cerber | d16a7994d5bb51ea77a2dee74c09cd8ad23d6f812372e17c216c34ba6cf23826

Analysis

max time kernel
105s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
25/03/2025, 00:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Wolf_Woofer_FREE v3.7.exe
Size

1.6MB
MD5

23119593e91f22d4a585f26d0363d968
SHA1

83aca1d89f48fcc5537daa2c958cb29411958c6a
SHA256

d16a7994d5bb51ea77a2dee74c09cd8ad23d6f812372e17c216c34ba6cf23826
SHA512

7002a39052466cf7ff29484d94f5321b8965615efb4f8fe691a829ef48719366f43ea20e1158dff43e9113f22f64b52f48ba6fe57e42a87e3dea8ded31593a7a
SSDEEP

49152:ZomiJqMHLl1b1uHIY/NmDDBGs5KGLhUlC2GQvPb:5iJXf8HT/NGDB1/2r

Score

10^/10

cerber discovery execution persistence ransomware spyware stealer

Malware Config

Signatures

Cerber
Cerber is a widely used ransomware-as-a-service (RaaS), first seen in 2017.
ransomware cerber
Cerber family
cerber

Downloads MZ/PE file 1 IoCs

flow	pid	Process
59	5628	Wolf_Woofer_FREE v3.7.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000\Control Panel\International\Geo\Nation	Wolf_Woofer_FREE v3.7.exe

Executes dropped EXE 9 IoCs

pid	Process
1368	WOLF.exe
5688	WOLF.exe
3388	WOLF.exe
3188	WOLF.exe
3580	WOLF.exe
436	WOLF.exe
996	WOLF.exe
2336	WOLF.exe
5636	DutyCleaner.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	DutyCleaner.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	cmd.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\c_modem.inf	cmd.exe
File opened for modification	C:\Windows\INF\defltbase.inf	cmd.exe
File opened for modification	C:\Windows\INF\gameport.inf	cmd.exe
File opened for modification	C:\Windows\INF\iaLPSS2i_I2C_BXT_P.inf	cmd.exe
File opened for modification	C:\Windows\INF\mdmzyp.inf	cmd.exe
File opened for modification	C:\Windows\INF\UGatherer\040C\gsrvctr.ini	cmd.exe
File opened for modification	C:\Windows\INF\wvmbusvideo.inf	cmd.exe
File opened for modification	C:\Windows\INF\wvmgid.inf	cmd.exe
File opened for modification	C:\Windows\INF\mdmrock.inf	cmd.exe
File opened for modification	C:\Windows\Logs\WAASME~1\WAASME~2.ETL	cmd.exe
File opened for modification	C:\Windows\INF\mdmdf56f.inf	cmd.exe
File opened for modification	C:\Windows\INF\mdmgl008.inf	cmd.exe
File opened for modification	C:\Windows\INF\MSDTCB~1.0\0C0A\_TransactionBridgePerfCounters_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\netnwifi.inf	cmd.exe
File opened for modification	C:\Windows\INF\rspndr.inf	cmd.exe
File opened for modification	C:\Windows\INF\secrecs.inf	cmd.exe
File opened for modification	C:\Windows\INF\c_dot4.inf	cmd.exe
File opened for modification	C:\Windows\INF\c_image.inf	cmd.exe
File opened for modification	C:\Windows\INF\keyboard.inf	cmd.exe
File opened for modification	C:\Windows\INF\mdmcomp.inf	cmd.exe
File opened for modification	C:\Windows\INF\microsoft_bluetooth_hfp.inf	cmd.exe
File opened for modification	C:\Windows\INF\net7500-x64-n650f.inf	cmd.exe
File opened for modification	C:\Windows\INF\netnvm64.inf	cmd.exe
File opened for modification	C:\Windows\INF\TAPISRV\0410\tapiperf.ini	cmd.exe
File opened for modification	C:\Windows\INF\cdrom.inf	cmd.exe
File opened for modification	C:\Windows\INF\.NET Data Provider for Oracle\0411\_DataOracleClientPerfCounters_shared12_neutral_d.ini	cmd.exe
File opened for modification	C:\Windows\INF\hidbatt.inf	cmd.exe
File opened for modification	C:\Windows\INF\mbtr8897w81x64.inf	cmd.exe
File opened for modification	C:\Windows\INF\SERVIC~3.0\0409\_ServiceModelServicePerfCounters_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\TermService\0C0A\tslabels.ini	cmd.exe
File opened for modification	C:\Windows\INF\ts_wpdmtp.inf	cmd.exe
File opened for modification	C:\Windows\INF\wfpcapture.inf	cmd.exe
File opened for modification	C:\Windows\INF\mdmtdkj2.inf	cmd.exe
File opened for modification	C:\Windows\INF\.NET CLR Networking 4.0.0.0\0407\_Networkingperfcounters_d.ini	cmd.exe
File opened for modification	C:\Windows\INF\amdi2c.inf	cmd.exe
File opened for modification	C:\Windows\INF\apps.inf	cmd.exe
File opened for modification	C:\Windows\INF\cht4nulx64.inf	cmd.exe
File opened for modification	C:\Windows\INF\mdmdgitn.inf	cmd.exe
File opened for modification	C:\Windows\INF\mdmlucnt.inf	cmd.exe
File opened for modification	C:\Windows\INF\mdmmcom.inf	cmd.exe
File opened for modification	C:\Windows\INF\c_netclient.inf	cmd.exe
File opened for modification	C:\Windows\INF\mdmgl010.inf	cmd.exe
File opened for modification	C:\Windows\INF\mdmsun2.inf	cmd.exe
File opened for modification	C:\Windows\INF\megasas.inf	cmd.exe
File opened for modification	C:\Windows\INF\ntprint4.inf	cmd.exe
File opened for modification	C:\Windows\INF\TAPISRV\0409\tapiperf.ini	cmd.exe
File opened for modification	C:\Windows\INF\tpm.inf	cmd.exe
File opened for modification	C:\Windows\INF\volmgr.inf	cmd.exe
File opened for modification	C:\Windows\INF\amdsata.inf	cmd.exe
File opened for modification	C:\Windows\INF\c_multifunction.inf	cmd.exe
File opened for modification	C:\Windows\INF\SMSvcHost 4.0.0.0\0C0A\_SMSvcHostPerfCounters_d.ini	cmd.exe
File opened for modification	C:\Windows\INF\TAPISRV\040C\tapiperf.ini	cmd.exe
File opened for modification	C:\Windows\INF\uicciso.inf	cmd.exe
File opened for modification	C:\Windows\INF\wceisvista.inf	cmd.exe
File opened for modification	C:\Windows\INF\mdmcom1.inf	cmd.exe
File opened for modification	C:\Windows\INF\c_battery.inf	cmd.exe
File opened for modification	C:\Windows\INF\mdmaiwa4.inf	cmd.exe
File opened for modification	C:\Windows\INF\Windows Workflow Foundation 4.0.0.0\PerfCounters.ini	cmd.exe
File opened for modification	C:\Windows\INF\WindowsTrustedRTProxy.inf	cmd.exe
File opened for modification	C:\Windows\INF\wmbclass_wmc_union.inf	cmd.exe
File opened for modification	C:\Windows\INF\.NET Data Provider for SqlServer\0407\_dataperfcounters_shared12_neutral_d.ini	cmd.exe
File opened for modification	C:\Windows\INF\errdev.inf	cmd.exe
File opened for modification	C:\Windows\INF\mdmisdn.inf	cmd.exe
File opened for modification	C:\Windows\INF\MSDTCB~1.0\0411\_TransactionBridgePerfCounters_D.ini	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1888	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 52 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Wolf_Woofer_FREE v3.7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	reg.exe
Delete value	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	reg.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5700	timeout.exe

Enumerates system info in registry 2 TTPs 10 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	reg.exe
Delete value	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	reg.exe
Delete value	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate	reg.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	reg.exe
Delete value	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	reg.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	reg.exe
Delete value	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	reg.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	reg.exe
Delete value	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	reg.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	reg.exe

Kills process with taskkill 19 IoCs

defense_evasion

pid	Process
4856	taskkill.exe
1376	taskkill.exe
5648	taskkill.exe
4760	taskkill.exe
4520	taskkill.exe
3584	taskkill.exe
1348	taskkill.exe
4960	taskkill.exe
4396	taskkill.exe
776	taskkill.exe
4704	taskkill.exe
3172	taskkill.exe
3100	taskkill.exe
4684	taskkill.exe
4884	taskkill.exe
6112	taskkill.exe
6044	taskkill.exe
3688	taskkill.exe
2876	taskkill.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3446877943-4095308722-756223633-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1368	WOLF.exe
1368	WOLF.exe
5688	WOLF.exe
5688	WOLF.exe
3388	WOLF.exe
3388	WOLF.exe
3188	WOLF.exe
3188	WOLF.exe
3580	WOLF.exe
3580	WOLF.exe
436	WOLF.exe
436	WOLF.exe
996	WOLF.exe
996	WOLF.exe
2336	WOLF.exe
2336	WOLF.exe
1888	powershell.exe
1888	powershell.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	5628	Wolf_Woofer_FREE v3.7.exe
Token: SeDebugPrivilege	1888	powershell.exe
Token: SeDebugPrivilege	4760	taskkill.exe
Token: SeDebugPrivilege	3172	taskkill.exe
Token: SeDebugPrivilege	3100	taskkill.exe
Token: SeDebugPrivilege	1348	taskkill.exe
Token: SeDebugPrivilege	4960	taskkill.exe
Token: SeDebugPrivilege	2876	taskkill.exe
Token: SeDebugPrivilege	4520	taskkill.exe
Token: SeDebugPrivilege	4856	taskkill.exe
Token: SeDebugPrivilege	4684	taskkill.exe
Token: SeDebugPrivilege	4884	taskkill.exe
Token: SeDebugPrivilege	6112	taskkill.exe
Token: SeDebugPrivilege	1376	taskkill.exe
Token: SeDebugPrivilege	4396	taskkill.exe
Token: SeDebugPrivilege	776	taskkill.exe
Token: SeDebugPrivilege	5648	taskkill.exe
Token: SeDebugPrivilege	4704	taskkill.exe
Token: SeDebugPrivilege	3584	taskkill.exe
Token: SeDebugPrivilege	6044	taskkill.exe
Token: SeDebugPrivilege	3688	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5628 wrote to memory of 4248	5628	Wolf_Woofer_FREE v3.7.exe	107
PID 5628 wrote to memory of 4248	5628	Wolf_Woofer_FREE v3.7.exe	107
PID 5628 wrote to memory of 4248	5628	Wolf_Woofer_FREE v3.7.exe	107
PID 4248 wrote to memory of 2396	4248	cmd.exe	109
PID 4248 wrote to memory of 2396	4248	cmd.exe	109
PID 4248 wrote to memory of 2396	4248	cmd.exe	109
PID 2396 wrote to memory of 3976	2396	net.exe	110
PID 2396 wrote to memory of 3976	2396	net.exe	110
PID 2396 wrote to memory of 3976	2396	net.exe	110
PID 4248 wrote to memory of 1368	4248	cmd.exe	111
PID 4248 wrote to memory of 1368	4248	cmd.exe	111
PID 4248 wrote to memory of 5688	4248	cmd.exe	112
PID 4248 wrote to memory of 5688	4248	cmd.exe	112
PID 4248 wrote to memory of 3388	4248	cmd.exe	113
PID 4248 wrote to memory of 3388	4248	cmd.exe	113
PID 4248 wrote to memory of 3188	4248	cmd.exe	114
PID 4248 wrote to memory of 3188	4248	cmd.exe	114
PID 4248 wrote to memory of 3580	4248	cmd.exe	115
PID 4248 wrote to memory of 3580	4248	cmd.exe	115
PID 4248 wrote to memory of 436	4248	cmd.exe	116
PID 4248 wrote to memory of 436	4248	cmd.exe	116
PID 4248 wrote to memory of 996	4248	cmd.exe	117
PID 4248 wrote to memory of 996	4248	cmd.exe	117
PID 4248 wrote to memory of 2336	4248	cmd.exe	118
PID 4248 wrote to memory of 2336	4248	cmd.exe	118
PID 4248 wrote to memory of 5700	4248	cmd.exe	119
PID 4248 wrote to memory of 5700	4248	cmd.exe	119
PID 4248 wrote to memory of 5700	4248	cmd.exe	119
PID 5628 wrote to memory of 5636	5628	Wolf_Woofer_FREE v3.7.exe	120
PID 5628 wrote to memory of 5636	5628	Wolf_Woofer_FREE v3.7.exe	120
PID 5636 wrote to memory of 4312	5636	DutyCleaner.exe	121
PID 5636 wrote to memory of 4312	5636	DutyCleaner.exe	121
PID 4312 wrote to memory of 684	4312	cmd.exe	123
PID 4312 wrote to memory of 684	4312	cmd.exe	123
PID 684 wrote to memory of 5944	684	net.exe	124
PID 684 wrote to memory of 5944	684	net.exe	124
PID 4312 wrote to memory of 1888	4312	cmd.exe	125
PID 4312 wrote to memory of 1888	4312	cmd.exe	125
PID 5628 wrote to memory of 4476	5628	Wolf_Woofer_FREE v3.7.exe	126
PID 5628 wrote to memory of 4476	5628	Wolf_Woofer_FREE v3.7.exe	126
PID 5628 wrote to memory of 4476	5628	Wolf_Woofer_FREE v3.7.exe	126
PID 4476 wrote to memory of 4760	4476	cmd.exe	128
PID 4476 wrote to memory of 4760	4476	cmd.exe	128
PID 4476 wrote to memory of 4760	4476	cmd.exe	128
PID 5628 wrote to memory of 5240	5628	Wolf_Woofer_FREE v3.7.exe	129
PID 5628 wrote to memory of 5240	5628	Wolf_Woofer_FREE v3.7.exe	129
PID 5628 wrote to memory of 5240	5628	Wolf_Woofer_FREE v3.7.exe	129
PID 4476 wrote to memory of 3172	4476	cmd.exe	131
PID 4476 wrote to memory of 3172	4476	cmd.exe	131
PID 4476 wrote to memory of 3172	4476	cmd.exe	131
PID 4476 wrote to memory of 3100	4476	cmd.exe	132
PID 4476 wrote to memory of 3100	4476	cmd.exe	132
PID 4476 wrote to memory of 3100	4476	cmd.exe	132
PID 4476 wrote to memory of 1348	4476	cmd.exe	133
PID 4476 wrote to memory of 1348	4476	cmd.exe	133
PID 4476 wrote to memory of 1348	4476	cmd.exe	133
PID 4476 wrote to memory of 4960	4476	cmd.exe	134
PID 4476 wrote to memory of 4960	4476	cmd.exe	134
PID 4476 wrote to memory of 4960	4476	cmd.exe	134
PID 4476 wrote to memory of 2876	4476	cmd.exe	135
PID 4476 wrote to memory of 2876	4476	cmd.exe	135
PID 4476 wrote to memory of 2876	4476	cmd.exe	135
PID 4476 wrote to memory of 4520	4476	cmd.exe	136
PID 4476 wrote to memory of 4520	4476	cmd.exe	136

C:\Users\Admin\AppData\Local\Temp\Wolf_Woofer_FREE v3.7.exe
"C:\Users\Admin\AppData\Local\Temp\Wolf_Woofer_FREE v3.7.exe"
1⤵
- Downloads MZ/PE file
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Documents\KillaSpoofer\KillaSpoof\KillaSpoof.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4248
- - C:\Windows\SysWOW64\net.exe
    net session
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2396
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      System Location Discovery: System Language Discovery
      PID:3976
- - C:\Users\Admin\Documents\KillaSpoofer\KillaSpoof\UTIL\WOLF.exe
    WOLF /BM "To Be Filled By O.E.M."
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:1368
- - C:\Users\Admin\Documents\KillaSpoofer\KillaSpoof\UTIL\WOLF.exe
    WOLF /SM "To Be Filled By O.E.M."
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:5688
- - C:\Users\Admin\Documents\KillaSpoofer\KillaSpoof\UTIL\WOLF.exe
    WOLF /SS "W1197429239"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3388
- - C:\Users\Admin\Documents\KillaSpoofer\KillaSpoof\UTIL\WOLF.exe
    WOLF /BS "W3244314109"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3188
- - C:\Users\Admin\Documents\KillaSpoofer\KillaSpoof\UTIL\WOLF.exe
    WOLF /BP "W32901253-73Z-388716002-XN5543"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3580
- - C:\Users\Admin\Documents\KillaSpoofer\KillaSpoof\UTIL\WOLF.exe
    WOLF /SP "W1274517887-P5A-1039523069-XN21605"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:436
- - C:\Users\Admin\Documents\KillaSpoofer\KillaSpoof\UTIL\WOLF.exe
    WOLF /PSN "W955828315"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:996
- - C:\Users\Admin\Documents\KillaSpoofer\KillaSpoof\UTIL\WOLF.exe
    WOLF /SU auto
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2336
- - C:\Windows\SysWOW64\timeout.exe
    timeout /T 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:5700
- C:\Users\Public\Documents\DutyCleaner\DutyCleaner.exe
  "C:\Users\Public\Documents\DutyCleaner\DutyCleaner.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:5636
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c "Duty Cleaner.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4312
  - - C:\Windows\system32\net.exe
      NET SESSION
      4⤵
      Suspicious use of WriteProcessMemory
      PID:684
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 SESSION
        5⤵
        
        PID:5944
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "[Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null; [Windows.UI.Notifications.ToastNotification, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null; $xml = [Windows.UI.Notifications.ToastNotificationManager]::GetTemplateContent([Windows.UI.Notifications.ToastTemplateType]::ToastText01); $text = $xml.CreateTextNode('Thank you for using the program!'); $xml.GetElementsByTagName('text').AppendChild($text); $toast = [Windows.UI.Notifications.ToastNotification]::new($xml); [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier('Duty Cleaning Program').Show($toast);"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1888
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Documents\DutyCleaner\FortniteCleaner.bat" "
  2⤵
  - Enumerates connected drives
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4476
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im epicgameslauncher.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4760
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im FortniteClient-Win64-Shipping_EAC.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3172
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im FortniteClient-Win64-Shipping.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3100
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im FortniteClient-Win64-Shipping_BE.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1348
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im FortniteLauncher.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4960
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im UnrealCEFSubProcess.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2876
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im CEFProcess.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4520
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im EasyAntiCheat.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4856
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im BEService.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4684
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im BEServices.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4884
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im BattleEye.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6112
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c findstr /b ::: "C:\Users\Public\Documents\DutyCleaner\FortniteCleaner.bat"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1028
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /b ::: "C:\Users\Public\Documents\DutyCleaner\FortniteCleaner.bat"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4716
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\MuiCache" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3040
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5448
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3228
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\Bags" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2664
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\Shell\BagMRU" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2760
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Store" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5296
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4508
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2976
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5856
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5812
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRULegacy" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4284
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:924
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1116
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v BIOSVendor /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    PID:1520
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v BIOSReleaseDate /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    PID:3452
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v SystemManufacturer /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    PID:1764
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v SystemProductName /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    PID:5624
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\BIOS" /v SystemManufacturer /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Enumerates system info in registry
    PID:3604
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKEY_LOCAL_MACHINE\Hardware\Description\System\CentralProcessor\0" /v ProcessorNameString /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:4364
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control" /v SystemStartOptions /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2696
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKEY_CURRENT_USER\Software\Epic Games" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5000
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im epicgameslauncher.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1376
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im FortniteClient-Win64-Shipping_EAC.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4396
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im FortniteClient-Win64-Shipping.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:776
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im FortniteClient-Win64-Shipping_BE.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5648
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im FortniteLauncher.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4704
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im EpicGamesLauncher.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3584
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im FortniteClient-Win64-Shipping.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:6044
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im EpicGamesLauncher.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3688
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKEY_LOCAL_MACHINE\Software\Epic Games" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2756
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKEY_CURRENT_USER\Software\Epic Games" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4056
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKEY_LOCAL_MACHINE\Software\Epic Games" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5912
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Documents\DutyCleaner\FortnitecleanerSmall.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Duty Cleaner.bat

Filesize
208KB

MD5
00375ee83226cbdd0e8bc5f2c71aa38d

SHA1
0ff7ea34203a1729140f2429358bc58aa28e5bb2

SHA256
dd97aed20239f8546bfab3556a04426b80b263f04e8436264c4213043919249f

SHA512
a8587b43a10b015746cfc519362d1402c9cb09f4d932cf9e1d2fc1d2bcb7b9b76f8747057606d75ff15782ba5de9919ec0f63a515ba6673536e2e989923111c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gl512tum.x3x.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Documents\KillaSpoofer\KillaSpoof\KillaSpoof.bat

Filesize
1KB

MD5
44d499f2de89cb19a6c55cde1dddfdcc

SHA1
09122b371d901d298552ff699667f0a1e0cf6f09

SHA256
93ba415a352cf208331ec65718f16de18f040a9f613595427f6f7e176cbebc69

SHA512
cb76943ba6ee361f56e25d8fd59fa9933ea4f350782511312834ddf582f804001bf00ba3697e55301481f6b1de6f3023da8d8468e76da953d77a7fde65200926

Download Submit
C:\Users\Admin\Documents\KillaSpoofer\KillaSpoof\UTIL\WOLF.exe

Filesize
4.9MB

MD5
b7219857e8e1305def7a814ad27f5fb5

SHA1
b41ee7cf66e7cfbc19764c1ca5bbddcc6141e0bb

SHA256
c3d568da2c0055824bfc629de90970014fe15164693f7acc478dc7e06891516f

SHA512
fa35a119b73e9fba4dad22966f5a13ae5486931c1f1559ec7e0e4fbf4523d5b463407c7058254fdc5160352cd668bf3ae55dbb352a1276704233d5e313dcd9fd

Download Submit
C:\Users\Admin\Documents\KillaSpoofer\KillaSpoof\UTIL\amifldrv64.sys

Filesize
18KB

MD5
785045f8b25cd2e937ddc6b09debe01a

SHA1
029c678674f482ababe8bbfdb93152392457109d

SHA256
37073e42ffa0322500f90cd7e3c8d02c4cdd695d31c77e81560abec20bfb68ba

SHA512
40bbeb41816146c7172aa3cf27dace538908b7955171968e1cddcd84403b2588e0d8437a3596c2714ccdf4476eefa3d4e61d90ea118982b729f50b03df1104a9

Download Submit
C:\Users\Public\Documents\DutyCleaner\DutyCleaner.exe

Filesize
190KB

MD5
b51c7b53dc6f6119198f306493affb6d

SHA1
1fa6013669ce756dd09fe03fc192136cbe13daaf

SHA256
1243ca1244a25b33fae69e0525b8b3e17f059323cba2d2586c6247d33b602f50

SHA512
42460a6d3923aae34f6bb4f2616ebb9e3bd8551095d594eb6625fcc740223c3561b45ae9a62ca54b8e8bceaea3dde8def06123f345d2250b322deb13a45cded5

Download Submit
C:\Users\Public\Documents\DutyCleaner\FortniteCleaner.bat

Filesize
1.5MB

MD5
9f11b2a3e7a02c82b93a629b3be3e1d0

SHA1
c838319bd14ea3c31d48d236a8f63ad826c89a17

SHA256
8f9d69d08d71c182799f59f851231193bd5da5ac4a0a11f19543080dbf0525ba

SHA512
a90399e751bc58ffec2b721483fe8438bf1b1537ff9fffeae37beebd6354ca92d11c240d2cd92d16689c4986fc7a0e17031f9447737245ad5bfce210a99c709a

Download Submit
C:\Users\Public\Documents\DutyCleaner\FortnitecleanerSmall.bat

Filesize
41KB

MD5
defa26d378888c30e48eba0f049cea6f

SHA1
f748c93804b2ecd67f214b7506f45f8569c25563

SHA256
cd7f44c3574c63897307d9e6ab7164733b1a8289c26882fc806c68fe3ec4ab9f

SHA512
43a9ad2f6f0a794e77c4ec69da360761a8bc26d18d6e0e5775b408b7146d80030bbfa6a0d9aa1682fc9c1336d4ac7107598a1105a891489adeebcd6e3d6f6982

Download Submit
memory/436-57-0x0000000140000000-0x000000014086B000-memory.dmp

Filesize
8.4MB

Download
memory/996-62-0x0000000140000000-0x000000014086B000-memory.dmp

Filesize
8.4MB

Download
memory/1368-27-0x000000014007B000-0x000000014038F000-memory.dmp

Filesize
3.1MB

Download
memory/1368-34-0x0000000140000000-0x000000014086B000-memory.dmp

Filesize
8.4MB

Download
memory/1368-28-0x00007FFEC9F50000-0x00007FFEC9F52000-memory.dmp

Filesize
8KB

Download
memory/1368-29-0x0000000140000000-0x000000014086B000-memory.dmp

Filesize
8.4MB

Download
memory/1368-33-0x000000014007B000-0x000000014038F000-memory.dmp

Filesize
3.1MB

Download
memory/1888-88-0x0000022BDCF90000-0x0000022BDCFB2000-memory.dmp

Filesize
136KB

Download
memory/1888-101-0x0000022BDCFE0000-0x0000022BDCFE8000-memory.dmp

Filesize
32KB

Download
memory/1888-100-0x0000022BDCFD0000-0x0000022BDCFDA000-memory.dmp

Filesize
40KB

Download
memory/1888-102-0x0000022BDF930000-0x0000022BDF9A6000-memory.dmp

Filesize
472KB

Download
memory/1888-104-0x0000022BDF8B0000-0x0000022BDF8CE000-memory.dmp

Filesize
120KB

Download
memory/2336-67-0x0000000140000000-0x000000014086B000-memory.dmp

Filesize
8.4MB

Download
memory/3188-47-0x0000000140000000-0x000000014086B000-memory.dmp

Filesize
8.4MB

Download
memory/3388-42-0x0000000140000000-0x000000014086B000-memory.dmp

Filesize
8.4MB

Download
memory/3580-52-0x0000000140000000-0x000000014086B000-memory.dmp

Filesize
8.4MB

Download
memory/5628-9-0x0000000075210000-0x00000000759C0000-memory.dmp

Filesize
7.7MB

Download
memory/5628-7-0x0000000075210000-0x00000000759C0000-memory.dmp

Filesize
7.7MB

Download
memory/5628-11-0x0000000009240000-0x000000000924A000-memory.dmp

Filesize
40KB

Download
memory/5628-0-0x000000007521E000-0x000000007521F000-memory.dmp

Filesize
4KB

Download
memory/5628-10-0x0000000075210000-0x00000000759C0000-memory.dmp

Filesize
7.7MB

Download
memory/5628-2-0x0000000005FD0000-0x0000000006574000-memory.dmp

Filesize
5.6MB

Download
memory/5628-8-0x0000000006F50000-0x0000000006FB6000-memory.dmp

Filesize
408KB

Download
memory/5628-13-0x0000000009420000-0x0000000009432000-memory.dmp

Filesize
72KB

Download
memory/5628-6-0x000000007521E000-0x000000007521F000-memory.dmp

Filesize
4KB

Download
memory/5628-4-0x0000000075210000-0x00000000759C0000-memory.dmp

Filesize
7.7MB

Download
memory/5628-5-0x00000000059B0000-0x00000000059BA000-memory.dmp

Filesize
40KB

Download
memory/5628-1-0x0000000000DD0000-0x0000000000F68000-memory.dmp

Filesize
1.6MB

Download
memory/5628-3-0x0000000005900000-0x0000000005992000-memory.dmp

Filesize
584KB

Download
memory/5688-39-0x0000000140000000-0x000000014086B000-memory.dmp

Filesize
8.4MB

Download