Analysis

  • max time kernel
    150s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    11-09-2020 10:36

General

  • Target

    14c63d1c8979ac3e55720fbfedd7f1f7fb68bbf16a2ca2882284817cf01ccd8f.exe

  • Size

    14.6MB

  • MD5

    18067be70aad9ca5d329663e35ed5cde

  • SHA1

    8655fc0484f35513527268f7313334dc2c2d5953

  • SHA256

    14c63d1c8979ac3e55720fbfedd7f1f7fb68bbf16a2ca2882284817cf01ccd8f

  • SHA512

    8b071bbe15118e69873a600e2bdb15125f8c6ae1ab133b1951fbbf52b4dddd65734088dd51f84de716f9c2cbb22bcda40c83d129d8594fbb839a3975355277ed

Malware Config

Extracted

Family

metasploit

Version

windows/download_exec

C2

http://39.101.174.221:12358/LWbW

Attributes
  • headers User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; MALCJS)

Signatures

  • MetaSploit

    Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.

  • Registers COM server for autorun 1 TTPs
  • Drops file in Drivers directory 3 IoCs
  • Executes dropped EXE 35 IoCs
  • Loads dropped DLL 190 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Installs/modifies Browser Helper Object 2 TTPs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • JavaScript code in executable 21 IoCs
  • Drops file in System32 directory 32 IoCs
  • Modifies service 2 TTPs 849 IoCs
  • Drops file in Program Files directory 149 IoCs
  • Drops file in Windows directory 17 IoCs
  • NSIS installer 91 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
  • Modifies data under HKEY_USERS 199 IoCs
  • Modifies registry class 381 IoCs
  • Modifies system certificate store 2 TTPs 29 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 58 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 232 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\14c63d1c8979ac3e55720fbfedd7f1f7fb68bbf16a2ca2882284817cf01ccd8f.exe
    "C:\Users\Admin\AppData\Local\Temp\14c63d1c8979ac3e55720fbfedd7f1f7fb68bbf16a2ca2882284817cf01ccd8f.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1764
    • C:\Users\Admin\AppData\Local\Temp\TaskServer.exe
      TaskServer.exe
      2⤵
      • Executes dropped EXE
      PID:1920
    • C:\Users\Admin\AppData\Local\Temp\EasyConnectInstaller_.exe
      EasyConnectInstaller_.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Modifies service
      • Drops file in Program Files directory
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:1968
      • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\Uninstall.exe
        "C:\Program Files (x86)\Sangfor\SSL\ClientComponent\Uninstall.exe" -QUICKREPAIR -HIDE -NODELSESSION -SessionId=-1
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:864
      • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforCSClientInstaller.exe
        "C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforCSClientInstaller.exe" -SessionId=-1
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        PID:1980
      • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\TcpDriverInstaller.exe
        "C:\Program Files (x86)\Sangfor\SSL\ClientComponent\TcpDriverInstaller.exe" -SessionId=-1
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:1260
        • C:\Program Files (x86)\Sangfor\SSL\TcpDriver\Remove.exe
          "C:\Program Files (x86)\Sangfor\SSL\TcpDriver\Remove.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1904
        • C:\Program Files (x86)\Sangfor\SSL\TcpDriver\Install.exe
          "C:\Program Files (x86)\Sangfor\SSL\TcpDriver\Install.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:268
      • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\DnsDriverInstaller.exe
        "C:\Program Files (x86)\Sangfor\SSL\ClientComponent\DnsDriverInstaller.exe" -SessionId=-1
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:568
        • C:\Program Files (x86)\Sangfor\SSL\DnsDriver\Remove.exe
          "C:\Program Files (x86)\Sangfor\SSL\DnsDriver\Remove.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:800
        • C:\Program Files (x86)\Sangfor\SSL\DnsDriver\Install.exe
          "C:\Program Files (x86)\Sangfor\SSL\DnsDriver\Install.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:796
      • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SuperExeInstaller.exe
        "C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SuperExeInstaller.exe" -SessionId=-1
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        PID:1120
        • C:\Windows\SysWOW64\expand.exe
          "expand.exe" -r "C:\Program Files (x86)\Sangfor\SSL\Promote\SangforPromote.CAB" "C:\Program Files (x86)\Sangfor\SSL\Promote"
          4⤵
          • Drops file in Program Files directory
          • Drops file in Windows directory
          PID:1816
      • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforServiceClientInstaller.exe
        "C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforServiceClientInstaller.exe" -SessionId=-1
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        PID:900
        • C:\Windows\SysWOW64\expand.exe
          "expand.exe" -r "C:\Program Files (x86)\Sangfor\SSL\SangforServiceClient\SangforServiceClient.CAB" "C:\Program Files (x86)\Sangfor\SSL\SangforServiceClient"
          4⤵
          • Drops file in Program Files directory
          • Drops file in Windows directory
          PID:1944
      • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\VC2010RedistX86UInstaller.exe
        "C:\Program Files (x86)\Sangfor\SSL\ClientComponent\VC2010RedistX86UInstaller.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        PID:1824
      • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\HTPInstaller.exe
        "C:\Program Files (x86)\Sangfor\SSL\ClientComponent\HTPInstaller.exe" -SessionId=-1
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        PID:1992
      • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SJobberInstaller.exe
        "C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SJobberInstaller.exe" -SessionId=-1
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        PID:932
      • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforUpdateInstaller.exe
        "C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforUpdateInstaller.exe" -SessionId=-1
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        PID:360
      • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforRAppInstaller.exe
        "C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforRAppInstaller.exe" -SessionId=-1
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        PID:996
      • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\InstallControl.exe
        "C:\Program Files (x86)\Sangfor\SSL\ClientComponent\InstallControl.exe" -SessionId=-1
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Modifies registry class
        PID:604
      • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\VNICInstaller_X64.exe
        "C:\Program Files (x86)\Sangfor\SSL\ClientComponent\VNICInstaller_X64.exe" -SessionId=-1
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        PID:1016
        • C:\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\ndiscleanup.x64.exe
          "C:\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\ndiscleanup.x64.exe"
          4⤵
          • Executes dropped EXE
          PID:1200
        • C:\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\vacon.exe
          "C:\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\vacon.exe" install "C:\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\SangforCertificate.cer" "C:\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\SangforCertificate256.cer" "C:\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\SangforVNIC.inf" SangforVNIC
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Modifies service
          • Drops file in Windows directory
          • Modifies system certificate store
          • Suspicious use of AdjustPrivilegeToken
          PID:1136
        • C:\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\SetIPTime.exe
          "C:\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\SetIPTime.exe"
          4⤵
          • Executes dropped EXE
          PID:1380
          • C:\Windows\SysWOW64\netsh.exe
            netsh interface ip set interface 11 dadtransmits=0
            5⤵
            • Modifies service
            PID:1192
      • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\ComHelperX64.exe
        "C:\Program Files (x86)\Sangfor\SSL\ClientComponent\ComHelperX64.exe" reg ProxyIEX64.dll "C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforTcpX64.dll"
        3⤵
        • Executes dropped EXE
        • Modifies service
        • Modifies registry class
        PID:980
      • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\ComHelperX64.exe
        "C:\Program Files (x86)\Sangfor\SSL\ClientComponent\ComHelperX64.exe" reg SangforNspX64.dll "C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforNspX64.dll"
        3⤵
        • Executes dropped EXE
        • Modifies service
        • Modifies registry class
        PID:268
      • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\ECBaseInstaller.exe
        "C:\Program Files (x86)\Sangfor\SSL\ClientComponent\ECBaseInstaller.exe" -SessionId=-1
        3⤵
        • Executes dropped EXE
        PID:1256
      • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\ECAgentInstaller.exe
        "C:\Program Files (x86)\Sangfor\SSL\ClientComponent\ECAgentInstaller.exe" -SessionId=-1
        3⤵
        • Executes dropped EXE
        PID:1724
        • C:\Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe
          "C:\Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe" --restart
          4⤵
          • Executes dropped EXE
          PID:996
      • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SuperServiceInstaller.exe
        "C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SuperServiceInstaller.exe" -SessionId=-1
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        PID:1192
        • C:\Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe
          "C:\Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe" -/StopServer
          4⤵
          • Executes dropped EXE
          PID:1012
        • C:\Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe
          "C:\Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe" -/StartServer
          4⤵
          • Executes dropped EXE
          PID:1764
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{3ff9630f-0ed5-0990-3568-e74d850b0432}\sangforvnic.inf" "9" "693d7628f" "00000000000003CC" "WinSta0\Default" "0000000000000540" "208" "c:\program files (x86)\sangfor\ssl\csclient\vnic"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:1936
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Modifies service
    • Suspicious use of AdjustPrivilegeToken
    PID:1260
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot12" "" "" "6d110b0a3" "0000000000000000" "00000000000005C4" "00000000000005BC"
    1⤵
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:844
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "sangforvnic.inf:SangforVNIC.NTAMD64:SangforVNIC.ndi:5.9.0.0:sangforvnic" "693d7628f" "00000000000003CC" "00000000000005E0" "00000000000005B8"
    1⤵
    • Drops file in Drivers directory
    • Drops file in System32 directory
    • Modifies service
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    PID:1184
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding
    1⤵
      PID:1872
    • C:\Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe
      "C:\Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe"
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Modifies system certificate store
      PID:1256
      • C:\Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe
        "C:\Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe" --import-sys --enable-loopback
        2⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Modifies system certificate store
        PID:1856
      • C:\Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe
        "C:\Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe" --from-sp
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:1984
      • C:\Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe
        "C:\Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe" --import-nss --enable-ie-loopback
        2⤵
        • Executes dropped EXE
        PID:1924
      • C:\Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe
        "C:\Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe" --import-sys --enable-loopback
        2⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Modifies system certificate store
        PID:1792

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Browser Extensions

    1
    T1176

    Modify Existing Service

    1
    T1031

    Defense Evasion

    Modify Registry

    4
    T1112

    Install Root Certificate

    1
    T1130

    Credential Access

    Credentials in Files

    1
    T1081

    Discovery

    Query Registry

    1
    T1012

    Collection

    Data from Local System

    1
    T1005

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\PROGRA~2\Sangfor\SSL\CLIENT~1\ND_DKE~1.CAB
    • C:\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\SangforCertificate.cer
    • C:\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\SangforCertificate256.cer
    • C:\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\SangforVNIC.inf
    • C:\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\SetIPTime.exe
    • C:\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\SetIPTime.exe
    • C:\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\ndiscleanup.x64.exe
    • C:\Program Files (x86)\Sangfor\SSL\CSClient\VNIC\vacon.exe
    • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\ComHelperX64.exe
    • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\ComHelperX64.exe
    • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\DnsDriverInstaller.exe
    • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\DnsDriverInstaller.exe
    • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\ECAgentInstaller.exe
    • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\ECAgentInstaller.exe
    • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\ECBaseInstaller.exe
    • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\ECBaseInstaller.exe
    • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\HTPInstaller.exe
    • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\HTPInstaller.exe
    • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\InstallControl.exe
    • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\InstallControl.exe
    • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SJobberInstaller.exe
    • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SJobberInstaller.exe
    • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforCSClientInstaller.exe
    • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforCSClientInstaller.exe
    • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforCore.dll
    • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforNspX64.dll
    • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforRAppInstaller.exe
    • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforRAppInstaller.exe
    • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforServiceClientInstaller.exe
    • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforServiceClientInstaller.exe
    • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforTcp.dll
    • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforTcpX64.dll
    • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforUpdateInstaller.exe
    • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SangforUpdateInstaller.exe
    • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SuperExeInstaller.exe
    • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SuperExeInstaller.exe
    • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SuperServiceInstaller.exe
    • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\SuperServiceInstaller.exe
    • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\TcpDriverInstaller.exe
    • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\TcpDriverInstaller.exe
    • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\Uninstall.exe
    • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\Uninstall.exe
    • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\VC2010RedistX86UInstaller.exe
    • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\VC2010RedistX86UInstaller.exe
    • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\VNICInstaller_X64.exe
    • C:\Program Files (x86)\Sangfor\SSL\ClientComponent\VNICInstaller_X64.exe
    • C:\Program Files (x86)\Sangfor\SSL\DnsDriver\Install.exe
    • C:\Program Files (x86)\Sangfor\SSL\DnsDriver\Install.exe
    • C:\Program Files (x86)\Sangfor\SSL\DnsDriver\Remove.exe
    • C:\Program Files (x86)\Sangfor\SSL\DnsDriver\Remove.exe
    • C:\Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe
    • C:\Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe
    • C:\Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe
    • C:\Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe
    • C:\Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe
    • C:\Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe
    • C:\Program Files (x86)\Sangfor\SSL\ECAgent\ECBase.dll
    • C:\Program Files (x86)\Sangfor\SSL\ECAgent\SANGFORVPNLIBEAY32.dll
    • C:\Program Files (x86)\Sangfor\SSL\ECAgent\SANGFORVPNSSLEAY32.dll
    • C:\Program Files (x86)\Sangfor\SSL\Promote\MSVCP60.dll
    • C:\Program Files (x86)\Sangfor\SSL\Promote\SangforPromote.exe
    • C:\Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe
    • C:\Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe
    • C:\Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe
    • C:\Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe
    • C:\Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe
    • C:\Program Files (x86)\Sangfor\SSL\SangforServiceClient\SangforServiceClient.exe
    • C:\Program Files (x86)\Sangfor\SSL\TcpDriver\Install.exe
    • C:\Program Files (x86)\Sangfor\SSL\TcpDriver\Install.exe
    • C:\Program Files (x86)\Sangfor\SSL\TcpDriver\Remove.exe
    • C:\Program Files (x86)\Sangfor\SSL\TcpDriver\Remove.exe
    • C:\Users\Admin\AppData\Local\Temp\EasyConnectInstaller_.exe
    • C:\Users\Admin\AppData\Local\Temp\EasyConnectInstaller_.exe
    • C:\Users\Admin\AppData\Local\Temp\TaskServer.exe
    • C:\Users\Admin\AppData\Local\Temp\TaskServer.exe
    • C:\Users\Admin\AppData\Local\Temp\{3FF96~1\SangforVnic.sys
    • C:\Users\Admin\AppData\Local\Temp\{3ff9630f-0ed5-0990-3568-e74d850b0432}\SangforVnic.cat
    • C:\Users\Admin\AppData\Local\Temp\{3ff9630f-0ed5-0990-3568-e74d850b0432}\sangforvnic.inf
    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zalsryvg.Admin\cert8.db
    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zalsryvg.Admin\key3.db
    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zalsryvg.Admin\secmod.db
    • C:\Users\Admin\AppData\Roaming\Sangfor\SSL\Log\ECAgent_20200911.log
    • C:\Windows\INF\oem2.inf
    • C:\Windows\Logs\DPX\setupact.log
    • C:\Windows\SysWOW64\MSVCR100.dll
    • C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Sangfor\SSL\Log\ECAgent_20200911.log
    • C:\Windows\System32\DRIVER~1\FILERE~1\SANGFO~1.INF\SangforVnic.sys
    • C:\Windows\System32\DriverStore\FileRepository\sangforvnic.inf_amd64_neutral_9183b83f3b2f3cd1\SangforVnic.cat
    • C:\Windows\System32\DriverStore\FileRepository\sangforvnic.inf_amd64_neutral_9183b83f3b2f3cd1\sangforvnic.PNF
    • C:\Windows\System32\DriverStore\FileRepository\sangforvnic.inf_amd64_neutral_9183b83f3b2f3cd1\sangforvnic.inf
    • C:\Windows\System32\DriverStore\INFCACHE.1
    • \??\c:\PROGRA~2\sangfor\ssl\csclient\vnic\SANGFO~1.SYS
    • \??\c:\program files (x86)\sangfor\ssl\csclient\vnic\SangforVnic.cat
    • \??\c:\program files (x86)\sangfor\ssl\promote\sangforpromote.cab
    • \??\c:\program files (x86)\sangfor\ssl\sangforserviceclient\sangforserviceclient.cab
    • \Program Files (x86)\Sangfor\SSL\CSClient\VNIC\SetIPTime.exe
    • \Program Files (x86)\Sangfor\SSL\CSClient\VNIC\SetIPTime.exe
    • \Program Files (x86)\Sangfor\SSL\CSClient\VNIC\SetIPTime.exe
    • \Program Files (x86)\Sangfor\SSL\CSClient\VNIC\SetIPTime.exe
    • \Program Files (x86)\Sangfor\SSL\CSClient\VNIC\SetIPTime.exe
    • \Program Files (x86)\Sangfor\SSL\CSClient\VNIC\ndiscleanup.x64.exe
    • \Program Files (x86)\Sangfor\SSL\CSClient\VNIC\ndiscleanup.x64.exe
    • \Program Files (x86)\Sangfor\SSL\CSClient\VNIC\ndiscleanup.x64.exe
    • \Program Files (x86)\Sangfor\SSL\CSClient\VNIC\vacon.exe
    • \Program Files (x86)\Sangfor\SSL\CSClient\VNIC\vacon.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\CSClientManagerPrj.dll
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\ComHelperX64.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\ComHelperX64.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\DnsDriverInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\DnsDriverInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\DnsDriverInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\DnsDriverInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\ECAgentInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\ECAgentInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\ECAgentInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\ECAgentInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\ECBaseInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\ECBaseInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\ECBaseInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\ECBaseInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\HTPInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\HTPInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\HTPInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\HTPInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\InstallControl.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\InstallControl.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\InstallControl.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\InstallControl.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\Nddkey\FT_ND_API.dll
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\Nddkey\FT_ND_SC.dll
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\SJobberInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\SJobberInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\SJobberInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\SJobberInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\SSOClientPrj.dll
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\SangforBHO.dll
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\SangforCDC.dll
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\SangforCSClientInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\SangforCSClientInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\SangforCSClientInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\SangforCSClientInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\SangforCore.dll
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\SangforCore.dll
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\SangforL3Vpn.dll
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\SangforNsp.dll
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\SangforNspX64.dll
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\SangforNspX64.dll
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\SangforRAppInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\SangforRAppInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\SangforRAppInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\SangforRAppInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\SangforSddn.dll
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\SangforServiceClientInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\SangforServiceClientInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\SangforServiceClientInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\SangforServiceClientInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\SangforTcp.dll
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\SangforTcp.dll
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\SangforTcp.dll
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\SangforTcp.dll
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\SangforTcp.dll
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\SangforTcpX64.dll
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\SangforUpdateInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\SangforUpdateInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\SangforUpdateInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\SangforUpdateInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\SuperExeInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\SuperExeInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\SuperExeInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\SuperExeInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\SuperServiceInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\SuperServiceInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\SuperServiceInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\SuperServiceInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\TcpDriverInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\TcpDriverInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\TcpDriverInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\TcpDriverInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\Uninstall.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\Uninstall.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\Uninstall.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\UrlWarrent.dll
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\VC2010RedistX86UInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\VC2010RedistX86UInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\VC2010RedistX86UInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\VC2010RedistX86UInstaller.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\VNICInstaller_X64.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\VNICInstaller_X64.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\VNICInstaller_X64.exe
    • \Program Files (x86)\Sangfor\SSL\ClientComponent\VNICInstaller_X64.exe
    • \Program Files (x86)\Sangfor\SSL\DnsDriver\Install.exe
    • \Program Files (x86)\Sangfor\SSL\DnsDriver\Install.exe
    • \Program Files (x86)\Sangfor\SSL\DnsDriver\Install.exe
    • \Program Files (x86)\Sangfor\SSL\DnsDriver\Install.exe
    • \Program Files (x86)\Sangfor\SSL\DnsDriver\Remove.exe
    • \Program Files (x86)\Sangfor\SSL\DnsDriver\Remove.exe
    • \Program Files (x86)\Sangfor\SSL\DnsDriver\Remove.exe
    • \Program Files (x86)\Sangfor\SSL\DnsDriver\Remove.exe
    • \Program Files (x86)\Sangfor\SSL\DnsDriver\Remove.exe
    • \Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe
    • \Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe
    • \Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe
    • \Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe
    • \Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe
    • \Program Files (x86)\Sangfor\SSL\ECAgent\ECAgent.exe
    • \Program Files (x86)\Sangfor\SSL\ECAgent\ECBase.dll
    • \Program Files (x86)\Sangfor\SSL\ECAgent\ECBase.dll
    • \Program Files (x86)\Sangfor\SSL\ECAgent\ECBase.dll
    • \Program Files (x86)\Sangfor\SSL\ECAgent\ECBase.dll
    • \Program Files (x86)\Sangfor\SSL\ECAgent\ECBase.dll
    • \Program Files (x86)\Sangfor\SSL\ECAgent\SangforVpnLibeay32.dll
    • \Program Files (x86)\Sangfor\SSL\ECAgent\SangforVpnLibeay32.dll
    • \Program Files (x86)\Sangfor\SSL\ECAgent\SangforVpnLibeay32.dll
    • \Program Files (x86)\Sangfor\SSL\ECAgent\SangforVpnLibeay32.dll
    • \Program Files (x86)\Sangfor\SSL\ECAgent\SangforVpnLibeay32.dll
    • \Program Files (x86)\Sangfor\SSL\ECAgent\SangforVpnSsleay32.dll
    • \Program Files (x86)\Sangfor\SSL\ECAgent\SangforVpnSsleay32.dll
    • \Program Files (x86)\Sangfor\SSL\ECAgent\SangforVpnSsleay32.dll
    • \Program Files (x86)\Sangfor\SSL\ECAgent\SangforVpnSsleay32.dll
    • \Program Files (x86)\Sangfor\SSL\ECAgent\SangforVpnSsleay32.dll
    • \Program Files (x86)\Sangfor\SSL\Promote\SangforPromote.exe
    • \Program Files (x86)\Sangfor\SSL\Promote\SangforPromote.exe
    • \Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe
    • \Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe
    • \Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe
    • \Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe
    • \Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe
    • \Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe
    • \Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe
    • \Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe
    • \Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe
    • \Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe
    • \Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe
    • \Program Files (x86)\Sangfor\SSL\Promote\SangforPromoteService.exe
    • \Program Files (x86)\Sangfor\SSL\Promote\msvcp60.dll
    • \Program Files (x86)\Sangfor\SSL\Promote\msvcp60.dll
    • \Program Files (x86)\Sangfor\SSL\RemoteAppClient\SfRemoteAppClient.exe
    • \Program Files (x86)\Sangfor\SSL\RemoteAppClient\SfRemoteAppClient.exe
    • \Program Files (x86)\Sangfor\SSL\SangforCSClient\SangforCSClient.exe
    • \Program Files (x86)\Sangfor\SSL\SangforCSClient\SangforCSClient.exe
    • \Program Files (x86)\Sangfor\SSL\SangforCSClient\SangforCSClient.exe
    • \Program Files (x86)\Sangfor\SSL\SangforCSClient\SangforCSClient.exe
    • \Program Files (x86)\Sangfor\SSL\SangforCSClient\SangforCSClientUninstaller.exe
    • \Program Files (x86)\Sangfor\SSL\SangforServiceClient\SangforServiceClient.exe
    • \Program Files (x86)\Sangfor\SSL\SangforServiceClient\SangforServiceClient.exe
    • \Program Files (x86)\Sangfor\SSL\SangforUpdate\SangforUD.exe
    • \Program Files (x86)\Sangfor\SSL\SangforUpdate\SangforUD.exe
    • \Program Files (x86)\Sangfor\SSL\SvpnJobber\SvpnJobber.exe
    • \Program Files (x86)\Sangfor\SSL\SvpnJobber\SvpnJobber.exe
    • \Program Files (x86)\Sangfor\SSL\TcpDriver\Install.exe
    • \Program Files (x86)\Sangfor\SSL\TcpDriver\Install.exe
    • \Program Files (x86)\Sangfor\SSL\TcpDriver\Install.exe
    • \Program Files (x86)\Sangfor\SSL\TcpDriver\Install.exe
    • \Program Files (x86)\Sangfor\SSL\TcpDriver\Remove.exe
    • \Program Files (x86)\Sangfor\SSL\TcpDriver\Remove.exe
    • \Program Files (x86)\Sangfor\SSL\TcpDriver\Remove.exe
    • \Program Files (x86)\Sangfor\SSL\TcpDriver\Remove.exe
    • \Program Files (x86)\Sangfor\SSL\TcpDriver\Remove.exe
    • \Users\Admin\AppData\Local\Temp\EasyConnectInstaller_.exe
    • \Users\Admin\AppData\Local\Temp\EasyConnectInstaller_.exe
    • \Users\Admin\AppData\Local\Temp\EasyConnectInstaller_.exe
    • \Users\Admin\AppData\Local\Temp\EasyConnectInstaller_.exe
    • \Users\Admin\AppData\Local\Temp\TaskServer.exe
    • \Users\Admin\AppData\Local\Temp\nsd93D9.tmp\System.dll
    • \Users\Admin\AppData\Local\Temp\nsd93D9.tmp\System.dll
    • \Users\Admin\AppData\Local\Temp\nsi957E.tmp\System.dll
    • \Users\Admin\AppData\Local\Temp\nsi988A.tmp\nsExec.dll
    • \Users\Admin\AppData\Local\Temp\nss8EBA.tmp\KillProcDLL.dll
    • \Users\Admin\AppData\Local\Temp\nss8EBA.tmp\System.dll
    • \Users\Admin\AppData\Local\Temp\nss96F4.tmp\nsExec.dll
    • \Users\Admin\AppData\Local\Temp\nsx620F.tmp\SkinBtn.dll
    • \Users\Admin\AppData\Local\Temp\nsx620F.tmp\SkinProgress.dll
    • \Users\Admin\AppData\Local\Temp\nsx620F.tmp\System.dll
    • \Users\Admin\AppData\Local\Temp\nsx620F.tmp\dbdStaticCtrl.dll
    • \Users\Admin\AppData\Local\Temp\nsxA9F7.tmp\System.dll
    • \Users\Admin\AppData\Local\Temp\nsxA9F7.tmp\System.dll
    • \Users\Admin\AppData\Local\Temp\nsxA9F7.tmp\nsExec.dll
    • \Users\Admin\AppData\Local\Temp\nsxA9F7.tmp\nsExec.dll
    • \Users\Admin\AppData\Local\Temp\nsxA9F7.tmp\nsExec.dll
    • \Windows\SysWOW64\SangforInstallHelper.dll
    • \Windows\SysWOW64\msvcr100.dll
    • \Windows\SysWOW64\msvcr100.dll
    • \Windows\SysWOW64\msvcr100.dll
    • \Windows\SysWOW64\msvcr100.dll
    • \Windows\SysWOW64\msvcr100.dll
    • memory/268-226-0x0000000000000000-mapping.dmp
    • memory/268-67-0x0000000000000000-mapping.dmp
    • memory/360-147-0x0000000000000000-mapping.dmp
    • memory/564-17-0x000007FEF6720000-0x000007FEF699A000-memory.dmp
      Filesize

      2.5MB

    • memory/568-74-0x0000000000000000-mapping.dmp
    • memory/604-165-0x0000000000000000-mapping.dmp
    • memory/796-90-0x0000000000000000-mapping.dmp
    • memory/800-82-0x0000000000000000-mapping.dmp
    • memory/864-19-0x0000000000000000-mapping.dmp
    • memory/900-110-0x0000000000000000-mapping.dmp
    • memory/932-138-0x0000000000000000-mapping.dmp
    • memory/980-221-0x0000000000000000-mapping.dmp
    • memory/996-250-0x0000000000000000-mapping.dmp
    • memory/996-156-0x0000000000000000-mapping.dmp
    • memory/1012-272-0x0000000000000000-mapping.dmp
    • memory/1016-175-0x0000000000000000-mapping.dmp
    • memory/1120-97-0x0000000000000000-mapping.dmp
    • memory/1136-191-0x0000000000000000-mapping.dmp
    • memory/1184-208-0x0000000000F70000-0x0000000000F72000-memory.dmp
      Filesize

      8KB

    • memory/1184-209-0x0000000000F70000-0x0000000000F72000-memory.dmp
      Filesize

      8KB

    • memory/1192-219-0x0000000000000000-mapping.dmp
    • memory/1192-264-0x0000000000000000-mapping.dmp
    • memory/1200-184-0x0000000000000000-mapping.dmp
    • memory/1256-231-0x0000000000000000-mapping.dmp
    • memory/1260-50-0x0000000000000000-mapping.dmp
    • memory/1380-213-0x0000000000000000-mapping.dmp
    • memory/1724-241-0x0000000000000000-mapping.dmp
    • memory/1764-280-0x0000000000000000-mapping.dmp
    • memory/1792-693-0x0000000000000000-mapping.dmp
    • memory/1792-705-0x0000000000E60000-0x0000000000E64000-memory.dmp
      Filesize

      16KB

    • memory/1816-104-0x0000000000000000-mapping.dmp
    • memory/1824-124-0x0000000000000000-mapping.dmp
    • memory/1856-296-0x0000000000000000-mapping.dmp
    • memory/1856-307-0x0000000000E90000-0x0000000000E94000-memory.dmp
      Filesize

      16KB

    • memory/1904-58-0x0000000000000000-mapping.dmp
    • memory/1920-1-0x0000000000000000-mapping.dmp
    • memory/1920-8-0x0000000000584000-0x0000000000589000-memory.dmp
      Filesize

      20KB

    • memory/1924-691-0x0000000000000000-mapping.dmp
    • memory/1944-117-0x0000000000000000-mapping.dmp
    • memory/1968-5-0x0000000000000000-mapping.dmp
    • memory/1968-32-0x00000000054F0000-0x0000000005502000-memory.dmp
      Filesize

      72KB

    • memory/1980-36-0x0000000000000000-mapping.dmp
    • memory/1984-313-0x0000000003370000-0x0000000003381000-memory.dmp
      Filesize

      68KB

    • memory/1984-312-0x0000000002F60000-0x0000000002F71000-memory.dmp
      Filesize

      68KB

    • memory/1984-337-0x0000000002F60000-0x0000000002F71000-memory.dmp
      Filesize

      68KB

    • memory/1984-314-0x0000000002F60000-0x0000000002F71000-memory.dmp
      Filesize

      68KB

    • memory/1984-317-0x0000000002F60000-0x0000000002F71000-memory.dmp
      Filesize

      68KB

    • memory/1984-301-0x0000000000000000-mapping.dmp
    • memory/1984-339-0x0000000002F60000-0x0000000002F71000-memory.dmp
      Filesize

      68KB

    • memory/1984-338-0x0000000003370000-0x0000000003381000-memory.dmp
      Filesize

      68KB

    • memory/1992-131-0x0000000000000000-mapping.dmp