14daf4e07c92a2e4a83e658a76a54ed907c7f3885de63149b64dc3168e55702f

Analysis

max time kernel
899s
max time network
907s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/10/2026, 04:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WPS_Office_x64.exe
Size 126.2MB
Sample261007-ep92nsds8r
SHA256 14daf4e07c92a2e4a83e658a76a54ed907c7f3885de63149b64dc3168e55702f
MD5 36919bc2b06e1f2e07cc3c7643c3e57a
SHA1 506353d007815df4c45596ebdac89cdc995d46b6
SHA512 ccb798f0b1c275ea4b2bacf19128ae0771c6fdc7aa9a81b762d7a77c3e76963a79ae5faecc55d9db43c64ab351d33304dd78a8805f5e1b6e29362855985d54d0
SSDEEP 3145728:pnsE1R2M8mVDcuy74o2iT7xt1ggmjxjbhkxvb/Q3:rRp8kDu72oLmxjgy
TLSH
T12C583322F29254B9D59642B0C5A763772938F9140731A7EB26906F385E32ED03E3FF58
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit defense_evasion discovery execution installer persistence privilege_escalation ransomware spyware trojan

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Parent PID Spoofing

T1134.004

description	pid	Process	procid_target
PID 2520 created 3192	2520	elevation_service.exe	54

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3932	attrib.exe
5112	attrib.exe

Executes dropped EXE 10 IoCs

pid	Process
3924	WPS_Office_x64.tmp
2180	Larkpurity2027.exe
4308	installer.exe
4880	Larkpurity2027.exe
1300	Larkpurity2027.exe
3616	Larkpurity2027.exe
4312	Larkpurity2027.exe
3480	Larkpurity2027.exe
1004	Larkpurity2027.exe
3516	Larkpurity2027.exe

Loads dropped DLL 8 IoCs

pid	Process
2180	Larkpurity2027.exe
4880	Larkpurity2027.exe
1300	Larkpurity2027.exe
3616	Larkpurity2027.exe
4312	Larkpurity2027.exe
3480	Larkpurity2027.exe
1004	Larkpurity2027.exe
3516	Larkpurity2027.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1224	icacls.exe
3788	icacls.exe

Enumerates connected drives 3 TTPs 5 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
	\??\F:\	waitfor.exe
	\??\F:\	installer.exe
File opened (read-only)	\??\F:\	waitfor.exe
File opened (read-only)	\??\D:\	waitfor.exe
	\??\D:\	waitfor.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	installer.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	waitfor.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	waitfor.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0B2CB9C11CFD091DCC143A9C3B857B3	waitfor.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0B2CB9C11CFD091DCC143A9C3B857B3	waitfor.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 11 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1864	cmd.exe
5084	cmd.exe
2828	cmd.exe
3180	cmd.exe
2932	cmd.exe
2504	cmd.exe
3976	cmd.exe
3668	cmd.exe
1680	cmd.exe
2740	cmd.exe
3944	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	installer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	installer.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WPS_Office_x64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WPS_Office_x64.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	installer.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral3/memory/4872-0-0x0000000000400000-0x0000000000428000-memory.dmp	innosetup
behavioral3/memory/4872-48-0x0000000000400000-0x0000000000428000-memory.dmp	innosetup

GoLang User-Agent 10 IoCs

Uses default user-agent string defined by GoLang HTTP packages.

description	flow	ioc
HTTP User-Agent header	791	Go-http-client/1.1
HTTP User-Agent header	956	Go-http-client/1.1
HTTP User-Agent header	56	Go-http-client/1.1
HTTP User-Agent header	279	Go-http-client/1.1
HTTP User-Agent header	575	Go-http-client/1.1
HTTP User-Agent header	1049	Go-http-client/1.1
HTTP User-Agent header	1164	Go-http-client/1.1
HTTP User-Agent header	200	Go-http-client/1.1
HTTP User-Agent header	444	Go-http-client/1.1
HTTP User-Agent header	668	Go-http-client/1.1

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
3716	taskkill.exe
4196	taskkill.exe
1424	taskkill.exe

Modifies data under HKEY_USERS 42 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	waitfor.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	waitfor.exe

Modifies system certificate store 2 TTPs 40 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\CTLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\SystemCertificates\TestSignRoot	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\Certificates	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\Certificates	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\Certificates	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\SystemCertificates\OemEsim	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\SystemCertificates\OemEsim\CRLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\SystemCertificates\OemEsim\CTLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\SystemCertificates\TrustedDevices	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CTLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CRLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\SystemCertificates\FlightRoot	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\SystemCertificates\FlightRoot\Certificates	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\SystemCertificates\FlightRoot\CRLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\Certificates	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\SystemCertificates\TestSignRoot\Certificates	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CRLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer\CTLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\Certificates	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\Certificates	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CTLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\SystemCertificates\PasspointTrustedRoots\CRLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CRLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\SystemCertificates\WindowsServerUpdateServices\CTLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\SystemCertificates\eSIM Certification Authorities\CRLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\SystemCertificates\OemEsim\Certificates	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CRLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\SystemCertificates\TrustedDevices\CRLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\SystemCertificates\AAD Token Issuer\CTLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\SystemCertificates\FlightRoot\CTLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\SystemCertificates\TestSignRoot\CTLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CTLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\SystemCertificates\TrustedAppRoot\CRLs	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\SystemCertificates\TrustedDevices\Certificates	installer.exe
Key created	\REGISTRY\USER\S-1-5-21-1805035633-626948184-3225555471-1000\Software\Microsoft\SystemCertificates\Windows Live ID Token Issuer	installer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4952	schtasks.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
3924	WPS_Office_x64.tmp
3924	WPS_Office_x64.tmp
4308	installer.exe
4308	installer.exe
2180	Larkpurity2027.exe
2180	Larkpurity2027.exe
2520	elevation_service.exe
2520	elevation_service.exe
2520	elevation_service.exe
2520	elevation_service.exe
2520	elevation_service.exe
2520	elevation_service.exe
2520	elevation_service.exe
2520	elevation_service.exe
2520	elevation_service.exe
2520	elevation_service.exe
4880	Larkpurity2027.exe
4880	Larkpurity2027.exe
4144	waitfor.exe
4144	waitfor.exe
2520	elevation_service.exe
2520	elevation_service.exe
1300	Larkpurity2027.exe
1300	Larkpurity2027.exe
3616	Larkpurity2027.exe
3616	Larkpurity2027.exe
4312	Larkpurity2027.exe
4312	Larkpurity2027.exe
4144	waitfor.exe
4144	waitfor.exe
3480	Larkpurity2027.exe
3480	Larkpurity2027.exe
1004	Larkpurity2027.exe
1004	Larkpurity2027.exe
4144	waitfor.exe
4144	waitfor.exe
4144	waitfor.exe
4144	waitfor.exe
3516	Larkpurity2027.exe
3516	Larkpurity2027.exe
4144	waitfor.exe
4144	waitfor.exe
4144	waitfor.exe
4144	waitfor.exe

Suspicious behavior: MapViewOfSection 1 TTPs 11 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
2180	Larkpurity2027.exe
2520	elevation_service.exe
2520	elevation_service.exe
4880	Larkpurity2027.exe
2520	elevation_service.exe
1300	Larkpurity2027.exe
3616	Larkpurity2027.exe
4312	Larkpurity2027.exe
3480	Larkpurity2027.exe
1004	Larkpurity2027.exe
3516	Larkpurity2027.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	4196	taskkill.exe
Token: SeDebugPrivilege	1424	taskkill.exe
Token: SeDebugPrivilege	3716	taskkill.exe
Token: SeDebugPrivilege	2180	Larkpurity2027.exe
Token: SeShutdownPrivilege	2520	elevation_service.exe
Token: SeShutdownPrivilege	4144	waitfor.exe
Token: SeDebugPrivilege	4144	waitfor.exe
Token: SeDebugPrivilege	4144	waitfor.exe
Token: SeBackupPrivilege	396	vssvc.exe
Token: SeRestorePrivilege	396	vssvc.exe
Token: SeAuditPrivilege	396	vssvc.exe
Token: SeDebugPrivilege	4880	Larkpurity2027.exe
Token: SeDebugPrivilege	4636	whoami.exe
Token: SeDebugPrivilege	1300	Larkpurity2027.exe
Token: SeDebugPrivilege	3616	Larkpurity2027.exe
Token: SeDebugPrivilege	4312	Larkpurity2027.exe
Token: SeDebugPrivilege	3480	Larkpurity2027.exe
Token: SeDebugPrivilege	1004	Larkpurity2027.exe
Token: SeDebugPrivilege	3516	Larkpurity2027.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3924	WPS_Office_x64.tmp

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4144	waitfor.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 3924	4872	WPS_Office_x64.exe	82
PID 3924 wrote to memory of 4196	3924	WPS_Office_x64.tmp	83
PID 3924 wrote to memory of 1424	3924	WPS_Office_x64.tmp	87
PID 3924 wrote to memory of 3716	3924	WPS_Office_x64.tmp	89
PID 3924 wrote to memory of 2180	3924	WPS_Office_x64.tmp	91
PID 3924 wrote to memory of 4308	3924	WPS_Office_x64.tmp	92
PID 2520 wrote to memory of 1864	2520	elevation_service.exe	97
PID 1864 wrote to memory of 4144	1864	cmd.exe	99
PID 2520 wrote to memory of 5084	2520	elevation_service.exe	100
PID 5084 wrote to memory of 1224	5084	cmd.exe	102
PID 2520 wrote to memory of 3668	2520	elevation_service.exe	103
PID 3668 wrote to memory of 3788	3668	cmd.exe	105
PID 4144 wrote to memory of 1724	4144	waitfor.exe	106
PID 2520 wrote to memory of 5112	2520	elevation_service.exe	107
PID 2520 wrote to memory of 3932	2520	elevation_service.exe	109
PID 2520 wrote to memory of 4952	2520	elevation_service.exe	111
PID 4144 wrote to memory of 1408	4144	waitfor.exe	113
PID 1680 wrote to memory of 4880	1680	cmd.exe	119
PID 4144 wrote to memory of 2828	4144	waitfor.exe	121
PID 2828 wrote to memory of 3280	2828	cmd.exe	122
PID 2828 wrote to memory of 4636	2828	cmd.exe	123
PID 3180 wrote to memory of 1300	3180	cmd.exe	126
PID 2740 wrote to memory of 3616	2740	cmd.exe	130
PID 3944 wrote to memory of 4312	3944	cmd.exe	136
PID 2932 wrote to memory of 3480	2932	cmd.exe	142
PID 2504 wrote to memory of 1004	2504	cmd.exe	154
PID 3976 wrote to memory of 3516	3976	cmd.exe	172

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3932	attrib.exe
5112	attrib.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3192
- C:\Users\Admin\AppData\Local\Temp\WPS_Office_x64.exe
  "C:\Users\Admin\AppData\Local\Temp\WPS_Office_x64.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Users\Admin\AppData\Local\Temp\is-GO66N.tmp\WPS_Office_x64.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-GO66N.tmp\WPS_Office_x64.tmp" /SL5="$5029A,131909722,119296,C:\Users\Admin\AppData\Local\Temp\WPS_Office_x64.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3924
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM Larkpurity2027.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4196
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM Larkpurity2027.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1424
  - - C:\Windows\SysWOW64\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /F /IM Larkpurity2027.exe /T
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3716
  - - C:\Drivers\SkimmingPutt\Larkpurity2027.exe
      "C:\Drivers\SkimmingPutt\Larkpurity2027.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:2180
  - - C:\Drivers\Addscolonist7038\installer.exe
      "C:\Drivers\Addscolonist7038\installer.exe"
      4⤵
      Executes dropped EXE
      Enumerates connected drives
      Writes to the Master Boot Record (MBR)
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      PID:4308
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c waitfor.exe ZqIdleHeartbeat3f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1864
- - C:\Windows\System32\waitfor.exe
    waitfor.exe ZqIdleHeartbeat3f
    3⤵
    - Enumerates connected drives
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4144
  - - C:\Windows\system32\cmd.exe
      cmd ver
      4⤵
      PID:1724
  - - C:\Windows\system32\w32tm.exe
      w32tm /resync
      4⤵
      PID:1408
  - - C:\Windows\system32\cmd.exe
      cmd.exe /K "chcp 65001 >nul"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2828
    - - C:\Windows\System32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:3280
    - - C:\Windows\System32\whoami.exe
        
        whoami
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4636

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Windows\system32\cmd.exe
  cmd /c "icacls \"C:\Drivers\" /deny Users:(D)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5084
- - C:\Windows\system32\icacls.exe
    icacls \"C:\Drivers\" /deny Users:(D)
    3⤵
    - Modifies file permissions
    PID:1224
- C:\Windows\system32\cmd.exe
  cmd /c "icacls \"C:\Drivers\" /grant Users:(OI)(CI)(RX)"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3668
- - C:\Windows\system32\icacls.exe
    icacls \"C:\Drivers\" /grant Users:(OI)(CI)(RX)
    3⤵
    - Modifies file permissions
    PID:3788
- C:\Windows\system32\attrib.exe
  attrib C:\Drivers +s +h
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:5112
- C:\Windows\system32\attrib.exe
  attrib C:\Drivers\* +s +h /S /D
  2⤵
  - Sets file to hidden
  - Views/modifies file attributes
  PID:3932
- C:\Windows\system32\schtasks.exe
  schtasks /create /tn GajfkZfIppXseqCLUsWIRFhG /tr "cmd /c cd /d \"C:\Drivers\SkimmingPutt\" && start \"\" \"C:\Drivers\SkimmingPutt\Larkpurity2027.exe\"" /sc onstart /ru SYSTEM /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4952

C:\Windows\system32\cmd.exe
cmd
1⤵
PID:3908

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:396

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\SkimmingPutt" && start "" "C:\Drivers\SkimmingPutt\Larkpurity2027.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Drivers\SkimmingPutt\Larkpurity2027.exe
  "C:\Drivers\SkimmingPutt\Larkpurity2027.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:4880

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\SkimmingPutt" && start "" "C:\Drivers\SkimmingPutt\Larkpurity2027.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3180
- C:\Drivers\SkimmingPutt\Larkpurity2027.exe
  "C:\Drivers\SkimmingPutt\Larkpurity2027.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:1300

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\SkimmingPutt" && start "" "C:\Drivers\SkimmingPutt\Larkpurity2027.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Drivers\SkimmingPutt\Larkpurity2027.exe
  "C:\Drivers\SkimmingPutt\Larkpurity2027.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:3616

C:\Windows\system32\schtasks.exe
schtasks /query /tn GajfkZfIppXseqCLUsWIRFhG
1⤵
PID:4068

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\SkimmingPutt" && start "" "C:\Drivers\SkimmingPutt\Larkpurity2027.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Drivers\SkimmingPutt\Larkpurity2027.exe
  "C:\Drivers\SkimmingPutt\Larkpurity2027.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:4312

C:\Windows\system32\schtasks.exe
schtasks /query /tn GajfkZfIppXseqCLUsWIRFhG
1⤵
PID:1644

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\SkimmingPutt" && start "" "C:\Drivers\SkimmingPutt\Larkpurity2027.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Drivers\SkimmingPutt\Larkpurity2027.exe
  "C:\Drivers\SkimmingPutt\Larkpurity2027.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:3480

C:\Windows\system32\schtasks.exe
schtasks /query /tn GajfkZfIppXseqCLUsWIRFhG
1⤵
PID:2436

C:\Windows\system32\schtasks.exe
schtasks /query /tn GajfkZfIppXseqCLUsWIRFhG
1⤵
PID:420

C:\Windows\system32\schtasks.exe
schtasks /query /tn GajfkZfIppXseqCLUsWIRFhG
1⤵
PID:2448

C:\Windows\system32\schtasks.exe
schtasks /query /tn GajfkZfIppXseqCLUsWIRFhG
1⤵
PID:4740

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\SkimmingPutt" && start "" "C:\Drivers\SkimmingPutt\Larkpurity2027.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Drivers\SkimmingPutt\Larkpurity2027.exe
  "C:\Drivers\SkimmingPutt\Larkpurity2027.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:1004

C:\Windows\system32\schtasks.exe
schtasks /query /tn GajfkZfIppXseqCLUsWIRFhG
1⤵
PID:3900

C:\Windows\system32\schtasks.exe
schtasks /query /tn GajfkZfIppXseqCLUsWIRFhG
1⤵
PID:2388

C:\Windows\system32\schtasks.exe
schtasks /query /tn GajfkZfIppXseqCLUsWIRFhG
1⤵
PID:1660

C:\Windows\system32\schtasks.exe
schtasks /query /tn GajfkZfIppXseqCLUsWIRFhG
1⤵
PID:3468

C:\Windows\system32\schtasks.exe
schtasks /query /tn GajfkZfIppXseqCLUsWIRFhG
1⤵
PID:1192

C:\Windows\system32\schtasks.exe
schtasks /query /tn GajfkZfIppXseqCLUsWIRFhG
1⤵
PID:1944

C:\Windows\system32\schtasks.exe
schtasks /query /tn GajfkZfIppXseqCLUsWIRFhG
1⤵
PID:1016

C:\Windows\system32\cmd.exe
cmd /c cd /d "C:\Drivers\SkimmingPutt" && start "" "C:\Drivers\SkimmingPutt\Larkpurity2027.exe"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Drivers\SkimmingPutt\Larkpurity2027.exe
  "C:\Drivers\SkimmingPutt\Larkpurity2027.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  PID:3516

C:\Windows\system32\schtasks.exe
schtasks /query /tn GajfkZfIppXseqCLUsWIRFhG
1⤵
PID:4420

C:\Windows\system32\schtasks.exe
schtasks /query /tn GajfkZfIppXseqCLUsWIRFhG
1⤵
PID:4020

C:\Windows\system32\schtasks.exe
schtasks /query /tn GajfkZfIppXseqCLUsWIRFhG
1⤵
PID:3728

C:\Windows\system32\schtasks.exe
schtasks /query /tn GajfkZfIppXseqCLUsWIRFhG
1⤵
PID:2516

C:\Windows\system32\schtasks.exe
schtasks /query /tn GajfkZfIppXseqCLUsWIRFhG
1⤵
PID:1632

C:\Windows\system32\schtasks.exe
schtasks /query /tn GajfkZfIppXseqCLUsWIRFhG
1⤵
PID:4804

C:\Windows\system32\schtasks.exe
schtasks /query /tn GajfkZfIppXseqCLUsWIRFhG
1⤵
PID:1132

C:\Windows\system32\schtasks.exe
schtasks /query /tn GajfkZfIppXseqCLUsWIRFhG
1⤵
PID:196

C:\Windows\system32\schtasks.exe
schtasks /query /tn GajfkZfIppXseqCLUsWIRFhG
1⤵
PID:2264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

Process Injection

T1055

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Access Token Manipulation

T1134

Parent PID Spoofing

T1134.004

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Process Injection

T1055

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

element.mp4

Path C:\Drivers\Addscolonist7038\element.mp4
Size 33.5MB
SHA256 8856498cc64dfe296720288009cca8e9aba46414eb783514a80a8509ae4aa1b0
MD5 92fb1ed96fe2d7c5b29820737411709c
SHA1 9102a74bcfd188b60a4aa307b8be91d7fad01084
SHA512 d0ea25f48b8e70a5982e1c73b676ccb7127780344c6e0fd3621c31ac6ec201935d034e9ea04e32b369b0ffefee2edcecbde799307ed678a3edfdf4bd7863d2d9
SSDEEP 786432:KKzn9eNLh5n2Ao5/WP7FTyC8Ir7rZjyiqi8RsLGZGK4qCH:KuE1R2hWP7ZyCFVjyicsLy743H
TLSH
T11B77336D9376E085E36523F29FC431EE573DBBE80714B3A81AB2231BD03DA9190AD15D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

installer.exe

Path C:\Drivers\Addscolonist7038\installer.exe
Size 5.5MB
SHA256 4932670ff54b6efef2ddef4835295646d3c5c66e69d944fce456d9c32a26f66b
MD5 5a2bdf7321c1c4cd4306837fc40c2e5d
SHA1 f4c101eaf525f116a6d6d0388a6b2cc2dba58142
SHA512 5a3ec1bc0a2b0688a956d12bc9549ea2f7fe6ff40366bc627dc02a56b0147923a46cd47708ce6c8a544a9e90d705586d31a23356b5e6be946ba1a8cb7cffadaa
SSDEEP 98304:kWJLSU6ZVUdnkurXJ1m2CJQvGPeuTxp6vTV1IWdsBO4+jQ/1pF:fmU6ZVwPrnYJTxpadsZ+o1pF
TLSH
T10346C011FB8681F1E4D201B0157BBBBA587DAA285B2588D7F7D02D2584302D37A3BF5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-44HMQ.tmp

Path C:\Drivers\Addscolonist7038\is-44HMQ.tmp
Size 32.6MB
SHA256 b3445120834e759d39ea857029b64b1f5fac0ab2ee1add27ac43044974f6af76
MD5 df7d7ebd3af9d6035b977f9eab9d2e47
SHA1 6c9c3468cd2db2fa132699dba198bdcce0ce2c40
SHA512 1143f8cb7dbc346c96d7787893a9a706d5a6519f55c225458be570b63f7d3b6fe93db03691c1bc8fd7eb59e5985304f7cf83390c32e9900561ee8c3cf85d5aaf
SSDEEP 786432:tgdSrgRsKwRzjjhdWVS4nog2rao3se3EARacok+vczJ1GA:tgdmghwxjbrYkrT3UAkk+vW7T
TLSH
T1FD77337C42F9D444D37593F2FA86037F423C67D6094872608D6A6387D879E80ABFA85E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kopiya.mp3

Path C:\Drivers\Addscolonist7038\kopiya.mp3
Size 2.2MB
SHA256 411a33aa5fa7e6a3f111fd83428b7bab86901249fcc2cd772d97558368c223f6
MD5 ffd8d58ec282a409772a4adc06b1e3b9
SHA1 4f7373d980bcda6cd0dc8d3d3971594a8bd52d96
SHA512 7685581f7fb7c23560775bed3c3036e662b284faf90255e78f36f776c1dff6f3232ef8335d3728f7e8a2fbf12d7b093ebdb95f457e953e98be4df070ebb72ab2
SSDEEP 49152:Y6vVDboaaqFCQq8bEmDoLQlet8PHg7/ZXxi5VGuUvJ:DvVDbAqFuCEmJQOHgXi5Py
TLSH
T1EAB5335AF6A89106ECFC7B7A57F70BD8CE1A4B260E8473128D15102390B5790E5EFB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

primer.png

Path C:\Drivers\Addscolonist7038\primer.png
Size 15.4MB
SHA256 8860fbad4d22e158ec6b4d3ac92b7f475f2f36ac2d5ab5038dd8552e179bc7f2
MD5 3eb98348d7b7bd5640ca6ac933ede3aa
SHA1 af68224f8bdb05c259c367d69ecd037348af2f8d
SHA512 4bc1be734cc5aecf6915d794606aee66682f39151eed326a17342d32135f41764ac49625a119de2451e5dfa592a4807a1e384f2a535f12a598c3de8067151253
SSDEEP 393216:3siqwShpdGhfqsntp/g+QOFGaAXIJYaukujXSdQglxQdg:3s30hB3nFuIJYaukVd/lx8g
TLSH
T1CAF633F806AF4DE57202B0A9702773FC17D5FBF00A06B9A2FB65409B125E8EC1667794
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

registraciya.png

Path C:\Drivers\Addscolonist7038\registraciya.png
Size 14.2MB
SHA256 50a5ea14ce344b4081abd4e5d01cda3c5e99c3ee11398ef1bf0b65f4c32d82cf
MD5 cf9ba4848d04056cbe2ff4198edde496
SHA1 e2a87694ff936c7a4a9552b633c9a9500d7e1cdb
SHA512 8963fd757b41e4ef22893a95c921783b69eb7114759a878b4819158411347fe6bc8f888624ad119bcdb62e6cc5a76fcb752344ec78fdf0e96c495828f0c13e39
SSDEEP 393216:OcxjBJUrSHGfN9mOpk6kGvrCYRKTYP47l0gQ8zF:OcxjzU2aN9GGvrqlQ0
TLSH
T120E633472FD71371E16BEA2ADF7F63807B8DC36A1A82E5A19C8C1207559A22D5D3C31C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stil.mp3

Path C:\Drivers\Addscolonist7038\stil.mp3
Size 2.4MB
SHA256 02e135568e0e142448eecd47aaad3ea3a1768b73f958f415eced3a05804b20c0
MD5 17828f7c343a444f043c6ad03ba78877
SHA1 44882ba2073ac29bd9a34ad29e8a3ad2b6c1b299
SHA512 372b533ad436b9ef9094c74c970370d8e321667a2dce908a2e3c39aa05367ad3b307d37687d3ffc3550009d20f96d714f3e9590fd08b2c3e21944efccade7fde
SSDEEP 49152:bAcTjd20i/Twfv9Zip9LgjMDpZU/EO9tBK7zS7YZztHI/1/170L1+SU1TLlr:ccTjdmEfO3eM3UsPNZzto/1lSU1TL
TLSH
T173C533398834101FF4E186F3A149396FC4A6D79D5D28B694E5B0341BC542F2BEBE5D83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Larkpurity2027.exe

Path C:\Drivers\SkimmingPutt\Larkpurity2027.exe
Size 6.3MB
SHA256 4cf7281ac1036468edceccbe3535a35dc528c8954b9466df1722b5a7205b59f9
MD5 7c0969dfc870eb1a6033c9452afdf792
SHA1 43ea34ce3a77cc4cc0da9f651ccb2f4e59e1cc43
SHA512 4e57a58d96e45d9ac8ccd2b5f761b0aac3e055b1cc80ca45a32edad4d3ca14d6ee353b225cded8522a629c4cbaa77b4382ef00709933dfc64bf861967a6f7fff
SSDEEP 98304:Z8Bn5Ucs9D50zg2UlAvaP8UGi9Q+0wZkn4mQk93PSfggTlzQM7nP6nXqJhE6GM4Y:b9T8X54s9jmXov13uFnCPwHMStuNzm
TLSH
T151666C26F25268ADC99A9270C69753333635F8501332EB3F2654EB342F27ED02E5EB54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QuakePreceding5900.F3

Path C:\Drivers\SkimmingPutt\QuakePreceding5900.F3
Size 4.4MB
SHA256 d9cef7ddeb83d025793b2b802ed4eed7c4a4d8d28bbd9d8f79ebad2383b226bf
MD5 c510f3db221e59bf11d077b8e69184d5
SHA1 1a9dc635e847300810630595a867551b72d94d10
SHA512 f492faea0f1e4e9e1fee20276cf119ad561ba3bc4971fd26eab53149321d70a32c3bb92fea01d9b5ae97384aeff862853393fcee8e8e3495d09af227490cf6c6
SSDEEP 49152:W0yti4T67dMa1yBtIi+/QlkOanjrTr4eaYGWnOc4/hSvWby8m:W0ytB6Xi+/QmOqj3rIYHnOcmHe
TLSH
T12126BF313241A914E16F431AD1B85E1CD67D6A48A3BA5F5C8F13BFE23E95302FA7819C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 19KB
SHA256 9d08278ad74fe7d67620005e03235915875d823e745e4ef934c7db8daaa9cf15
MD5 dcb295fc17bf69dc804acb41c342d52c
SHA1 385745db182179ce14b4b9bbc368c68b6eaaf86d
SHA512 d64b435fd4d51d256a89e94021237ecc066791bd7ef0728c69349d5f20858374c2832be1c0da40e9fcc39344d3146e6598e20c6f0cec596c75494d6c70e41bf9
SSDEEP 384:truUMsm4d3suSgR2loMnJjJZiFcsMgz1i92g+xeUvzXWgN:AUQgNQoMJjJZacstz1i963zXvN
TLSH
T1D392D093CE4091C9A29A4321094DE626F5CB3DFDB87CFD3CC672915A4CA8B5583E2DE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 17KB
SHA256 863ab1368d08a86236239094a781f0ef8e5bb2653924e85abd0da5e73d26b4ec
MD5 cd0af3c5c50de939b7b0985154ca1afb
SHA1 971e13e4b6b4d3016916971bd0ca0ab7c143e74a
SHA512 48d9967cfca7fbdea35830e81a684394589df8d8522b4aa4c211ba3c18d951dd541b2646c913b75d82ac8845bce6e466af822aab5a00806e4601f6ede78eef1e
SSDEEP 384:truUMsm4d3suSgR2loMnJjJZiFcsMgz1i92gy:AUQgNQoMJjJZacstz1i9u
TLSH
T1D682D0D3CE4491C9A29A4321145CE526F2C77DFAB87CFD6DC472850A8CACB1583E2DE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 28KB
SHA256 d8ff96078a32c8eb8c254dec19d5a5977f442412ae8b13252342da983e4d5212
MD5 ce0d17cb2ca94862c87cf422f92384a2
SHA1 47448be934075bb529a3e72fd772525f14e4d919
SHA512 b09daf20394d6e6e5e50d631d30506499af8c9bde70ea702712d4cfdc9d6586ebd18ac567a524745bbbc3852ffa4f7a99d382f0cc6ce3b8e338db71b166ba575
SSDEEP 384:truUMsm4d3suSgR2loMnJjJZiFcsMgz1i92g+xeUvzXWgiDMs/sWPlT2SUkd:AUQgNQoMJjJZacstz1i963zXv0TPlTvv
TLSH
T1E2D2D1578A10A0C0B3A70326164AF53BF5C63DEC7869FD7CC672C08D8DD4A5A87E1E91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 35KB
SHA256 8c9c7d7287001f653b3b34424e13ccb608b7213e594a1e331513fa716cebe143
MD5 06373c500bbd69dd1e538f9f3309a6e4
SHA1 36cc5f3619d8164f373364ab07936f0e2d8ed8a3
SHA512 39b5aa55030f44fba19e19051059dbc8c62988e01b63f4decfa3b28957f5bd23000242813c6f98f2ec4ce15b9e437f52b20fe87bb8581ecffd250d527c00ba0e
SSDEEP 768:AUQgNQoMJjJZacstz1i963zXv0TPlTvSbs96eeuVpQq:AUFNuna263zXulTvEs9ZpQq
TLSH
T100F2E0178710B5C122EB0325290AF26BF5C678F87889FC7DC322C08D8E98B5A87E1D52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 35KB
SHA256 8c983acbb4e15e44fb9ffc7687eb7e732e2912f5f512a6b64992789d5f35da30
MD5 1f651bd1bd5ef65a24b048baf9d0aec8
SHA1 48b6f652ae8164fc1b85ef7b1d516e9e41b30613
SHA512 8fc095005e051bedd71d4abe0c08d01b10f39f9f244fa47c2865a171ebc56b123393f20c00f2a37dde51cd322bcfdd6659fac1dc6755b2b75c7a80d1e8f75626
SSDEEP 768:AUQgNQoMJjJZacstz1i963zXv0TPlTvSbs96eeuVpQJ:AUFNuna263zXulTvEs9ZpQJ
TLSH
T145F2E1678710A5C132DB0325290AF26FF5C679F87899F87DC321C08D8E9475AC7E5E52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 41KB
SHA256 df4eae89c02445605b96cbf42a9bd98142a7a6d631f17a9d282d97b338ce722f
MD5 fdc448673e496620e379f6cc1aeda2e8
SHA1 fcfcee75d08b11fa4c5e3b58c4c57023b10d0023
SHA512 b846de85df24b2441e4817278a19a7d13a5f2b45ebebb9a0e3e253f09b89d99112a3a926a5934063aeb0b95eff985197c6618d1a27d3c72f8f332ccc4314fc7c
SSDEEP 768:AUQgNQoMJjJZacstz1i963zXv0TPlTvSbs96eeuVpQlW5vvUs:AUFNuna263zXulTvEs9ZpQliUs
TLSH
T1DA13E0678610B2C136D60322241AF26BF5DA39FC7894F87DC322C09DCED875A97E5D52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 43KB
SHA256 c442b9e68ef5583469f1fe00f7a9c8676fc2cc257fcbb10564b133c3b818927a
MD5 4d491e5d68d1d612842bfbe95b49e298
SHA1 90219fe134e51d6f1efd53693a73c02542da510c
SHA512 a7ef45d5b072887e77ced06c01ff8e7ef0790071a2684252a1aa58eb355b2277f127bfff5ce13ae27a54f758b51814f6563b963878b7b28efeaeded202fb39a1
SSDEEP 768:AUQgNQoMJjJZacstz1i963zXv0TPlTvSbs96eeuVpQlW5vvUS21FO:AUFNuna263zXulTvEs9ZpQliUrO
TLSH
T16013E0678614B6C137DA0322650EF1ABF5CA39FC3894B83DC222C05DCE9C75ACBD6952
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 48KB
SHA256 d35f35acd34b497d3c7262df76be42927c42304992724fe22b3e1fecb85e4ef1
MD5 328aabf33521f35fae096d0d0f04729c
SHA1 84e19091bbeb9ae64340c383b060dd7eb7bedbb0
SHA512 38f558b95a5428bb99cac5ce62d2fe206ec96721d78644e67b28d77664c22e0213ffc2872a2f1dafe33ee0441751c251ee5200d5bb5766c17d9a1b7ae03ab15a
SSDEEP 768:AUQgNQoMJjJZacstz1i963zXv0TPlTvSbs96eeuVpQlW5vvUS21FFnzLk2zvk:AUFNuna263zXulTvEs9ZpQliUrxNzM
TLSH
T11723F067831476C123EA0366640AF2AAF1C938F83584F47DC227C44DCEAC75AC7E6902
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 51KB
SHA256 8e6582e77ba23169f815933ea3b06453bcd0ac05bd1b569770673727573d3f67
MD5 307d3afe2da024fef037b76191ba112f
SHA1 f656c677891cf9fe7c6d1240ce426730eb42227b
SHA512 d1c6f12bff7280a0f35232a0caec53fe5b372aeb3161865904ddb6f60297a57154b6385d728acc82a130a25d720e4fb2b72a4f4d6418e622f6f7d26f5486922a
SSDEEP 1536:AUFNuna263zXulTvEs9ZpQliUrxNzIP94:ZFO63zXuRvEIpL94
TLSH
T16B33F167871472C122DA13A2685EF2ABF4C968F83584F43EC727C44DCEA875AC7E5E01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 59KB
SHA256 7f40de7e5a6803043ef0b3a137c677a83d050eda1259bb672d726f942fffeb8c
MD5 e9b5b2b53b1cef810906203dfd480568
SHA1 6422bcf7fdb728a779f5d2585c049326e9bca4cd
SHA512 694b46bc1dc57e9fff73826def25651f2386744a9cd124a572c58153523ae9b1551a200b2f6d5d3dfb767ac38fd1339f8e939450a737c2ac89fbf1071a4e712d
SSDEEP 1536:AUFNuna263zXulTvEs9ZpQliUrxNzIP9ijrVc0Ujkj2:ZFO63zXuRvEIpL9Gc/j82
TLSH
T1EB53F1ABC31871C122D603E2594FE2ABF1CA38F839D4B43ED627840DDE9835AD7D5A51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 61KB
SHA256 2048622f6fea3f582ff6765e93438c768487908a4f06b97d83b95bd45ae693fd
MD5 c6726fe0231baf14cdc773b4c6a4a4b7
SHA1 4d734f6b893662247a958d3a30aabc8477982e38
SHA512 cdc1c3077828cceca1b1509d85e32c70849e9500af2c610a104e213e7f5aa64904ed9c04a6ca400db12e353adc8e7b5400379928e6f3de99f8a141e2206193df
SSDEEP 1536:AUFNuna263zXulTvEs9ZpQliUrxNzIP9ijrVc0UjkjC:ZFO63zXuRvEIpL9Gc/j8C
TLSH
T1285301AB831871C422D643E2194FE2E7F5CA38F836D4B43EC617844DDE98365C7E5A42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 75KB
SHA256 8ae90521771a1ce5bfca8145e0c61f9b728b659e6ef4ec2b9d11aa902abe3b6d
MD5 4e94becaa1b78e18f85e3258e556ea07
SHA1 6bcc9871d204e7d7d076c45080e6e40060f6fc50
SHA512 0d1df43fe1a170502a5741baf4b11e7ce30d52e00468e1ab7dd7b1be80c37fec71a2d6a0f07579a5ab10746ed6fe5256a0bd6696526707a93d79b57b1a9d88ac
SSDEEP 1536:AUFNuna263zXulTvEs9ZpQliUrxNzIP9ijrVc0UjkjSuueahAdUPST:ZFO63zXuRvEIpL9Gc/j8XaNST
TLSH
T12E73029B871CB6C821E757A2584FE2A9F1DA34F836C8743EDE1B401C9E9836587D0E42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat

Path C:\Drivers\drivers.dat
Size 6KB
SHA256 551e51c51e57b56c05ec14a20bc7103d54fe6c9a995ca3ce2fcb0fd1b6297c20
MD5 4b5a4646b23846c893f5377b59d246c8
SHA1 9ec11eca9aaa26b1641c31f18df2595dd6e940a0
SHA512 dffcd250ab678b361d380fbb358a34a6346e7193304ca4c9662caae18a9b2b2625ede2e87f80844c0ebc68d4b50c1c99d3ddae14f427bdd6e7a605c4d9d31693
SSDEEP 192:QuLHLu6bO3sav6JXd0O4SsuW9gDydG+kGh0:truUMsm4d3suSgR2q
TLSH
T12DE19F1B5C4083C905EC621222AAF72BF56BB69FB8767C1D963346088DE0651C3E38E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 28KB
SHA256 74b1ef07fb378f36246278b96b550e5b37be3bd6b6faaf2c6570ddee8bce5f58
MD5 c889f43e5666c800a443a94f748d6f5f
SHA1 b2425e1c2b4f5e9435a7e2077d63b5be5d3e4f89
SHA512 eda5e825549b001870130517e4d19de09c1a0e5daa78f09dbaf7cfc669871401930f12c5427c757872b89eb4c35b41c7efbe3b5f3808d220296919829ea207a8
SSDEEP 768:AUQgNQoMJjJZacstz1i963zXv0TPlTvSJ:AUFNuna263zXulTvS
TLSH
T158D2D1578A10A0C1B6E70325115AF13BF5C63DEC78A9FD7CC672C08E8D98A5687E1EA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 34KB
SHA256 1fb6f43f3658f3290866faca243ee381bb1475fe73c036e6738eb52cc31d4fa3
MD5 0bc9c0b241e87a86afb0d1704ec3e0fe
SHA1 131c788622aca2cda514f1e853de3413f888c635
SHA512 4fc41893142ddc9aa4dcee8c15e39f987b0bfe1a6789ff41c8edf65d95f27074de25e23b09900e3cf4a150fa182e45aa23124ed183a8d4ef408a97eac4352fed
SSDEEP 768:AUQgNQoMJjJZacstz1i963zXv0TPlTvSbs96eeuVpQv:AUFNuna263zXulTvEs9ZpQv
TLSH
T1BAF2E0178710A5C162EB0325690AF26FF5CA78F87898FC7DC321C08D8D98B5AC7E2D52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 3KB
SHA256 5cebabdb4e997759ab10ed2298cd948ff4ba5e97c54082e3a4f43cdcbe5ba752
MD5 b4a76dfc678c54027536554e4c5a980c
SHA1 89008e3046bd576b3f588fb4a11fca36de6ab7ce
SHA512 3b08cb04cdfa2955fbf965950f5af50c58ad384bea16471942b664d6758cfe68b35adc066d7abd047812fa0ad926ea3880b66b2f68b636583340e5358f192510
TLSH
T192717D189C80474550FCE2D152E9F01BF2ABB19AF871FC5D8922020989D8455C1E3FFA
MD5 SHA1 SHA512 TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 61KB
SHA256 e4dbade297d82b00664d177882122e4e2751f555d93bf82ddea8fa9fee642679
MD5 2a2da140144be115f6356a70465b4b76
SHA1 971bd0b020dc78f0bfaea4afc1a4b48f06c15bcc
SHA512 3bb58815d0eee1845323875165a8901832dd27657328ef5c7e4b3567aa79da1b8f8f24deb2e4331666cf6b979fa4f3dc192674792c5b2842924db81c0835a2e6
SSDEEP 1536:AUFNuna263zXulTvEs9ZpQliUrxNzIP9Lj4Vc0UjkjC:ZFO63zXuRvEIpL9Gc/j8C
TLSH
T14E5301AB831871C422D643E2194FE2E7F5CA38F836D4B43EC617844DDE98365C7E5A42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.dat.0

Path C:\Drivers\drivers.dat.0
Size 75KB
SHA256 bdca9ac8d890b933ff9c9642519059e3735a7f895eba303d859ed551657ec59d
MD5 6db12d6ff5395170f2300021478298ca
SHA1 87bac4c8284398833d6c885d3ef662852b1ce383
SHA512 c88ed6ce4c1346d4c0733dbc691cdd16f06a5f94b6dbaab760f5d6b3ec663980f8322a5f8aa1e1b6c2d98be110a2257d76ab6403eaf4bf994bb336bf949dde4f
SSDEEP 1536:AUFNuna263zXulTvEs9ZpQliUrxNzIP9Lj4Vc0UjkjSuueahAdUPSq:ZFO63zXuRvEIpL9Gc/j8XaNSq
TLSH
T17973029B871CB6D821E757A2584FE2A9F1DA34F836C4743EDA1B401CAE9C365C7D0E42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BouquetZipping-8276.T4Is

Path C:\Drivers\easierviewed80\BouquetZipping-8276.T4Is
Size 10.3MB
SHA256 34260e1cf907112ceb2a280712cdf679470569bb3d95092818ecc456d708954d
MD5 5dd6a658e0f32a899cdbda6e087067ef
SHA1 80e44709959a5689fdc41ad079da1641a643eebf
SHA512 586c76710e21b7a534394b18e2f0e1e14b38eb76158c6970e944b4adbfbe2f38f143b3111e2dac5fe22bf4d1ad764dd51df27a63acdc80a37172c53cc3dca3ed
SSDEEP 196608:/UPV1KD3cYyU2OzElApy2E7gkmrhblALjWi6DoJTL2gETmzBOFSk1/SLgmY8XV/H:c98GUDYl6Lkm7ALit1mzBOFD1/sg1CND
TLSH
T1F4B633E35924E783E743DD169CE88F589B87F0684524B668D3BEA62C666F4C2FF05D00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WPS_Office_x64.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-GO66N.tmp\WPS_Office_x64.tmp
Size 1.1MB
SHA256 cf0018affdd0b7921f922f1741ad229ec52c8a7d6c2b19889a149e0cc24aa839
MD5 129b8e200a6e90e813080c9ce0474063
SHA1 b5352cdae50e5ddf3eb62f75f2e77042386b8841
SHA512 10949e7f0b6dd55e0a5d97e4531ef61427920cccc2136c0dd3607cdc79afa0d8a7178965a07039948da97f0200ead8fe5a54921620c943c7fc76dd5ef5a7c841
SSDEEP 24576:WEZXjiinrzY5tO+uKE3LMT0jECZQEbLBDBEnFWsyb7xyx:bdmbjTKlD00R
TLSH
T17C453A22A3D68433D5732E758D6BC2945C367E202FA4D48A7EF89E0C4E79B41BD35392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

77EC63BDA74BD0D0E0426DC8F8008506

Path C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506
Size 78KB
SHA256 778412b81d2d1b42a8394bd7920506224afb565e1159933f7366fed1fcc7891c
MD5 5c64b625cea69c9aaf959048a4af9804
SHA1 541d6eab558dfc00123a8b46de4499378850d33c
SHA512 97df48950e77152151459d3dc9591239b592bbe07d69c07abc03405b48bb50d4c80f2a931e741ca2c5cda090e74f490392fb71df0e2dc2188433d8eed40a5bdc
SSDEEP 1536:NOaPh/nzFYMgqy/492ESY4u4+UCk/SivFCY4Y+B3nkkqKI52UYNlgnE:8aVzBbGofSttxjSGYY+BhTTfgnE
TLSH
T1938302E948ED2FC1FFBBF0CA92689986275440D66818B0777C3D7804320A7475ABF5E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1004-1752-0x0000000001F10000-0x000000000213B000-memory.dmp

Download

memory/1300-852-0x0000000001C40000-0x0000000001E6B000-memory.dmp

Download

memory/2180-53-0x0000000001EF0000-0x000000000211B000-memory.dmp

Download

memory/2520-200-0x000001F34E150000-0x000001F34E239000-memory.dmp

Download

memory/2520-790-0x000001F34E240000-0x000001F34E32B000-memory.dmp

Download

memory/2520-206-0x000001F34E240000-0x000001F34E32B000-memory.dmp

Download

memory/2520-851-0x000001F34E240000-0x000001F34E32B000-memory.dmp

Download

memory/2520-307-0x000001F34E240000-0x000001F34E32B000-memory.dmp

Download

memory/2520-257-0x000001F34E240000-0x000001F34E32B000-memory.dmp

Download

memory/2520-399-0x000001F34E240000-0x000001F34E32B000-memory.dmp

Download

memory/2520-224-0x000001F34E240000-0x000001F34E32B000-memory.dmp

Download

memory/3480-1527-0x0000000001EC0000-0x00000000020EB000-memory.dmp

Download

memory/3516-1977-0x0000000001B30000-0x0000000001D5B000-memory.dmp

Download

memory/3616-1077-0x0000000001E80000-0x00000000020AB000-memory.dmp

Download

memory/3924-47-0x0000000000400000-0x000000000052C000-memory.dmp

Download

memory/3924-5-0x00000000022A0000-0x00000000022A1000-memory.dmp

Download

memory/4144-485-0x000001E688850000-0x000001E68BAC1000-memory.dmp

Download

memory/4144-328-0x000001E687640000-0x000001E688848000-memory.dmp

Download

memory/4144-330-0x000001E688850000-0x000001E68BAC1000-memory.dmp

Download

memory/4144-493-0x000001E688850000-0x000001E68BAC1000-memory.dmp

Download

memory/4144-484-0x000001E688850000-0x000001E68BAC1000-memory.dmp

Download

memory/4144-473-0x000001E688850000-0x000001E68BAC1000-memory.dmp

Download

memory/4144-737-0x000001E688850000-0x000001E68BAC1000-memory.dmp

Download

memory/4144-474-0x000001E688850000-0x000001E68BAC1000-memory.dmp

Download

memory/4144-472-0x000001E688850000-0x000001E68BAC1000-memory.dmp

Download

memory/4144-400-0x000001E688850000-0x000001E68BAC1000-memory.dmp

Download

memory/4144-406-0x000001E688850000-0x000001E68BAC1000-memory.dmp

Download

memory/4144-377-0x000001E688850000-0x000001E68BAC1000-memory.dmp

Download

memory/4144-401-0x000001E688850000-0x000001E68BAC1000-memory.dmp

Download

memory/4312-1302-0x0000000002160000-0x000000000238B000-memory.dmp

Download

memory/4872-0-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4872-48-0x0000000000400000-0x0000000000428000-memory.dmp

Download

memory/4880-518-0x0000000001E90000-0x00000000020BB000-memory.dmp

Download