41ce175543ee748c232f25768c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ui-strings.js
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-il\ui-strings.js
        • Size 14KB
        • SHA256 9ae7b1e92536b0581dda7dd5d9950d488b8d9b009955403f74dd997d68cfc58f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ui-strings.js
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-il\ui-strings.js
        • Size 15KB
        • SHA256 11cdb55c77a9eb4049cdf1adb225f474574e976b7ebb44ff20130760824852d0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        core_icons.png
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\core_icons.png
        • Size 10KB
        • SHA256 15257be9c6c30ca9a6345a54b9d0d51853050d0eb40176683303fd0a5ea7ad37
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ui-strings.js
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\en-il\ui-strings.js
        • Size 9KB
        • SHA256 719151eef2fcc2e0ef6c581613c1d7a1228097fccf9dde6600678a4b69a08035
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ui-strings.js
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-ma\ui-strings.js
        • Size 11KB
        • SHA256 7b1b25fcbe4bf12f826d5c7a5e6980aff0623c4bfa0c8ae8aebf6c44cb084aab
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ui-strings.js
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fr-ma\ui-strings.js
        • Size 17KB
        • SHA256 7ba852299e006c418cbcbb49a79aca8812b041d0dbf74a87cac3961d32a943ce
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ui-strings.js
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\fr-ma\ui-strings.js
        • Size 18KB
        • SHA256 6ef7247cde79b08bba0c55133fc6c5dacdc7a2d496c5595627fa1118f10edd3c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ui-strings.js
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\en-il\ui-strings.js
        • Size 19KB
        • SHA256 42af3a79979f41c6289275bfd6b22c45725f76f23c7ffef7c495e051aae53cd4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ui-strings.js
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\fr-ma\ui-strings.js
        • Size 23KB
        • SHA256 c1648a6269076e85a2b1a7a6930d45e01b64a4623fc5db224677d43962846e1f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        !!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT
        • Path C:\Program Files\Crashpad\!!! ALL YOUR FILES ARE ENCRYPTED !!!.TXT
        • Size 985B
        • SHA256 48af9ebd5536e69433ab8275f17054f77b5080cdba04e73abcca55cfcd99afa5
        • MD5 SHA1 SHA512
        Submit Download

        OfficeClickToRun.exe
        • Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
        • Size 4.1MB
        • SHA256 ee0fe82cdd16b9cef61c06c1ff15501b54a6eee364876ac95eda18d0fc61d250
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ISO690.XSL
        • Path C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\ISO690.XSL
        • Size 265KB
        • SHA256 0fe145ea87c9e0866d4e04ce0929e9497630dcf3dfff4801b5e0c247af68214c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        osmdp64.msi
        • Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\osmdp64.msi
        • Size 2.4MB
        • SHA256 3fff4fb5746e5f1694d5b77594aa5a509c794075338de066e0f04980a0c18f68
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        osmclienticon.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe
        • Size 62KB
        • SHA256 1614edf38064b0cef3cc154eae940d50b095d2e00f1d0af961165fe7677d66d0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        misc.exe
        • Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe
        • Size 1015KB
        • SHA256 3ac3e1399dc39d54f37ff5578062a8dd24dbebe08f388586f9d7341866e8f4fb
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        vlc.mo
        • Path C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\vlc.mo
        • Size 606KB
        • SHA256 f3671593a970b8a2283c6247d9fe3bc9ab2ccb8c518896111740ca7d0af29df0
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        vlc.mo
        • Path C:\Program Files\VideoLAN\VLC\locale\es_MX\LC_MESSAGES\vlc.mo
        • Size 610KB
        • SHA256 49ce00e0711a40b24f213f841a3a7be34fa9bec7586dea1fe488df14d6a6e766
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        vlc.mo
        • Path C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\vlc.mo
        • Size 674KB
        • SHA256 0d808dfe2f9de9c412004277756a9cd3e2e1c53b1c952b152534f31ca8106fe6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        vlc.mo
        • Path C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\vlc.mo
        • Size 1.1MB
        • SHA256 0deaa35e16eae51b5dd267ed7c494f181a68c210ed367446820b5f69dccf7f46
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        vlc.mo
        • Path C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\vlc.mo
        • Size 606KB
        • SHA256 0f36a7f3c9b500e73b92b3d1db7f3b69922978241e1225243828559bccc8313d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        vlc.mo
        • Path C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\vlc.mo
        • Size 773KB
        • SHA256 37adb3e092fb8d951991fff473e16b54698d8508172432ff6d7373088e59006f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        vlc.mo
        • Path C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\vlc.mo
        • Size 780KB
        • SHA256 3267598c4504fc08876b82d79551f54c2d81801a0aadbd72cd5fd7cb9c0275f2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
        • Size 2KB
        • SHA256 2f9a549e940c54a86748cc9076a3992a3bc622101c005c2b7cc75b9820493b92
        • MD5 SHA1 SHA512
        Submit Download

        204C1AA6F6114E6A513754A2AB5760FA_268232F9B7ADFD0751C3D83F667CFB78
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\204C1AA6F6114E6A513754A2AB5760FA_268232F9B7ADFD0751C3D83F667CFB78
        • Size 472B
        • SHA256 6eca0195a3b9d0d1feecd3dcef92594a1d9bdb040984b70bbd025a9fd719982a
        • MD5 SHA1 SHA512
        Submit Download

        B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
        • Size 1KB
        • SHA256 f198314ee09f7adc845d9fe2f67e9c06c63430c4b3ee0946d1e5b2a88d8bb997
        • MD5 SHA1 SHA512
        Submit Download

        07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3F26ED5DE6B4E859CCCA6035ECB8D9CB
        • Size 484B
        • SHA256 dea422ac78fde254d10dc8e72bdc0a15c5205308e67c519b067dea6e5b47d9af
        • MD5 SHA1 SHA512
        Submit Download

        204C1AA6F6114E6A513754A2AB5760FA_268232F9B7ADFD0751C3D83F667CFB78
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\204C1AA6F6114E6A513754A2AB5760FA_268232F9B7ADFD0751C3D83F667CFB78
        • Size 488B
        • SHA256 9d196f142ad631f641be42389e0e813aadae7aba6f49a81ea1609185e2d7c70a
        • MD5 SHA1 SHA512
        Submit Download

        B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
        • Size 482B
        • SHA256 4cd93f4d8b690d72bf7f2a39341547a42e0768e77cc86d756cef93411346bb46
        • MD5 SHA1 SHA512
        Submit Download

        U83ZD5VI.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8R55UT9S\U83ZD5VI.htm
        • Size 190B
        • SHA256 a563426e24d132cd87b70d9cb5cd3d57c2e1428873a3f3eb94649cf42e37b6a1
        • MD5 SHA1 SHA512
        Submit Download

        3XXW52J2.htm
        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YB8IB6GH\3XXW52J2.htm
        • Size 18KB
        • SHA256 44b3cbfb57079b2570e5ae94942d8e00ce0291c26317c2649a41101018bab25a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        TrustedInstaller.exe
        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\TrustedInstaller.exe
        • Size 211KB
        • SHA256 516475caf3fbd1f0c0283572550528f1f9e7b502dce5fb6b89d40f366a150bfd
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        BlockMerge.pcx.E8E-1E5-D95
        • Path C:\Users\Admin\Desktop\BlockMerge.pcx.E8E-1E5-D95
        • Size 695KB
        • SHA256 9a6cfcf91c3e3f260741c78d4089b1613ab62a2ff1f13390b71da806a38239d6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        CompareJoin.wmf.E8E-1E5-D95
        • Path C:\Users\Admin\Desktop\CompareJoin.wmf.E8E-1E5-D95
        • Size 325KB
        • SHA256 642a9179b21c387f9018b2fbc5ce561706d0847239d2e2347b43c97d3d9de737
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        CompleteConvertFrom.au3.E8E-1E5-D95
        • Path C:\Users\Admin\Desktop\CompleteConvertFrom.au3.E8E-1E5-D95
        • Size 394KB
        • SHA256 fe93ef7b3464a160baa8dc97f63202340367cfa74cd2463da21f571d9da393c8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        ConvertUndo.docx.E8E-1E5-D95
        • Path C:\Users\Admin\Desktop\ConvertUndo.docx.E8E-1E5-D95
        • Size 19KB
        • SHA256 a216a63e7aa54bc6516bf0baf296c531a781c933b684d79829fdb68388ea9bf5
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        CopyUnlock.emf.E8E-1E5-D95
        • Path C:\Users\Admin\Desktop\CopyUnlock.emf.E8E-1E5-D95
        • Size 348KB
        • SHA256 8264c67cce4391270f50d02897b106b3580633a601da4850905dcbfc2c424d66
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        DebugRemove.svg.E8E-1E5-D95
        • Path C:\Users\Admin\Desktop\DebugRemove.svg.E8E-1E5-D95
        • Size 579KB
        • SHA256 d18dd55d012c47f8dace1fa873f90b644031032501bb335506a344729e95fcdd
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        DenySplit.aiff.E8E-1E5-D95
        • Path C:\Users\Admin\Desktop\DenySplit.aiff.E8E-1E5-D95
        • Size 279KB
        • SHA256 da2709d445fda80845ffc8bebec5fbec806ed084a972a6b4c95d8e6c77dea41c
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        DisableCopy.mp2v.E8E-1E5-D95
        • Path C:\Users\Admin\Desktop\DisableCopy.mp2v.E8E-1E5-D95
        • Size 787KB
        • SHA256 b46f08007871e6c62839620ee01671c7cfe557aa223c0cee245f621b61973e6d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        DisablePop.pot.E8E-1E5-D95
        • Path C:\Users\Admin\Desktop\DisablePop.pot.E8E-1E5-D95
        • Size 556KB
        • SHA256 aa96f9d7cc5c7436420595dbb46569735230f651a79d789744060723f30b298e
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        FormatShow.htm.E8E-1E5-D95
        • Path C:\Users\Admin\Desktop\FormatShow.htm.E8E-1E5-D95
        • Size 1.1MB
        • SHA256 8421b46c643068b1354ff1407a124eb991751217765b1ac07faf311531ed8f88
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        InstallSuspend.vdw.E8E-1E5-D95
        • Path C:\Users\Admin\Desktop\InstallSuspend.vdw.E8E-1E5-D95
        • Size 487KB
        • SHA256 829a6dff47d5a81a5f384d388c057defcdfe46654e806d31323a469bec353ec2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MeasureTrace.ods.E8E-1E5-D95
        • Path C:\Users\Admin\Desktop\MeasureTrace.ods.E8E-1E5-D95
        • Size 417KB
        • SHA256 d2703e1e8105f911a2a2e4122ca0329ceccdab04dbfe4b3c8a588214e57bb453
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MoveFormat.aiff.E8E-1E5-D95
        • Path C:\Users\Admin\Desktop\MoveFormat.aiff.E8E-1E5-D95
        • Size 463KB
        • SHA256 ba2212764a57300d9f34215d6caa635ba4e8e1d5f7b2c10cfab1e8c26af7a0fb
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        MoveSearch.wav.E8E-1E5-D95
        • Path C:\Users\Admin\Desktop\MoveSearch.wav.E8E-1E5-D95
        • Size 533KB
        • SHA256 a5b7adebf6b10c72f55d4d8c8e7afeea31114260be14d7c6421243d46c668697
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        OutRename.wma.E8E-1E5-D95
        • Path C:\Users\Admin\Desktop\OutRename.wma.E8E-1E5-D95
        • Size 371KB
        • SHA256 726440cd210a59b2a5a199dc0e957b483646448c61aac1558d05d06ba832f7e8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        PushGet.rm.E8E-1E5-D95
        • Path C:\Users\Admin\Desktop\PushGet.rm.E8E-1E5-D95
        • Size 302KB
        • SHA256 a087d219b6b2ceeb263c8199c2bc88880e16adceb7b781a83143c03bc15bcfff
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        RedoComplete.wma.E8E-1E5-D95
        • Path C:\Users\Admin\Desktop\RedoComplete.wma.E8E-1E5-D95
        • Size 648KB
        • SHA256 3368e1087ab7987f6e4ba5eeadc82f6c5fb976748dc60e385fdc2a2c7dbb0fc9
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        RequestClose.js.E8E-1E5-D95
        • Path C:\Users\Admin\Desktop\RequestClose.js.E8E-1E5-D95
        • Size 718KB
        • SHA256 363515f77ccb118be85a988bd9d6a97c489f5a998aa00d0351a21c01ba5f8f67
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        RevokeTrace.csv.E8E-1E5-D95
        • Path C:\Users\Admin\Desktop\RevokeTrace.csv.E8E-1E5-D95
        • Size 625KB
        • SHA256 93e553c8198cd5034b269c2b0d0c1bdf45a521a69ce9e4d7061b6a23b1683e49
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        SaveOptimize.jpg.E8E-1E5-D95
        • Path C:\Users\Admin\Desktop\SaveOptimize.jpg.E8E-1E5-D95
        • Size 741KB
        • SHA256 1b34bc8bdc1a6202cceeb8a7719ee3607a261e1d3cb07e60932c5060d37ce7e4
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        SaveWatch.doc.E8E-1E5-D95
        • Path C:\Users\Admin\Desktop\SaveWatch.doc.E8E-1E5-D95
        • Size 510KB
        • SHA256 b36d6f026f39991accadca10f78845a0b2c70a5efb078b16dd3f26659ce39db3
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        SetSplit.docx.E8E-1E5-D95
        • Path C:\Users\Admin\Desktop\SetSplit.docx.E8E-1E5-D95
        • Size 19KB
        • SHA256 a496c436db3fe40c646db7dbb6cd5f78caa4570022d3848ac6c05726576faec8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        SkipClose.xps.E8E-1E5-D95
        • Path C:\Users\Admin\Desktop\SkipClose.xps.E8E-1E5-D95
        • Size 602KB
        • SHA256 6d98460a5a655130f68cac0f0d6befddff0865f156ba8c47a8e361d3fe19f372
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        UnlockWrite.WTV.E8E-1E5-D95
        • Path C:\Users\Admin\Desktop\UnlockWrite.WTV.E8E-1E5-D95
        • Size 764KB
        • SHA256 8b6da35d909274882e3894e70520330afee089b6ff9c3e68f24b7c8069ad3eb2
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        UnpublishDismount.avi.E8E-1E5-D95
        • Path C:\Users\Admin\Desktop\UnpublishDismount.avi.E8E-1E5-D95
        • Size 440KB
        • SHA256 56ea7c2acd1853055da4af6c4515988147a28a3a6959b6b6fe195c88a4dc87ca
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        WaitMount.pps.E8E-1E5-D95
        • Path C:\Users\Admin\Desktop\WaitMount.pps.E8E-1E5-D95
        • Size 671KB
        • SHA256 92a3fd05d1955b5397c8fa96ab5aad1baf4107ae576b68770453048064a3fe15
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        vcredist2010_x86.log.html
        • Path C:\vcredist2010_x86.log.html
        • Size 83KB
        • SHA256 a630b3ab71970e8706382bfbf4bc78cceabe4dc294923f6be084ab9c4a021bbc
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/672-21-0x0000000000A70000-0x0000000000A71000-memory.dmp
        Download

        memory/740-68-0x0000000000DC0000-0x0000000000F00000-memory.dmp
        Download

        memory/1284-31-0x0000000000E20000-0x0000000000F60000-memory.dmp
        Download

        memory/2248-25971-0x0000000000DC0000-0x0000000000F00000-memory.dmp
        Download

        memory/2248-25166-0x0000000000DC0000-0x0000000000F00000-memory.dmp
        Download

        memory/2248-7380-0x0000000000DC0000-0x0000000000F00000-memory.dmp
        Download

        memory/2248-17601-0x0000000000DC0000-0x0000000000F00000-memory.dmp
        Download

        memory/2248-13495-0x0000000000DC0000-0x0000000000F00000-memory.dmp
        Download

        memory/3660-43-0x0000000000DC0000-0x0000000000F00000-memory.dmp
        Download

        memory/3660-2041-0x0000000000DC0000-0x0000000000F00000-memory.dmp
        Download

        memory/3660-19669-0x0000000000DC0000-0x0000000000F00000-memory.dmp
        Download

        memory/3660-25999-0x0000000000DC0000-0x0000000000F00000-memory.dmp
        Download

        memory/4596-25998-0x0000000000FD0000-0x0000000000FD1000-memory.dmp
        Download