9cdc309bde3af8f3a2b8f775f4d8eb1655c43f0bab982c676131fda8eb5a2796

Analysis

user interaction
yes
max time kernel
87s
max time network
54s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SetupCedrea_v1.0.4.msi
Size 12.0MB
Sample260825-persfsx1f1
SHA256 9cdc309bde3af8f3a2b8f775f4d8eb1655c43f0bab982c676131fda8eb5a2796
MD5 49f5315efeb9fd8549be4cca7e2ba54f
SHA1 67972b8e1081fbc27d00566a868c823f3233b684
SHA512 c16543423ec7807943dde181af3d424e4f660eb317f766a5f7820f8b9cfaf13c63a880929a30f16dd7ea4d1892136e604cd5de929c7872c316b3b0108cd716df
SSDEEP 196608:xE37EalEzlPf6CeWd1Iuy8YWjCeGTJvU/ptDJSxGIq6vQjwiNw68umxJXBSvqCt:x6IWEpPfWyuuy8YW+eCNEjDJXJ6ojLOn
TLSH
T1C9C6332275C6E177C0291C31193B476CBE76AC295EA4C90BD324BB4C6DB11C22BBEB57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2836	TurkTrust.Cedrea.WPF.exe

Loads dropped DLL 38 IoCs

pid	Process
3336	MsiExec.exe
3336	MsiExec.exe
3816	MsiExec.exe
3816	MsiExec.exe
2836	TurkTrust.Cedrea.WPF.exe
2836	TurkTrust.Cedrea.WPF.exe
2836	TurkTrust.Cedrea.WPF.exe
2836	TurkTrust.Cedrea.WPF.exe
2836	TurkTrust.Cedrea.WPF.exe
2836	TurkTrust.Cedrea.WPF.exe
2836	TurkTrust.Cedrea.WPF.exe
2836	TurkTrust.Cedrea.WPF.exe
2836	TurkTrust.Cedrea.WPF.exe
2836	TurkTrust.Cedrea.WPF.exe
2836	TurkTrust.Cedrea.WPF.exe
2836	TurkTrust.Cedrea.WPF.exe
2836	TurkTrust.Cedrea.WPF.exe
2836	TurkTrust.Cedrea.WPF.exe
2836	TurkTrust.Cedrea.WPF.exe
2836	TurkTrust.Cedrea.WPF.exe
2836	TurkTrust.Cedrea.WPF.exe
2836	TurkTrust.Cedrea.WPF.exe
2836	TurkTrust.Cedrea.WPF.exe
2836	TurkTrust.Cedrea.WPF.exe
2836	TurkTrust.Cedrea.WPF.exe
2836	TurkTrust.Cedrea.WPF.exe
2836	TurkTrust.Cedrea.WPF.exe
2836	TurkTrust.Cedrea.WPF.exe
2836	TurkTrust.Cedrea.WPF.exe
2836	TurkTrust.Cedrea.WPF.exe
2836	TurkTrust.Cedrea.WPF.exe
2836	TurkTrust.Cedrea.WPF.exe
2836	TurkTrust.Cedrea.WPF.exe
2836	TurkTrust.Cedrea.WPF.exe
2836	TurkTrust.Cedrea.WPF.exe
2836	TurkTrust.Cedrea.WPF.exe
2836	TurkTrust.Cedrea.WPF.exe
2836	TurkTrust.Cedrea.WPF.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.Diagnostics.TextWriterTraceListener.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.Threading.Tasks.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.Threading.ThreadPool.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\TURKTRUST\Cedrea\System.Resources.ResourceManager.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.Threading.Overlapped.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.ComponentModel.TypeConverter.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.Data.Common.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.ServiceModel.Duplex.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.Runtime.Serialization.Xml.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.Xml.XPath.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.Collections.Specialized.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.Net.WebSockets.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.ObjectModel.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.Xml.XDocument.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\Telerik.Windows.Data.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.Security.Cryptography.X509Certificates.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.Runtime.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.Diagnostics.Process.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.Resources.Writer.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.Net.Primitives.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.IO.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.Globalization.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\TURKTRUST\Cedrea\System.Collections.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.Reflection.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.Net.WebHeaderCollection.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.Collections.Concurrent.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\TurkTrust.Cedrea.WPF.exe.config	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.Diagnostics.Tracing.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.Reflection.Emit.Lightweight.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\Microsoft.Windows.Shell.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\TURKTRUST\Cedrea\System.Globalization.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.Net.Http.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\ArnicaC_CS.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.Linq.Expressions.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.Diagnostics.FileVersionInfo.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\TurkTrust.Cedrea.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.Security.Cryptography.Csp.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.Net.Sockets.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.Security.SecureString.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.Globalization.Calendars.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.Security.Principal.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.IO.Compression.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.Runtime.Handles.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.Resources.ResourceManager.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\SmartcardLibraryWrapper.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.Reflection.Extensions.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.Diagnostics.StackTrace.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.Net.Http.WebRequest.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\FontAwesome.WPF.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\Telerik.Windows.Documents.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.Diagnostics.Tools.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.Runtime.Serialization.Formatters.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.Linq.Queryable.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\GalaSoft.MvvmLight.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\Telerik.Windows.Controls.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\GalaSoft.MvvmLight.Platform.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.Dynamic.Runtime.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\Telerik.Windows.Controls.GridView.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.Collections.NonGeneric.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.Runtime.Extensions.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.Console.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\Telerik.Windows.Documents.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.IO.FileSystem.Watcher.dll	msiexec.exe
File created	C:\Program Files (x86)\TURKTRUST\Cedrea\System.Threading.Thread.dll	msiexec.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e597ebb.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI85D1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e597ec5.msi	msiexec.exe
File created	C:\Windows\Installer\e597ebb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8505.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAD8AC45C6EA3C3CF.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{85032079-E567-42F5-9242-213FC2B60AE2}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF68232F865FB72415.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8A95.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1FA33EDD48F78FEA.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFDA0D5413349D61F.TMP	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2624	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TurkTrust.Cedrea.WPF.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ad3b1fc6af0fc0350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ad3b1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ad3b1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ad3b1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ad3b1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Control Panel\Colors	TurkTrust.Cedrea.WPF.exe

Modifies registry class 41 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	TurkTrust.Cedrea.WPF.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	TurkTrust.Cedrea.WPF.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	TurkTrust.Cedrea.WPF.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings	TurkTrust.Cedrea.WPF.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	TurkTrust.Cedrea.WPF.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	TurkTrust.Cedrea.WPF.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\NotificationData	TurkTrust.Cedrea.WPF.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	TurkTrust.Cedrea.WPF.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	TurkTrust.Cedrea.WPF.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	TurkTrust.Cedrea.WPF.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	TurkTrust.Cedrea.WPF.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	TurkTrust.Cedrea.WPF.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	TurkTrust.Cedrea.WPF.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	TurkTrust.Cedrea.WPF.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	TurkTrust.Cedrea.WPF.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	TurkTrust.Cedrea.WPF.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	TurkTrust.Cedrea.WPF.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	TurkTrust.Cedrea.WPF.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	TurkTrust.Cedrea.WPF.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	TurkTrust.Cedrea.WPF.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	TurkTrust.Cedrea.WPF.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	TurkTrust.Cedrea.WPF.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	TurkTrust.Cedrea.WPF.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	TurkTrust.Cedrea.WPF.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	TurkTrust.Cedrea.WPF.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	TurkTrust.Cedrea.WPF.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	TurkTrust.Cedrea.WPF.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	TurkTrust.Cedrea.WPF.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	TurkTrust.Cedrea.WPF.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	TurkTrust.Cedrea.WPF.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	TurkTrust.Cedrea.WPF.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	TurkTrust.Cedrea.WPF.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	TurkTrust.Cedrea.WPF.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	TurkTrust.Cedrea.WPF.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	TurkTrust.Cedrea.WPF.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	TurkTrust.Cedrea.WPF.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	TurkTrust.Cedrea.WPF.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	TurkTrust.Cedrea.WPF.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	TurkTrust.Cedrea.WPF.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	TurkTrust.Cedrea.WPF.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	TurkTrust.Cedrea.WPF.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2100	msiexec.exe
2100	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2624	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2624	msiexec.exe
Token: SeSecurityPrivilege	2100	msiexec.exe
Token: SeCreateTokenPrivilege	2624	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2624	msiexec.exe
Token: SeLockMemoryPrivilege	2624	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2624	msiexec.exe
Token: SeMachineAccountPrivilege	2624	msiexec.exe
Token: SeTcbPrivilege	2624	msiexec.exe
Token: SeSecurityPrivilege	2624	msiexec.exe
Token: SeTakeOwnershipPrivilege	2624	msiexec.exe
Token: SeLoadDriverPrivilege	2624	msiexec.exe
Token: SeSystemProfilePrivilege	2624	msiexec.exe
Token: SeSystemtimePrivilege	2624	msiexec.exe
Token: SeProfSingleProcessPrivilege	2624	msiexec.exe
Token: SeIncBasePriorityPrivilege	2624	msiexec.exe
Token: SeCreatePagefilePrivilege	2624	msiexec.exe
Token: SeCreatePermanentPrivilege	2624	msiexec.exe
Token: SeBackupPrivilege	2624	msiexec.exe
Token: SeRestorePrivilege	2624	msiexec.exe
Token: SeShutdownPrivilege	2624	msiexec.exe
Token: SeDebugPrivilege	2624	msiexec.exe
Token: SeAuditPrivilege	2624	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2624	msiexec.exe
Token: SeChangeNotifyPrivilege	2624	msiexec.exe
Token: SeRemoteShutdownPrivilege	2624	msiexec.exe
Token: SeUndockPrivilege	2624	msiexec.exe
Token: SeSyncAgentPrivilege	2624	msiexec.exe
Token: SeEnableDelegationPrivilege	2624	msiexec.exe
Token: SeManageVolumePrivilege	2624	msiexec.exe
Token: SeImpersonatePrivilege	2624	msiexec.exe
Token: SeCreateGlobalPrivilege	2624	msiexec.exe
Token: SeCreateTokenPrivilege	2624	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2624	msiexec.exe
Token: SeLockMemoryPrivilege	2624	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2624	msiexec.exe
Token: SeMachineAccountPrivilege	2624	msiexec.exe
Token: SeTcbPrivilege	2624	msiexec.exe
Token: SeSecurityPrivilege	2624	msiexec.exe
Token: SeTakeOwnershipPrivilege	2624	msiexec.exe
Token: SeLoadDriverPrivilege	2624	msiexec.exe
Token: SeSystemProfilePrivilege	2624	msiexec.exe
Token: SeSystemtimePrivilege	2624	msiexec.exe
Token: SeProfSingleProcessPrivilege	2624	msiexec.exe
Token: SeIncBasePriorityPrivilege	2624	msiexec.exe
Token: SeCreatePagefilePrivilege	2624	msiexec.exe
Token: SeCreatePermanentPrivilege	2624	msiexec.exe
Token: SeBackupPrivilege	2624	msiexec.exe
Token: SeRestorePrivilege	2624	msiexec.exe
Token: SeShutdownPrivilege	2624	msiexec.exe
Token: SeDebugPrivilege	2624	msiexec.exe
Token: SeAuditPrivilege	2624	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2624	msiexec.exe
Token: SeChangeNotifyPrivilege	2624	msiexec.exe
Token: SeRemoteShutdownPrivilege	2624	msiexec.exe
Token: SeUndockPrivilege	2624	msiexec.exe
Token: SeSyncAgentPrivilege	2624	msiexec.exe
Token: SeEnableDelegationPrivilege	2624	msiexec.exe
Token: SeManageVolumePrivilege	2624	msiexec.exe
Token: SeImpersonatePrivilege	2624	msiexec.exe
Token: SeCreateGlobalPrivilege	2624	msiexec.exe
Token: SeCreateTokenPrivilege	2624	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2624	msiexec.exe
Token: SeLockMemoryPrivilege	2624	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2624	msiexec.exe
2624	msiexec.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2624	msiexec.exe
2100	msiexec.exe
3336	MsiExec.exe
3816	MsiExec.exe
2836	TurkTrust.Cedrea.WPF.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 3336	2100	msiexec.exe	90
PID 2100 wrote to memory of 2420	2100	msiexec.exe	95
PID 2100 wrote to memory of 3816	2100	msiexec.exe	98

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\SetupCedrea_v1.0.4.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2624

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5B1CA0DADAEF0AC34301B8E354D33BC7 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3336
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2420
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 411B8D9A6A3FDDE196BBD9C520BB336C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3816

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:5404

C:\Program Files (x86)\TURKTRUST\Cedrea\TurkTrust.Cedrea.WPF.exe
"C:\Program Files (x86)\TURKTRUST\Cedrea\TurkTrust.Cedrea.WPF.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e597ebc.rbs

Path C:\Config.Msi\e597ebc.rbs
Size 107KB
SHA256 d0a2dda6d558ae344c2867c14d21d78af4bc2b5d9fe325684d775b5d9fb250e8
MD5 44ee64e716693616ddd2a3163ff4ad30
SHA1 6899a4a2c69e5205f379a455842572e4e10c5f14
SHA512 c33f03de76c66ee9ad18f07d5de8c2783f1034e39e03e8a17d99a8d2ee7292ea33ce883153c5aee1371dcd2f2a2d6395b31bc20af9a064b44a39cc240f4503c6
SSDEEP 768:oDMG8G8VrVqsNmin9kzaphbLPNSVFyKTf482H8w78YuH0PC/:8x8LqsXUEPetm/uH0P0
TLSH
T10CB3B761A502FBE9FD508FB33752990827618B52C1DD2A7C51D2C43ECE81F5BBA242F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommonServiceLocator.dll

Path C:\Program Files (x86)\TURKTRUST\Cedrea\CommonServiceLocator.dll
Size 9KB
SHA256 0901248381ecd6cb362727a7905f0ebe7b791317b4502f39a8caaaca3326a244
MD5 181fa402215022dd2e5a19d89db1392d
SHA1 90dd2343c497389798cc0aba53863eecdd5e65d8
SHA512 a442e768a477b9237cd165610e11267d7fbfe608980663c20e597276b343fa745e830104f77e8a76fe705587f5e386ccc797e9676b073ae09da77472ed6d04a8
SSDEEP 192:p8jlxHkDc3Y9vGHDnq+SoG4MUzyRxHjgeMSFjgFBZWniW:ajHkDc3Y0I4MUzyxHjgelQWniW
TLSH
T1C2127511ABE84366FEFB2F796C7716001975FD94E836DB2E028C105E58A2F044EE2367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GalaSoft.MvvmLight.Extras.dll

Path C:\Program Files (x86)\TURKTRUST\Cedrea\GalaSoft.MvvmLight.Extras.dll
Size 21KB
SHA256 cb4d844434a8ffbd33531470e094524be27b88ca42b2c2197492bbe8246ea1bb
MD5 810e42e2bbfb536bdc01abf882a24938
SHA1 7bd37217aaf5ec27d2f993bb4212b0b8ab94d220
SHA512 176769ef15d87373c53cc39241126bd39ce57b18af0df4d9d2cf68645868dd53090cb5ab93b8ba78303a3e6b5f3888d2150e6def57b26462df1b12fe7450f650
SSDEEP 384:+/l5QKk8gdYAT5gb5DoCEJkUvuXctCRJEITSIjZ4qbhPyWAPslJ:ijQKJAW9Ehvvs+CRJxTb6qhPLAPslJ
TLSH
T16AA2FA48E3F8336AE6FF5BB5A9F221415B72BC02A821FB5C1E9C504A6C3B740551177B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GalaSoft.MvvmLight.dll

Path C:\Program Files (x86)\TURKTRUST\Cedrea\GalaSoft.MvvmLight.dll
Size 29KB
SHA256 b097fca120a9e76fa870d82662bdd233adbf08fc34a3c509f31cc5ced0ac1ecf
MD5 af04687248da9e95a7ff65ab538d0bcf
SHA1 7511184300e2b6f70bc92333392386a812b2dabf
SHA512 a5eab337f6386de5fb2cc809730bac7d17cdfb309afea32e65e9d8c457f97ac3e3f03cebd48535cf253e28f3aa600f234631c2060ec59acb917cb5f135f4b67a
SSDEEP 768:yQrLeg1z+o9LyepjivwvCGIzCGShkS6fF3xLAJs+d:tKExEJGB4fXLAL
TLSH
T129D23B0663F9D76AD7EE0F71B8B211155773FB066933D7898F98E489385339028433A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NLog.dll

Path C:\Program Files (x86)\TURKTRUST\Cedrea\NLog.dll
Size 674KB
SHA256 ca20ab8e9f53229b229cace3fae5a5cfce6e3ea8c9ccfdb3394efd5666b018b0
MD5 aa0fc18ad19cee41578c1dd2e4b1b75c
SHA1 894acc2ecd0c86cae06bcf8c68f920700843311d
SHA512 4e9b045732b486f85871c3ba5fed871338433edb35c7e5cab7ddf4e7a29fd419761fc4c5bd23fce8eae9f9d707795c62b5034b3b9a121b96b4ed50a5543bd5e2
SSDEEP 12288:WHz/hXL/VnT/XHzDI8OGuHm+OFWulCGp+OVT7p57FwMUsQ:WHz/hXL/VnT/XHzDI8vCGp+OVPpFFwMQ
TLSH
T1B7E4381233FC861AD09F2334A4210D1517F1EE167A6ADB5E6954B1FE2CF274ADE013AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Collections.dll

Path C:\Program Files (x86)\TURKTRUST\Cedrea\System.Collections.dll
Size 20KB
SHA256 2b78c282cab89292804fd9ab6fc9fdc34564f6d98f20fd50c247525443d4f10c
MD5 b63321af488df1d53a7065e07efb2645
SHA1 1b2eb68263eb98a458e8285acf15ac667b4fd3c4
SHA512 911e814dc084bf85ab29a7c443751524c27d01c81f3f00176a7aaa792bf9dd32b58c5fe57f388f4f7246d35b0ec98af90f19607d63e977862522fb2cb5a86dea
SSDEEP 384:jkSyokip/wAW8meWVP5h0GftpBjHec4HRN7eg7yRl7fAH:jFPxwVPwi9eBvyQH
TLSH
T1C2923AD2CBBC9603EDA72E7063A9D9833C3DA7D75E20911A105EF1691C933D4DB2462D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Globalization.dll

Path C:\Program Files (x86)\TURKTRUST\Cedrea\System.Globalization.dll
Size 20KB
SHA256 8f5fb1640ca5d0d0d8c70fb47e4087dd0205c23691124bdd2ed03215ddfd70ef
MD5 0c0242636e02dd6cc2315a7d068e2dcc
SHA1 13de18ec66b33950cd14c767242384ddeaae4dd9
SHA512 c75571acca1240f818015da6808bb4c16a55826a3971b3ba8a3aed550ff26ea2be09bbba375873549f7ac8a1a3af18252146d7417e56f67c04762c8644f60c3f
SSDEEP 384:k00VRLWrRCRc0RZWTb7F0GftpBjfjv57c4HRN76QXhlYQefX:k00TOwcus+iVFB6nX
TLSH
T1D8922892CF7C9143EDA76E7062A9D9833D3DA7C31D20A52B045AF5981C933D4DB20B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Linq.dll

Path C:\Program Files (x86)\TURKTRUST\Cedrea\System.Linq.dll
Size 20KB
SHA256 db3fe2faeb567083bbf9701ca9deeda3c923522db87fa7ef361925d0b759b6ba
MD5 529914710f98cf036581f0d31cb9f1e0
SHA1 d30753ebfc727bf712042505c9e724af4e6ddca7
SHA512 58dc2618196c1ae3d6afea33225af7313511eb08026ffcd1dff696790bbbc7c6c7648c6a7becb91ace2feab9ec302c94e8a8f764cdac8ed068eeaec5dd4ccdbf
SSDEEP 384:0Q0FIWqRWAlF0GftpBjDBc4HRN7qp1x09loX:C6R+i/Bqpp
TLSH
T1EF923AC2CFBC9543ECA36D7022A8D9837E3DA7C75D20955B005AF6A42C933D4EB2462C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Reflection.Extensions.dll

Path C:\Program Files (x86)\TURKTRUST\Cedrea\System.Reflection.Extensions.dll
Size 20KB
SHA256 10ca3ab7ad3a1a39fc0e56287a16a0a69bbfc3ef2770761f54c46108685962bd
MD5 97c7294fe22f940961b66e4d6baf8dae
SHA1 4df9011757f511354180a296f499b619818bbfe9
SHA512 3718ee2a822d8d7458296fac4974f0bed3739a0290e8e6f0462acb1643d75155081f98e5ceacdc8e5f5b2f260ea279c347234025178e8c161a8153cd26fc4b26
SSDEEP 384:B7WB4WzhLF0GftpBjFD1c4HRN7FudVMlEar:BSr+i71BFM8
TLSH
T1A9922982CF7C9243EDA36D7066A8D9837D3DA7C35D10922B159EF1A42C937D0EB1462D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Reflection.dll

Path C:\Program Files (x86)\TURKTRUST\Cedrea\System.Reflection.dll
Size 20KB
SHA256 94eec8232e0aac233ac9a0114072f44798408ea05a368540e9c3a4d09a3df32e
MD5 c73e4432d28a5c0f45df013d69227645
SHA1 932aae57dd983e9568e1753e1788a5921aa94dc9
SHA512 1d21f3e685a92fd8bdd2043869fb6541bb8913951a0b10a26d18b41a3b1ec17e90a2d6732d953bcdbd6aad40f8c92d7f9c2b24deb6d62518b467f46ab4f6add5
SSDEEP 384:OS7QWEMWE437F0GftpBjDc4HRN7FC2AXOVlPxZO:OSSP+ihBA9eZO
TLSH
T1C19219C2CEB89243DCD35DB0A2B9E9837D3DA7C71820912A105AF5992C937E4DB15A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Resources.ResourceManager.dll

Path C:\Program Files (x86)\TURKTRUST\Cedrea\System.Resources.ResourceManager.dll
Size 20KB
SHA256 eadc2fe50bb08977953f3e8c269ff7566a19c25b95cb43f85ab9d80f802981a3
MD5 d3a9e49c10552f152e102802ec5a87af
SHA1 a15b80dfa2b29083a3bf7db9f70bdbfb7a83f305
SHA512 3def4a045b8ea0eebbb31bd42d2efd5f290ab4fd4393eb8328b33006d1dd2fdcc18b56c28d2cbc1a27631b84eb5ea8fb68864e4be98ccaf72b366459c6edb601
SSDEEP 384:9eaW9tWt1VF0GftpBjSc4HRN7u5gXlL2PW:9eR6V+ikBeu
TLSH
T122920782CFB88543EDA36D7162B8DA837D3DA7C75D20551A109AF1A91CD33D0EB24A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.dll

Path C:\Program Files (x86)\TURKTRUST\Cedrea\System.Runtime.dll
Size 28KB
SHA256 04940f5a1efd33f57c491a797fd67c4158aa22b0147ed1a4a4c602fa1d60f580
MD5 867c5f1f90ca71fff832ffa0574b4200
SHA1 0c4144de80f701190d0207592c5c8eb90ff0d02e
SHA512 c9facc170c0ead65141da43c0549f96b630cf61c886a933eec4f4f61cae66f3218e195e92f9f5dad92b93e70112b00c7e762ec916b13b53d5f067f6bb7c3384a
SSDEEP 384:osm6AjixuZtMWC6g/jnyW/XW3LF0GftpBjD9T69c4HRN73AXOVlP1S:oHlwdnrC+iDToBgz
TLSH
T164D228A2EE589313DC971BB052B7D4C23EFAB3C60932592E104AE5953C833F49B61319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.Tasks.dll

Path C:\Program Files (x86)\TURKTRUST\Cedrea\System.Threading.Tasks.dll
Size 21KB
SHA256 5a7d2bb25660102f0f57ba2a9a881dbf29556616a91e7ff1cc4a31209c6e621f
MD5 1ef467a7f8ea1220d395a4b24716e66f
SHA1 a8bef0413aba8c0429affb94322bb9ce8b63899d
SHA512 8ee2a3ac9a9ffa10eada202dc0bc79cb73243208e0e204db626dc502b4375b929a4a9ca414b198e874bb3ec3007e9a5dd1de3e4106d624489a5860f797e0cfc9
SSDEEP 384:ts4GhT3d3Nl9WntW+Wxw0GftpBjEH6Kc4HRN7xllYD+IVD:ts4Ae16i8BxAqIVD
TLSH
T12CA23BE6CF7C9643ED936E7062AAD9837C3DB7C76D20912A105AF1942C933D4D720A2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Telerik.Windows.Controls.FileDialogs.dll

Path C:\Program Files (x86)\TURKTRUST\Cedrea\Telerik.Windows.Controls.FileDialogs.dll
Size 158KB
SHA256 fdab05120e0e4876645ac2ac8c507a592da37a5c3ba588969fbb5f0be03b7ddd
MD5 63e29eba5ae1125481210cef84c1d706
SHA1 2d8090fc0f55da42d21e50602de89199fc42c566
SHA512 b532510baa56189123fdc1899e33f9b9e168928827e4d5a9c7a5fe97013b077a178e732ec9a6fefee9f9ab48c21d887dcddcceabb47b17bcbc1c7ecd650a776a
SSDEEP 3072:c8kFJDjrCuj28WGEQQQ68akZZFrXvqt0RSG9x3R:c86Dj/Z9Xvqi
TLSH
T142F37C32A7EC872AC7EF467DE4A011058770E613A532EB5C7E8851EE1663B4197122FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Telerik.Windows.Controls.FixedDocumentViewers.dll

Path C:\Program Files (x86)\TURKTRUST\Cedrea\Telerik.Windows.Controls.FixedDocumentViewers.dll
Size 442KB
SHA256 3f1e28322fe565ede4faf8789bf9ecd6de95e500ee4c316bee019abb57cd667e
MD5 ff97a60d47efe9d817163d386984607a
SHA1 a7409f273337f6ff60dc83116e9450fbe64f208a
SHA512 2ae45cbaa83577a1bbb81bbf75a28209445a0f8ed163698c6218cd16f92cfc0e79a091cde5e64254249e23cbff7a8563bece6adcaf0d602bbf24fc7fa9019aae
SSDEEP 6144:7e78Qq1S2UpdlJVARwlMOytlM00vxuOV783plQ7u:vaFzleIUOV7r7u
TLSH
T1C6A49D5B56B4812FE9EF263238A80101C7B5A369E697FB18359CA4EE1FD3F418B41173
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Telerik.Windows.Controls.FixedDocumentViewersUI.dll

Path C:\Program Files (x86)\TURKTRUST\Cedrea\Telerik.Windows.Controls.FixedDocumentViewersUI.dll
Size 79KB
SHA256 667794977b0496ada6e8c98efa448281ea6302ec4cc5cc31acb313f76308e918
MD5 6d8d88f15f2b51cb768947244f5077df
SHA1 ada1c1b8f0c73f1f454865ac941e88469f86f59f
SHA512 d3d97d4dd885d8fbbb980058b98c8bbb5030d982706eecd83b29bd4569407805aa00ba5d59e5d049cbe751ffdef60ac529ea47ea8c8e76f53291610222d3b53b
SSDEEP 1536:+3Hh4lJVYrZ/MfdwNQLAAnmywsHnSAnmywsHOi2tZhq/szxw7hYcmg5aJCSCTYPw:s2aisvcmgkCSCTeBD1G
TLSH
T17283E88263FD0329EAFA1FB4257205500EBBB8936971D74D258C616D2BE7F9247017B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Telerik.Windows.Controls.GridView.dll

Path C:\Program Files (x86)\TURKTRUST\Cedrea\Telerik.Windows.Controls.GridView.dll
Size 1.1MB
SHA256 bc038363f156e3f608952e73559745b049b495a231d7e1288e171ee68eebf4ec
MD5 7846d535aec634b1fc0ac5feb1838e31
SHA1 34183ce518c474c46c0be1940f547855e19b273d
SHA512 685399bfaf3682355ff1cbf2cf382f7c7d0901aea9c2da9ea2845cd905d6399341323d0b6d133c7a3cb2d4579b54391ca56df78f1689523daa564634c2f2549b
SSDEEP 24576:w8oR5xijPj4BN/0UV8Sec6JLakww5ufR1/3DP:sdijPMQUVFeqv3
TLSH
T1E1355B2363E8CB5BC6EF4A79B074051867F0C887A3D3E79ABA41F7BA19837005C51667
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Telerik.Windows.Controls.Input.dll

Path C:\Program Files (x86)\TURKTRUST\Cedrea\Telerik.Windows.Controls.Input.dll
Size 594KB
SHA256 09cb98e541539cb888c0180e61e8926a67cebadb9345232819fd8fc6d0002408
MD5 cd4610105e13e2f5ea00fcd6cf6a198d
SHA1 8f599e37d45cff4dbca15584db9e825345335fb2
SHA512 be9be4ce64c3e0d3f4bb747b96d65012a7a3d5477ad8d8e98472a30c40e5c3b7e5606462aab369188e7c1beb0bc1529100828e5f7152b3f8cdb80f75b074706b
SSDEEP 12288:DlOhyjmAkuDqYxEMoto1KsvxDi5YHt0uxvwnZ1:whimAVx7oto1ZvBi5YH
TLSH
T1ADD45B6233B98B1EC2AF5B7AA0741414CBF0E4537BD6D74F2692E6AC5CE379108412DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Telerik.Windows.Controls.Navigation.dll

Path C:\Program Files (x86)\TURKTRUST\Cedrea\Telerik.Windows.Controls.Navigation.dll
Size 1.1MB
SHA256 b692620879c5654548b0d5bdc5a2348efe1f7a83df494576d34a30b7278e5e15
MD5 f0b4edcee959f47fb6bdda34dedc5b6f
SHA1 1b581e2220b2b19d97b2ce478b3dd4fcd7be2a18
SHA512 38ed890d56886b54f6bdfed1b1b9fc384d063ec4de8ed9008249597f221abe2e6e41ef60085c0606d886af22b3282f2803b76f4e56e392c82ccda335ac200eaa
SSDEEP 12288:3iM/mruZsX3S5WGPvkdhk7Lq1tMU2pJ8wt26qrewGtFpNKYeK/xzqFUN+qrxbI85:R7L1t26qrew21RbicbI8XXKlU
TLSH
T154355C1613E88B27C5AF07B9D0761A2476F0D687A3A3E78A7B9877BD1FC331049451A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Telerik.Windows.Controls.dll

Path C:\Program Files (x86)\TURKTRUST\Cedrea\Telerik.Windows.Controls.dll
Size 3.7MB
SHA256 3c1042e832581ab4b92df0825df7a1bede73f2351c6d61c88c3eb4054f251d5f
MD5 ae04bf271df74b507219e4177cee55c1
SHA1 80948fd86acb4317c5921b30ac4ece3322639a0b
SHA512 d63446e9051433679fe2e41f6cbc05c51113848424c3814f2cede4fa3f07bbe7d9a78d526d602cd51c0e01f33a01b451003e7855c0b33865598c558bf8188702
SSDEEP 98304:2jw6JRbbJ45j7Ha/zsS2bu5MbbzOpJbrc3Me9DMbJcioxcKK2SewFiYCJc7vfmIJ:2jdJ45/9iD54Mz
TLSH
T121062840A3FD5A5CF2FF4B34A938477B4570FD993902E11E3640AA6D08D2F448EA57BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Telerik.Windows.Data.dll

Path C:\Program Files (x86)\TURKTRUST\Cedrea\Telerik.Windows.Data.dll
Size 459KB
SHA256 6d4d291361c114f4bb2bb3dfc34deb807c5472dba9d07a617a64b26f71755af6
MD5 6e640aa3f47d415755b0c6f3aa072ee4
SHA1 4c80ed81a509f4039bc2a8ac5c1da20f982f769a
SHA512 bf4a8b90c808bbb1b0739cdd7d5ddf29d45a5b6b593441eea5072034e50b5f940b37ed4795ed7949a195cd36e31d34c4911cc79bfc67c96af4100566fbcd04c7
SSDEEP 12288:JzvqTjzy/UmofX/NCa8hx+BWupHVHFjNueAGvaSAv8rYn2sPz2Wp+kV23I1JaTV7:JzyTjzKx+MupHVHVNu
TLSH
T1AFA4482137DC8B37C1EF67BAE478240187B1E593A2A7E78B1A50A1F51C93791AD113E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Telerik.Windows.Documents.Core.dll

Path C:\Program Files (x86)\TURKTRUST\Cedrea\Telerik.Windows.Documents.Core.dll
Size 352KB
SHA256 62a3b45f1b449d5f4ecc8e230a8309b6bdba879fcab0a28e02220c3a17cd2829
MD5 7efdb1617375cf72cb16552245f65ade
SHA1 d0cd4443f592ccec744302a2fe2d63918bc623a6
SHA512 1a816be4a1d7543610f9e26ee45522bc67a82cb453ca934603b91b78feed62ca268982c86181537ece837fee09fca22f66ed2c7046b1ad45cb6a1de6c2942562
SSDEEP 6144:zUpaw02OHiGZWtjp/H69xRyCWsJmqoG6MnXxjGEp8egXMF7rwIuOjzqAi8Y5Gvl9:WZOH0qJ6MnRp7VrwIuOjzqAi8Y5Gvl9
TLSH
T11B746B5423E80223C5FF8BB9ECF0499B9BF4F16B7146EB4E1C885BD91C53B8A5940267
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Telerik.Windows.Documents.dll

Path C:\Program Files (x86)\TURKTRUST\Cedrea\Telerik.Windows.Documents.dll
Size 2.7MB
SHA256 b2b42ec666b2931ee634ace50ea1975915352dcb6e5b4b7fe531113bd56fd529
MD5 bac93ff73fe43ab133a9e82f30c31ad2
SHA1 a9e573d5563dd92cc915339d6459632387bb5b21
SHA512 5483b6d38bceb007e8204fcf2e287417db274a3ad2b1ebcc738a8f502cbe0828a822a18178fb3953a1706e9d37b7cd8eb62800474e1de645099741a26962fb81
SSDEEP 24576:KhUZmT+mSqPhKijD+yqWgoW1mZ3N7CnmDoAiGGxNbNcNaO7QX4IaFJ:NmTgqwydR2Zjq
TLSH
T155D52910B7B8C62AC56DAAB054B1708046F7F46C276ADF8D23C5E9AF795BF00C70526E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Telerik.Windows.Themes.Office2016.dll

Path C:\Program Files (x86)\TURKTRUST\Cedrea\Telerik.Windows.Themes.Office2016.dll
Size 2.2MB
SHA256 fc462029649e4bc34e3026d987458217ee2365b074842e64abffcb4e74031188
MD5 9e9da7c25761e8f0dd1f688a0f9329ae
SHA1 8c5913db2a12e25caa9a0e4bd0aa75810eb635f7
SHA512 f6a284c2a08808732768fc7834654529c2dc9fe432222f7132da0fdbfba372bd32f6182f4887752e31bf64c90a687550b98ffd420b3393390dc6fdb8b6f2b211
SSDEEP 24576:PA+ye6Rwsb9qunVN1MKPBIb5D4kKV0S69:I+yC2quVIKPBtV
TLSH
T113A5291216280E74CA729FFEDD9B455CBD38126102E1C86126AF2D69BDCCC92479E37F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TurkTrust.Cedrea.Core.Enumerations.dll

Path C:\Program Files (x86)\TURKTRUST\Cedrea\TurkTrust.Cedrea.Core.Enumerations.dll
Size 6KB
SHA256 d71ad510ae2e3857e420d2f45a5c767d810e19fac30c1935ba92b985326ad0f7
MD5 d45f4deca953681660c49b4eb3bd9d20
SHA1 c81767ab5365680be58f9fe9554394009064b268
SHA512 b6012a28bc35ce74a30bd9c21de1e4cd9cb4d3af29783e97661a9ed033feff13e9849b0464b9c60c853b4e1665ea83b0e522ec20464cd407a4234b453902ccd6
SSDEEP 96:YeAeIvZ3iS+h4UqWXq1k9qjco7XkIO/SHEzCnjqgvz1:TIJMKsyXcMaSHEw
TLSH
T1D0C1A496C3D84772FBB75F329977070515B6F9A9CDE2E72E0104420BBC256102672FA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TurkTrust.Cedrea.Core.dll

Path C:\Program Files (x86)\TURKTRUST\Cedrea\TurkTrust.Cedrea.Core.dll
Size 31KB
SHA256 80ceecfc20587f31bf23fe17c5917493a26eae50ff7d7eb4f84238eb4c9bf5be
MD5 db1b1580ffd409ddd9ae88aa613217bc
SHA1 2fbbb1fadd59875579646b008533b49780aeb9b8
SHA512 35cedc9db4744243d8e6f433920e192eb75e73d4d327a0310b0f14daf75fc8edc8484f9034b32c995e6a3f2922bb4d25f4698bbcf149fec54209b543aa6a6430
SSDEEP 768:iXGtbSMQWOY6wKpcDeRAPbSUvvd31q2TWrGvyboY1d31q2Dve:M/cDeRVk3WrGKbFNve
TLSH
T1DAE2F9107BDE065AD2FB8F796DF9108885F3F5E62C11EE0F1981114B0926785EE12F7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TurkTrust.Cedrea.WPF.exe

Path C:\Program Files (x86)\TURKTRUST\Cedrea\TurkTrust.Cedrea.WPF.exe
Size 2.0MB
SHA256 4543e4daacceff4a92f812e41839651bb06d0b2a7164749bc922f5c9bcb662e8
MD5 27863e5798ea19fe2514c0437f035f9d
SHA1 7da7bfa73c82056044d43f276aa8eab69ae95072
SHA512 47a79248b4eb751a52a20ba45970f18088e63e3c57f655706b45a4a2d59ba4c5a3c3b54a10702438f29ade919d5eddc164e773f55fd6840145eeb452392ec936
SSDEEP 49152:NgwLOIeQMN8Er1DGX4nWMWwEblz6HcjLjww1I:CwLOIeNNvkIWMWPbh6H2gwy
TLSH
T193A5DE19241E1A13C5A50AFBA8F6D31035A51D06D65BC6C837DD3CA8B7BCB8242FE772
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TurkTrust.Cedrea.WPF.exe.config

Path C:\Program Files (x86)\TURKTRUST\Cedrea\TurkTrust.Cedrea.WPF.exe.config
Size 1KB
SHA256 612e4b2ba65971b6c27bf05c979b8947de63288c08c6e8d2b9095528deea5a17
MD5 7a91c5bc49c76a33f4770f6b65e4002a
SHA1 424454c5080a1ee31a214acb4e7084c18e511dff
SHA512 d5f8fff0e147f16e02c459907a41fb4b951e221582315a6b53e2c7ba51b197c643fcf94bb2f9e816f2aed4c31559c6ca5b124c5b759b595372c9284ff5e35511
TLSH
T199318932AAC4A9A68A704E13FE21AC51EB1543671689084D70EF257F8FA3C4F97570B3
MD5 SHA1 SHA512 TLSH

Submit Download

MSID16.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSID16.tmp
Size 285KB
SHA256 f74c97b1a53541b059d3bfafe41a79005ce5065f8210d7de9f1b600dc4e28aa0
MD5 b77a2a2768b9cc78a71bbffb9812b978
SHA1 b70e27eb446fe1c3bc8ea03dabbee2739a782e04
SHA512 a8b16bc60f8559c78c64ca9e85cd7fd704bba1f55b362465b7accef1bb853d1c9616995a35f972256c57fbe877ce880398ba1fbceaa658604883aa12dcbc4f57
SSDEEP 6144:cAOfnUdzb4m26KFHF/jliAYktxjw0gCvo5VGWg6AZzGbasKHr45I:cRUFb4H6KJF/pDYkw0gCvoKWg6AZznX4
TLSH
T18B547C117AD5D432E1BE0530397DABA52ABEF8316DF0C68F9384566D2D712C0A728F27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e597ebb.msi

Path C:\Windows\Installer\e597ebb.msi
Size 12.0MB
SHA256 9cdc309bde3af8f3a2b8f775f4d8eb1655c43f0bab982c676131fda8eb5a2796
MD5 49f5315efeb9fd8549be4cca7e2ba54f
SHA1 67972b8e1081fbc27d00566a868c823f3233b684
SHA512 c16543423ec7807943dde181af3d424e4f660eb317f766a5f7820f8b9cfaf13c63a880929a30f16dd7ea4d1892136e604cd5de929c7872c316b3b0108cd716df
SSDEEP 196608:xE37EalEzlPf6CeWd1Iuy8YWjCeGTJvU/ptDJSxGIq6vQjwiNw68umxJXBSvqCt:x6IWEpPfWyuuy8YW+eCNEjDJXJ6ojLOn
TLSH
T1C9C6332275C6E177C0291C31193B476CBE76AC295EA4C90BD324BB4C6DB11C22BBEB57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 c9bbb22381cb85c7689a34b5d233b87af474cf1c41416d0545cf836e96f0788e
MD5 3685b61e756e7ce8127e6238a50e6513
SHA1 8ba62345d990ce71b6d0688b01f807c8154ac5df
SHA512 3cf40915d8f98ec1950f0f7caf17f9696d01850b07b2d714dd26c427349586909d138a8df0614a5e41a8d0fab1b6a6545cc0b5e4fe34ff83d5c7a76680c814f4
SSDEEP 24576:ZFo3DMPjdoO/vvTL/Sg88iFQvrumHb7P0BKudxSUKpyKpb9cMoRWclmd4+S:nHU
TLSH
T1C057B42436F92200E7F79E3DA8F06A234D397D5BAC15DE8D45511B4E0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{6799e1bb-6038-4b7f-94c4-47c257e00f3c}_OnDiskSnapshotProp

Path \??\Volume{c61f3bad-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{6799e1bb-6038-4b7f-94c4-47c257e00f3c}_OnDiskSnapshotProp
Size 6KB
SHA256 fe0decfa6d651a24e956c5880c1b32e860d24bf37712d97c8f6428cc1e25203e
MD5 b8ff110031fafbdee3fe77c5b6ba6ffd
SHA1 17012184bfc2df2689b54d9208604a8054308aba
SHA512 a0d657324cb68fe31b27deff2c8f77c8141be501c69025f999c9cec51206857b2f01d4d73397f77fc32193a02234c1fa684594eb44875a6dee0166e33a999390
SSDEEP 96:FoPJT7lCvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:+PJVeb++uVmN
TLSH
T10ED178081AE54711E2B3AB3129F14557A877B911FF33CB8E0198238E6621A10F935F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2836-421-0x00000000082A0000-0x00000000088B8000-memory.dmp

Download

memory/2836-371-0x0000000006020000-0x0000000006250000-memory.dmp

Download

memory/2836-419-0x0000000007870000-0x000000000791E000-memory.dmp

Download

memory/2836-422-0x0000000008000000-0x0000000008020000-memory.dmp

Download

memory/2836-399-0x00000000076A0000-0x00000000077C0000-memory.dmp

Download

memory/2836-427-0x0000000008220000-0x000000000822A000-memory.dmp

Download

memory/2836-428-0x0000000008240000-0x0000000008248000-memory.dmp

Download

memory/2836-426-0x0000000007FF0000-0x0000000007FFE000-memory.dmp

Download

memory/2836-415-0x0000000005FB0000-0x0000000005FBE000-memory.dmp

Download

memory/2836-395-0x0000000005F30000-0x0000000005FAA000-memory.dmp

Download

memory/2836-411-0x0000000005E70000-0x0000000005E8A000-memory.dmp

Download

memory/2836-387-0x0000000005E90000-0x0000000005F2A000-memory.dmp

Download

memory/2836-407-0x0000000006510000-0x0000000006584000-memory.dmp

Download

memory/2836-403-0x0000000005E40000-0x0000000005E6E000-memory.dmp

Download

memory/2836-383-0x0000000005D20000-0x0000000005D7E000-memory.dmp

Download

memory/2836-375-0x0000000006610000-0x00000000069C4000-memory.dmp

Download

memory/2836-391-0x0000000006370000-0x0000000006488000-memory.dmp

Download

memory/2836-420-0x0000000007920000-0x0000000007C7B000-memory.dmp

Download

memory/2836-379-0x00000000073D0000-0x0000000007692000-memory.dmp

Download

memory/2836-429-0x000000000B130000-0x000000000B138000-memory.dmp

Download

memory/2836-431-0x000000000B110000-0x000000000B11E000-memory.dmp

Download

memory/2836-430-0x000000000B140000-0x000000000B17E000-memory.dmp

Download

memory/2836-432-0x000000000D4D0000-0x000000000D4D8000-memory.dmp

Download

memory/2836-367-0x0000000003290000-0x0000000003298000-memory.dmp

Download

memory/2836-363-0x0000000000B80000-0x0000000000D8A000-memory.dmp

Download

memory/2836-436-0x000000000B000000-0x000000000B008000-memory.dmp

Download

memory/2836-440-0x000000000AFA0000-0x000000000AFAC000-memory.dmp

Download

memory/2836-443-0x000000000AFD0000-0x000000000AFD8000-memory.dmp

Download

memory/2836-442-0x000000000AFC0000-0x000000000AFC8000-memory.dmp

Download

memory/2836-444-0x000000000AFF0000-0x000000000AFF8000-memory.dmp

Download

memory/2836-441-0x000000000AFB0000-0x000000000AFB8000-memory.dmp

Download

memory/2836-445-0x000000000B010000-0x000000000B018000-memory.dmp

Download

memory/2836-446-0x000000000B020000-0x000000000B028000-memory.dmp

Download

memory/2836-447-0x000000000EDD0000-0x000000000EDF2000-memory.dmp

Download

memory/2836-448-0x000000000EE70000-0x000000000EED6000-memory.dmp

Download

memory/2836-449-0x000000000F120000-0x000000000F128000-memory.dmp

Download