Analysis

  • max time kernel
    151s
  • max time network
    150s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    15-01-2022 12:52

General

  • Target

    7b1e00c9b305c4355432682a1d67a2bc1fc35bd4dccf53419d01a7986d8053e7.exe

  • Size

    314KB

  • MD5

    6003b916c04767dd36f8b0afb390e515

  • SHA1

    d8ba54cfd3f1a16a44a9f2ab9432e561071d2ecd

  • SHA256

    7b1e00c9b305c4355432682a1d67a2bc1fc35bd4dccf53419d01a7986d8053e7

  • SHA512

    a9d71fda74d9424e4673fbb6a9cc03a1fe4e04fb343d440df674250b31887f4b8dc4b0ea9b9b10ff5fe909564e5634a28948c0f4ac081fc96b210e985846bfc7

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

http://srtuiyhuali.at/

http://fufuiloirtu.com/

http://amogohuigotuli.at/

http://novohudosovu.com/

http://brutuilionust.com/

http://bubushkalioua.com/

http://dumuilistrati.at/

http://verboliatsiaeeees.com/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

arkei

Botnet

Default

C2

http://file-file-host4.com/tratata.php

Extracted

Family

tofsee

C2

patmushta.info

parubey.info

Extracted

Family

vidar

Version

49.6

Botnet

1120

C2

https://noc.social/@banda5ker

https://mastodon.social/@banda6ker

Attributes
  • profile_id

    1120

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Windows security bypass 2 TTPs
  • suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

    suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

  • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern

    suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Arkei Stealer Payload 1 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Vidar Stealer 1 IoCs
  • XMRig Miner Payload 3 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 15 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Drops file in Windows directory 3 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 12 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7b1e00c9b305c4355432682a1d67a2bc1fc35bd4dccf53419d01a7986d8053e7.exe
    "C:\Users\Admin\AppData\Local\Temp\7b1e00c9b305c4355432682a1d67a2bc1fc35bd4dccf53419d01a7986d8053e7.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2144
    • C:\Users\Admin\AppData\Local\Temp\7b1e00c9b305c4355432682a1d67a2bc1fc35bd4dccf53419d01a7986d8053e7.exe
      "C:\Users\Admin\AppData\Local\Temp\7b1e00c9b305c4355432682a1d67a2bc1fc35bd4dccf53419d01a7986d8053e7.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:2736
  • C:\Users\Admin\AppData\Local\Temp\F9F1.exe
    C:\Users\Admin\AppData\Local\Temp\F9F1.exe
    1⤵
    • Executes dropped EXE
    • Checks SCSI registry key(s)
    • Suspicious behavior: MapViewOfSection
    PID:3384
  • C:\Users\Admin\AppData\Local\Temp\FDCA.exe
    C:\Users\Admin\AppData\Local\Temp\FDCA.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1812
    • C:\Users\Admin\AppData\Local\Temp\FDCA.exe
      C:\Users\Admin\AppData\Local\Temp\FDCA.exe
      2⤵
      • Executes dropped EXE
      PID:3120
  • C:\Users\Admin\AppData\Local\Temp\415.exe
    C:\Users\Admin\AppData\Local\Temp\415.exe
    1⤵
    • Executes dropped EXE
    PID:500
  • C:\Users\Admin\AppData\Local\Temp\85C.exe
    C:\Users\Admin\AppData\Local\Temp\85C.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:2812
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\fcmvectb\
      2⤵
        PID:1084
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\zbjiyysp.exe" C:\Windows\SysWOW64\fcmvectb\
        2⤵
          PID:684
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create fcmvectb binPath= "C:\Windows\SysWOW64\fcmvectb\zbjiyysp.exe /d\"C:\Users\Admin\AppData\Local\Temp\85C.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:3380
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description fcmvectb "wifi internet conection"
            2⤵
              PID:4052
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start fcmvectb
              2⤵
                PID:1288
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:1640
              • C:\Users\Admin\AppData\Local\Temp\A7F.exe
                C:\Users\Admin\AppData\Local\Temp\A7F.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:568
                • C:\Users\Admin\AppData\Local\Temp\A7F.exe
                  C:\Users\Admin\AppData\Local\Temp\A7F.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:652
                  • C:\Users\Admin\AppData\Local\Temp\satan.exe
                    "C:\Users\Admin\AppData\Local\Temp\satan.exe"
                    3⤵
                    • Executes dropped EXE
                    • Checks computer location settings
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2184
                    • C:\Users\Admin\AppData\Local\Temp\srvs.exe
                      "C:\Users\Admin\AppData\Local\Temp\srvs.exe"
                      4⤵
                      • Executes dropped EXE
                      • Checks BIOS information in registry
                      • Loads dropped DLL
                      • Checks whether UAC is enabled
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      PID:2780
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 2780 -s 1684
                        5⤵
                        • Program crash
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4164
              • C:\Windows\SysWOW64\fcmvectb\zbjiyysp.exe
                C:\Windows\SysWOW64\fcmvectb\zbjiyysp.exe /d"C:\Users\Admin\AppData\Local\Temp\85C.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:2348
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  • Suspicious use of WriteProcessMemory
                  PID:2380
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:664
              • C:\Windows\SysWOW64\explorer.exe
                C:\Windows\SysWOW64\explorer.exe
                1⤵
                • Accesses Microsoft Outlook profiles
                • outlook_office_path
                • outlook_win_path
                PID:396
              • C:\Windows\explorer.exe
                C:\Windows\explorer.exe
                1⤵
                  PID:2716
                • C:\Users\Admin\AppData\Local\Temp\72EF.exe
                  C:\Users\Admin\AppData\Local\Temp\72EF.exe
                  1⤵
                  • Executes dropped EXE
                  PID:372
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 372 -s 820
                    2⤵
                    • Suspicious use of NtCreateProcessExOtherParentProcess
                    • Program crash
                    PID:4612
                • C:\Users\Admin\AppData\Local\Temp\765B.exe
                  C:\Users\Admin\AppData\Local\Temp\765B.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                  PID:1228
                • C:\Users\Admin\AppData\Local\Temp\8187.exe
                  C:\Users\Admin\AppData\Local\Temp\8187.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2968
                • C:\Users\Admin\AppData\Local\Temp\9484.exe
                  C:\Users\Admin\AppData\Local\Temp\9484.exe
                  1⤵
                  • Executes dropped EXE
                  PID:2804
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 2804 -s 404
                    2⤵
                    • Program crash
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1268
                • C:\Users\Admin\AppData\Local\Temp\9D7D.exe
                  C:\Users\Admin\AppData\Local\Temp\9D7D.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2996
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    2⤵
                      PID:4892
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                      2⤵
                        PID:4900
                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                      1⤵
                      • Drops file in Windows directory
                      • Modifies Internet Explorer settings
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of SetWindowsHookEx
                      PID:3640
                    • C:\Windows\system32\browser_broker.exe
                      C:\Windows\system32\browser_broker.exe -Embedding
                      1⤵
                      • Modifies Internet Explorer settings
                      PID:4048
                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                      1⤵
                      • Suspicious behavior: MapViewOfSection
                      • Suspicious use of SetWindowsHookEx
                      PID:4208
                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                      1⤵
                      • Drops file in Windows directory
                      • Modifies Internet Explorer settings
                      • Modifies registry class
                      PID:4320
                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                      1⤵
                      • Modifies registry class
                      PID:4796
                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                      1⤵
                      • Modifies registry class
                      PID:5068
                    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                      1⤵
                      • Modifies registry class
                      PID:2344

                    Network

                    MITRE ATT&CK Enterprise v6

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\A7F.exe.log

                      MD5

                      41fbed686f5700fc29aaccf83e8ba7fd

                      SHA1

                      5271bc29538f11e42a3b600c8dc727186e912456

                      SHA256

                      df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437

                      SHA512

                      234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034

                    • C:\Users\Admin\AppData\Local\Temp\415.exe

                      MD5

                      88e8761eea7b1418f62f7d63a2bc3e5a

                      SHA1

                      4cb0ec77e2228e76da347479a5cae2885a436c0c

                      SHA256

                      6ddb0bfa1addfb2017913f0e0b70fa19c3714046117859df6a7319c606154506

                      SHA512

                      53f242d543bb2dac63ca15be51650614f20a727a92eef49f7624041d43439e0c50dc87f25a3675a282aed246f60d6279fc5ee84c658676de3b6bbebd7d0bffa4

                    • C:\Users\Admin\AppData\Local\Temp\415.exe

                      MD5

                      88e8761eea7b1418f62f7d63a2bc3e5a

                      SHA1

                      4cb0ec77e2228e76da347479a5cae2885a436c0c

                      SHA256

                      6ddb0bfa1addfb2017913f0e0b70fa19c3714046117859df6a7319c606154506

                      SHA512

                      53f242d543bb2dac63ca15be51650614f20a727a92eef49f7624041d43439e0c50dc87f25a3675a282aed246f60d6279fc5ee84c658676de3b6bbebd7d0bffa4

                    • C:\Users\Admin\AppData\Local\Temp\72EF.exe

                      MD5

                      852d86f5bc34bf4af7fa89c60569df13

                      SHA1

                      c961ccd088a7d928613b6df900814789694be0ae

                      SHA256

                      2eaa2a4d6c975c73dcbf251ea9343c4e76bdee4c5dda8d4c7074078be4d7fc6f

                      SHA512

                      b66b83d619a242561b2a7a7364428a554bb72ccc64c3ac3f28fc7c73efe95c7f9f3ac0401116ae6f7b41b960c323cc3b7adac782450013129d9dec49a81dcec7

                    • C:\Users\Admin\AppData\Local\Temp\72EF.exe

                      MD5

                      852d86f5bc34bf4af7fa89c60569df13

                      SHA1

                      c961ccd088a7d928613b6df900814789694be0ae

                      SHA256

                      2eaa2a4d6c975c73dcbf251ea9343c4e76bdee4c5dda8d4c7074078be4d7fc6f

                      SHA512

                      b66b83d619a242561b2a7a7364428a554bb72ccc64c3ac3f28fc7c73efe95c7f9f3ac0401116ae6f7b41b960c323cc3b7adac782450013129d9dec49a81dcec7

                    • C:\Users\Admin\AppData\Local\Temp\765B.exe

                      MD5

                      6adb5470086099b9169109333fadab86

                      SHA1

                      87eb7a01e9e54e0a308f8d5edfd3af6eba4dc619

                      SHA256

                      b4298f77e454bd5f0bd58913f95ce2d2af8653f3253e22d944b20758bbc944b4

                      SHA512

                      d050466be53c33daaf1e30cd50d7205f50c1aca7ba13160b565cf79e1466a85f307fe1ec05dd09f59407fcb74e3375e8ee706acda6906e52de6f2dd5fa3eddcd

                    • C:\Users\Admin\AppData\Local\Temp\765B.exe

                      MD5

                      6adb5470086099b9169109333fadab86

                      SHA1

                      87eb7a01e9e54e0a308f8d5edfd3af6eba4dc619

                      SHA256

                      b4298f77e454bd5f0bd58913f95ce2d2af8653f3253e22d944b20758bbc944b4

                      SHA512

                      d050466be53c33daaf1e30cd50d7205f50c1aca7ba13160b565cf79e1466a85f307fe1ec05dd09f59407fcb74e3375e8ee706acda6906e52de6f2dd5fa3eddcd

                    • C:\Users\Admin\AppData\Local\Temp\8187.exe

                      MD5

                      ae2e11b9e499987335f2e8dafcd26a36

                      SHA1

                      2d27b63dd8555ddffa326358148f3009b9c7365c

                      SHA256

                      4a50a008bd91dd04838da2ea59906538e55968105cec29a08792164edac4ed53

                      SHA512

                      ab183c612535cb1ec9818b245a15c1c873a585009ec73574605307b1e5ad5f4e9444ebe83695cc5a6e911a0fd2029148bd8475d043ccd450556a807847787f98

                    • C:\Users\Admin\AppData\Local\Temp\8187.exe

                      MD5

                      ae2e11b9e499987335f2e8dafcd26a36

                      SHA1

                      2d27b63dd8555ddffa326358148f3009b9c7365c

                      SHA256

                      4a50a008bd91dd04838da2ea59906538e55968105cec29a08792164edac4ed53

                      SHA512

                      ab183c612535cb1ec9818b245a15c1c873a585009ec73574605307b1e5ad5f4e9444ebe83695cc5a6e911a0fd2029148bd8475d043ccd450556a807847787f98

                    • C:\Users\Admin\AppData\Local\Temp\85C.exe

                      MD5

                      46a70d5d3e3c0c8ad531b1e0bd9f3dba

                      SHA1

                      f611ca2934d6b515517351101c50a1827b8f1f35

                      SHA256

                      f9381b13e08fd00f463366bcd93a8f544c9a186f12e8955694a2c6bc07f1e834

                      SHA512

                      ed3263658e18b801a89a3de77d012b21c9ce41cc4c5ccdf0723a9effe924a0da3725b936975fd61800ae7b38a468c80cd09c12b398fccf982077c5888a4616f6

                    • C:\Users\Admin\AppData\Local\Temp\85C.exe

                      MD5

                      46a70d5d3e3c0c8ad531b1e0bd9f3dba

                      SHA1

                      f611ca2934d6b515517351101c50a1827b8f1f35

                      SHA256

                      f9381b13e08fd00f463366bcd93a8f544c9a186f12e8955694a2c6bc07f1e834

                      SHA512

                      ed3263658e18b801a89a3de77d012b21c9ce41cc4c5ccdf0723a9effe924a0da3725b936975fd61800ae7b38a468c80cd09c12b398fccf982077c5888a4616f6

                    • C:\Users\Admin\AppData\Local\Temp\9484.exe

                      MD5

                      ea6647efccb50905310bcbc1c190a1d9

                      SHA1

                      7e0b65351bcff3a319a4d41ff9920b8b46dcd8c3

                      SHA256

                      9e1812937239361273db5165a8d2d61a80da1faf78b40392fe6d8006067481fd

                      SHA512

                      2a8a32079cd4b14c505b0af1c39457fe6fc1db56114ee6c2142eed69476a07aadd909dcef3c3458671434ab33d0cfce0cf95d8b534f04e10342e40451a5cae47

                    • C:\Users\Admin\AppData\Local\Temp\9484.exe

                      MD5

                      ea6647efccb50905310bcbc1c190a1d9

                      SHA1

                      7e0b65351bcff3a319a4d41ff9920b8b46dcd8c3

                      SHA256

                      9e1812937239361273db5165a8d2d61a80da1faf78b40392fe6d8006067481fd

                      SHA512

                      2a8a32079cd4b14c505b0af1c39457fe6fc1db56114ee6c2142eed69476a07aadd909dcef3c3458671434ab33d0cfce0cf95d8b534f04e10342e40451a5cae47

                    • C:\Users\Admin\AppData\Local\Temp\9D7D.exe

                      MD5

                      4837a9287985204a45642c28ccb89f9d

                      SHA1

                      4d84fd2cc1d7b06344015666b103b8d59d577777

                      SHA256

                      6276e981f19c76c6c6af4c96afb2e4a911186db61c9bcd0ec5a09607cdaf7031

                      SHA512

                      63f24d7feff62b09b2155fcfdf1e3e16edbb96dbed021400ee212948f049017825d6e157a72170a0054a5e1ab979baf5a4266daaf6b143c63956682bf7bc73d5

                    • C:\Users\Admin\AppData\Local\Temp\9D7D.exe

                      MD5

                      4837a9287985204a45642c28ccb89f9d

                      SHA1

                      4d84fd2cc1d7b06344015666b103b8d59d577777

                      SHA256

                      6276e981f19c76c6c6af4c96afb2e4a911186db61c9bcd0ec5a09607cdaf7031

                      SHA512

                      63f24d7feff62b09b2155fcfdf1e3e16edbb96dbed021400ee212948f049017825d6e157a72170a0054a5e1ab979baf5a4266daaf6b143c63956682bf7bc73d5

                    • C:\Users\Admin\AppData\Local\Temp\A7F.exe

                      MD5

                      29e5d8cbcf13639096bf1353b5f9f48b

                      SHA1

                      800629d06593b7fb232a2dfd08384c4349f37382

                      SHA256

                      ba587b88b891dfe4c810be48e336cdae9d474618d9d0a3a0637cd2349cc307e2

                      SHA512

                      3e394d30c9d50b2ab61b6d9f2942313ec6cee2a4fd873d977bcfe6e62ce05596b62d0993294311da381eb47ad040a41307b192761501a47c8995624288aa5354

                    • C:\Users\Admin\AppData\Local\Temp\A7F.exe

                      MD5

                      29e5d8cbcf13639096bf1353b5f9f48b

                      SHA1

                      800629d06593b7fb232a2dfd08384c4349f37382

                      SHA256

                      ba587b88b891dfe4c810be48e336cdae9d474618d9d0a3a0637cd2349cc307e2

                      SHA512

                      3e394d30c9d50b2ab61b6d9f2942313ec6cee2a4fd873d977bcfe6e62ce05596b62d0993294311da381eb47ad040a41307b192761501a47c8995624288aa5354

                    • C:\Users\Admin\AppData\Local\Temp\A7F.exe

                      MD5

                      29e5d8cbcf13639096bf1353b5f9f48b

                      SHA1

                      800629d06593b7fb232a2dfd08384c4349f37382

                      SHA256

                      ba587b88b891dfe4c810be48e336cdae9d474618d9d0a3a0637cd2349cc307e2

                      SHA512

                      3e394d30c9d50b2ab61b6d9f2942313ec6cee2a4fd873d977bcfe6e62ce05596b62d0993294311da381eb47ad040a41307b192761501a47c8995624288aa5354

                    • C:\Users\Admin\AppData\Local\Temp\F9F1.exe

                      MD5

                      277680bd3182eb0940bc356ff4712bef

                      SHA1

                      5995ae9d0247036cc6d3ea741e7504c913f1fb76

                      SHA256

                      f9f0aaf36f064cdfc25a12663ffa348eb6d923a153f08c7ca9052dcb184b3570

                      SHA512

                      0b777d45c50eae00ad050d3b2a78fa60eb78fe837696a6562007ed628719784655ba13edcbbee953f7eefade49599ee6d3d23e1c585114d7aecddda9ad1d0ecb

                    • C:\Users\Admin\AppData\Local\Temp\F9F1.exe

                      MD5

                      277680bd3182eb0940bc356ff4712bef

                      SHA1

                      5995ae9d0247036cc6d3ea741e7504c913f1fb76

                      SHA256

                      f9f0aaf36f064cdfc25a12663ffa348eb6d923a153f08c7ca9052dcb184b3570

                      SHA512

                      0b777d45c50eae00ad050d3b2a78fa60eb78fe837696a6562007ed628719784655ba13edcbbee953f7eefade49599ee6d3d23e1c585114d7aecddda9ad1d0ecb

                    • C:\Users\Admin\AppData\Local\Temp\FDCA.exe

                      MD5

                      6003b916c04767dd36f8b0afb390e515

                      SHA1

                      d8ba54cfd3f1a16a44a9f2ab9432e561071d2ecd

                      SHA256

                      7b1e00c9b305c4355432682a1d67a2bc1fc35bd4dccf53419d01a7986d8053e7

                      SHA512

                      a9d71fda74d9424e4673fbb6a9cc03a1fe4e04fb343d440df674250b31887f4b8dc4b0ea9b9b10ff5fe909564e5634a28948c0f4ac081fc96b210e985846bfc7

                    • C:\Users\Admin\AppData\Local\Temp\FDCA.exe

                      MD5

                      6003b916c04767dd36f8b0afb390e515

                      SHA1

                      d8ba54cfd3f1a16a44a9f2ab9432e561071d2ecd

                      SHA256

                      7b1e00c9b305c4355432682a1d67a2bc1fc35bd4dccf53419d01a7986d8053e7

                      SHA512

                      a9d71fda74d9424e4673fbb6a9cc03a1fe4e04fb343d440df674250b31887f4b8dc4b0ea9b9b10ff5fe909564e5634a28948c0f4ac081fc96b210e985846bfc7

                    • C:\Users\Admin\AppData\Local\Temp\FDCA.exe

                      MD5

                      6003b916c04767dd36f8b0afb390e515

                      SHA1

                      d8ba54cfd3f1a16a44a9f2ab9432e561071d2ecd

                      SHA256

                      7b1e00c9b305c4355432682a1d67a2bc1fc35bd4dccf53419d01a7986d8053e7

                      SHA512

                      a9d71fda74d9424e4673fbb6a9cc03a1fe4e04fb343d440df674250b31887f4b8dc4b0ea9b9b10ff5fe909564e5634a28948c0f4ac081fc96b210e985846bfc7

                    • C:\Users\Admin\AppData\Local\Temp\satan.exe

                      MD5

                      c813de3f7afd4413d03d02186ec35c96

                      SHA1

                      bbfcfc985f99e6f630acafc07ec4807a6268d399

                      SHA256

                      6dc4a0f405256dc832e7cf7c0046acfa7180636be8bd115756013d7c7cbd37b5

                      SHA512

                      d0bf9679e2b9c713f3196ef7a578e3ea093a56cb54cd3904e7bba4d014753cd57d2a5ca0ce0a37222a3dd0fbbd87b95180198fb38b7cfd28f8976290585eb26e

                    • C:\Users\Admin\AppData\Local\Temp\satan.exe

                      MD5

                      c813de3f7afd4413d03d02186ec35c96

                      SHA1

                      bbfcfc985f99e6f630acafc07ec4807a6268d399

                      SHA256

                      6dc4a0f405256dc832e7cf7c0046acfa7180636be8bd115756013d7c7cbd37b5

                      SHA512

                      d0bf9679e2b9c713f3196ef7a578e3ea093a56cb54cd3904e7bba4d014753cd57d2a5ca0ce0a37222a3dd0fbbd87b95180198fb38b7cfd28f8976290585eb26e

                    • C:\Users\Admin\AppData\Local\Temp\srvs.exe

                      MD5

                      839d7dbac7284c842dde27b8d3a3528d

                      SHA1

                      530ee428d5925328f6f9a813a7529c697553350e

                      SHA256

                      3cc86dcff59b717324ebef671b4772107fb9950a73528019d4484773932b5a71

                      SHA512

                      2c96d266b7a9362d451ab203687983d8477c67e30f9999a6b51f11126d6f848b0c5cac4844c250585b4cca8f87299e6345952b7b2e982db5d88a1523a619bf35

                    • C:\Users\Admin\AppData\Local\Temp\srvs.exe

                      MD5

                      839d7dbac7284c842dde27b8d3a3528d

                      SHA1

                      530ee428d5925328f6f9a813a7529c697553350e

                      SHA256

                      3cc86dcff59b717324ebef671b4772107fb9950a73528019d4484773932b5a71

                      SHA512

                      2c96d266b7a9362d451ab203687983d8477c67e30f9999a6b51f11126d6f848b0c5cac4844c250585b4cca8f87299e6345952b7b2e982db5d88a1523a619bf35

                    • C:\Users\Admin\AppData\Local\Temp\zbjiyysp.exe

                      MD5

                      5ed453816812d1c8db0ff511ff91505e

                      SHA1

                      733b456c6dcc6ab698d31e41937d33f97801ede7

                      SHA256

                      bc513080bc73f96e3d122d29b25b76159ac2202429ed089bf1c6243ae756bda2

                      SHA512

                      691592e731fe759284ae287e9ce78b6c938f3370ec96ad54055c0ccf20f524fee0fe052d1538a8058279ed421d6193fd94ac7c5380d3b62e98f5bafcb809ff6a

                    • C:\Windows\SysWOW64\fcmvectb\zbjiyysp.exe

                      MD5

                      5ed453816812d1c8db0ff511ff91505e

                      SHA1

                      733b456c6dcc6ab698d31e41937d33f97801ede7

                      SHA256

                      bc513080bc73f96e3d122d29b25b76159ac2202429ed089bf1c6243ae756bda2

                      SHA512

                      691592e731fe759284ae287e9ce78b6c938f3370ec96ad54055c0ccf20f524fee0fe052d1538a8058279ed421d6193fd94ac7c5380d3b62e98f5bafcb809ff6a

                    • \ProgramData\mozglue.dll

                      MD5

                      8f73c08a9660691143661bf7332c3c27

                      SHA1

                      37fa65dd737c50fda710fdbde89e51374d0c204a

                      SHA256

                      3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

                      SHA512

                      0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

                    • \ProgramData\nss3.dll

                      MD5

                      bfac4e3c5908856ba17d41edcd455a51

                      SHA1

                      8eec7e888767aa9e4cca8ff246eb2aacb9170428

                      SHA256

                      e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                      SHA512

                      2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

                    • memory/372-252-0x0000000002F00000-0x0000000002FA0000-memory.dmp

                      Filesize

                      640KB

                    • memory/372-253-0x0000000003020000-0x00000000030E0000-memory.dmp

                      Filesize

                      768KB

                    • memory/372-263-0x0000000000400000-0x0000000002BC5000-memory.dmp

                      Filesize

                      39.8MB

                    • memory/372-230-0x0000000000000000-mapping.dmp

                    • memory/372-314-0x0000000000400000-0x0000000002BC5000-memory.dmp

                      Filesize

                      39.8MB

                    • memory/372-260-0x00000000030EB000-0x000000000316C000-memory.dmp

                      Filesize

                      516KB

                    • memory/372-281-0x0000000000400000-0x0000000002BC5000-memory.dmp

                      Filesize

                      39.8MB

                    • memory/396-219-0x0000000002F80000-0x0000000002FF4000-memory.dmp

                      Filesize

                      464KB

                    • memory/396-220-0x0000000002F10000-0x0000000002F7B000-memory.dmp

                      Filesize

                      428KB

                    • memory/396-218-0x0000000000000000-mapping.dmp

                    • memory/500-131-0x0000000000000000-mapping.dmp

                    • memory/500-141-0x0000000000560000-0x00000000006AA000-memory.dmp

                      Filesize

                      1.3MB

                    • memory/500-137-0x0000000000849000-0x000000000085A000-memory.dmp

                      Filesize

                      68KB

                    • memory/500-142-0x0000000000400000-0x000000000055F000-memory.dmp

                      Filesize

                      1.4MB

                    • memory/568-153-0x0000000004BA0000-0x0000000004BBE000-memory.dmp

                      Filesize

                      120KB

                    • memory/568-149-0x0000000004C40000-0x0000000004C41000-memory.dmp

                      Filesize

                      4KB

                    • memory/568-155-0x00000000051D0000-0x00000000056CE000-memory.dmp

                      Filesize

                      5.0MB

                    • memory/568-143-0x0000000000000000-mapping.dmp

                    • memory/568-146-0x0000000000340000-0x00000000003CA000-memory.dmp

                      Filesize

                      552KB

                    • memory/568-147-0x0000000000340000-0x00000000003CA000-memory.dmp

                      Filesize

                      552KB

                    • memory/568-150-0x00000000026C0000-0x00000000026C1000-memory.dmp

                      Filesize

                      4KB

                    • memory/568-151-0x0000000004C50000-0x0000000004CC6000-memory.dmp

                      Filesize

                      472KB

                    • memory/652-166-0x0000000000419192-mapping.dmp

                    • memory/652-187-0x0000000005C10000-0x0000000005C2E000-memory.dmp

                      Filesize

                      120KB

                    • memory/652-173-0x00000000056A0000-0x00000000056B2000-memory.dmp

                      Filesize

                      72KB

                    • memory/652-165-0x0000000000400000-0x0000000000420000-memory.dmp

                      Filesize

                      128KB

                    • memory/652-174-0x00000000057D0000-0x00000000058DA000-memory.dmp

                      Filesize

                      1.0MB

                    • memory/652-190-0x00000000077F0000-0x0000000007D1C000-memory.dmp

                      Filesize

                      5.2MB

                    • memory/652-169-0x0000000000400000-0x0000000000420000-memory.dmp

                      Filesize

                      128KB

                    • memory/652-170-0x0000000000400000-0x0000000000420000-memory.dmp

                      Filesize

                      128KB

                    • memory/652-180-0x0000000005700000-0x000000000573E000-memory.dmp

                      Filesize

                      248KB

                    • memory/652-189-0x00000000070F0000-0x00000000072B2000-memory.dmp

                      Filesize

                      1.8MB

                    • memory/652-179-0x00000000056A0000-0x0000000005CA6000-memory.dmp

                      Filesize

                      6.0MB

                    • memory/652-188-0x0000000006650000-0x00000000066B6000-memory.dmp

                      Filesize

                      408KB

                    • memory/652-183-0x0000000005760000-0x00000000057AB000-memory.dmp

                      Filesize

                      300KB

                    • memory/652-184-0x0000000005A50000-0x0000000005AC6000-memory.dmp

                      Filesize

                      472KB

                    • memory/652-185-0x0000000005B70000-0x0000000005C02000-memory.dmp

                      Filesize

                      584KB

                    • memory/652-186-0x00000000067C0000-0x0000000006CBE000-memory.dmp

                      Filesize

                      5.0MB

                    • memory/652-172-0x0000000005CB0000-0x00000000062B6000-memory.dmp

                      Filesize

                      6.0MB

                    • memory/664-216-0x0000000000B2259C-mapping.dmp

                    • memory/664-217-0x0000000000A90000-0x0000000000B81000-memory.dmp

                      Filesize

                      964KB

                    • memory/664-212-0x0000000000A90000-0x0000000000B81000-memory.dmp

                      Filesize

                      964KB

                    • memory/684-156-0x0000000000000000-mapping.dmp

                    • memory/1084-154-0x0000000000000000-mapping.dmp

                    • memory/1228-242-0x0000000000F80000-0x0000000001003000-memory.dmp

                      Filesize

                      524KB

                    • memory/1228-251-0x00000000056C0000-0x00000000056C1000-memory.dmp

                      Filesize

                      4KB

                    • memory/1228-246-0x0000000005680000-0x0000000005692000-memory.dmp

                      Filesize

                      72KB

                    • memory/1228-245-0x0000000005CE0000-0x00000000062E6000-memory.dmp

                      Filesize

                      6.0MB

                    • memory/1228-243-0x0000000000F80000-0x0000000001003000-memory.dmp

                      Filesize

                      524KB

                    • memory/1228-244-0x0000000072000000-0x0000000072080000-memory.dmp

                      Filesize

                      512KB

                    • memory/1228-248-0x0000000005710000-0x000000000574E000-memory.dmp

                      Filesize

                      248KB

                    • memory/1228-241-0x0000000075B20000-0x0000000075C11000-memory.dmp

                      Filesize

                      964KB

                    • memory/1228-240-0x00000000769D0000-0x0000000076B92000-memory.dmp

                      Filesize

                      1.8MB

                    • memory/1228-238-0x0000000001010000-0x000000000115A000-memory.dmp

                      Filesize

                      1.3MB

                    • memory/1228-239-0x0000000000F50000-0x0000000000F51000-memory.dmp

                      Filesize

                      4KB

                    • memory/1228-237-0x0000000000F80000-0x0000000001003000-memory.dmp

                      Filesize

                      524KB

                    • memory/1228-236-0x0000000000F80000-0x0000000001003000-memory.dmp

                      Filesize

                      524KB

                    • memory/1228-249-0x0000000076C20000-0x00000000771A4000-memory.dmp

                      Filesize

                      5.5MB

                    • memory/1228-247-0x00000000057E0000-0x00000000058EA000-memory.dmp

                      Filesize

                      1.0MB

                    • memory/1228-233-0x0000000000000000-mapping.dmp

                    • memory/1228-250-0x0000000073DF0000-0x0000000075138000-memory.dmp

                      Filesize

                      19.3MB

                    • memory/1228-255-0x0000000071F30000-0x0000000071F7B000-memory.dmp

                      Filesize

                      300KB

                    • memory/1288-162-0x0000000000000000-mapping.dmp

                    • memory/1640-163-0x0000000000000000-mapping.dmp

                    • memory/1812-136-0x0000000000560000-0x00000000006AA000-memory.dmp

                      Filesize

                      1.3MB

                    • memory/1812-123-0x0000000000000000-mapping.dmp

                    • memory/1812-126-0x0000000000909000-0x000000000091A000-memory.dmp

                      Filesize

                      68KB

                    • memory/2144-118-0x00000000006B0000-0x00000000006B9000-memory.dmp

                      Filesize

                      36KB

                    • memory/2184-209-0x0000000004FE0000-0x000000000502B000-memory.dmp

                      Filesize

                      300KB

                    • memory/2184-205-0x0000000076C20000-0x00000000771A4000-memory.dmp

                      Filesize

                      5.5MB

                    • memory/2184-191-0x0000000000000000-mapping.dmp

                    • memory/2184-224-0x0000000005340000-0x00000000053B6000-memory.dmp

                      Filesize

                      472KB

                    • memory/2184-226-0x0000000006100000-0x00000000065FE000-memory.dmp

                      Filesize

                      5.0MB

                    • memory/2184-225-0x00000000053C0000-0x0000000005452000-memory.dmp

                      Filesize

                      584KB

                    • memory/2184-227-0x0000000005480000-0x000000000549E000-memory.dmp

                      Filesize

                      120KB

                    • memory/2184-228-0x0000000005F00000-0x0000000005F66000-memory.dmp

                      Filesize

                      408KB

                    • memory/2184-229-0x0000000006800000-0x0000000006850000-memory.dmp

                      Filesize

                      320KB

                    • memory/2184-195-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

                      Filesize

                      4KB

                    • memory/2184-194-0x0000000000D70000-0x0000000000E36000-memory.dmp

                      Filesize

                      792KB

                    • memory/2184-196-0x00000000769D0000-0x0000000076B92000-memory.dmp

                      Filesize

                      1.8MB

                    • memory/2184-208-0x0000000073DF0000-0x0000000075138000-memory.dmp

                      Filesize

                      19.3MB

                    • memory/2184-210-0x0000000071F30000-0x0000000071F7B000-memory.dmp

                      Filesize

                      300KB

                    • memory/2184-207-0x0000000004FE0000-0x00000000055E6000-memory.dmp

                      Filesize

                      6.0MB

                    • memory/2184-206-0x0000000000C70000-0x0000000000CB4000-memory.dmp

                      Filesize

                      272KB

                    • memory/2184-204-0x0000000002F80000-0x0000000002FBE000-memory.dmp

                      Filesize

                      248KB

                    • memory/2184-203-0x00000000050F0000-0x00000000051FA000-memory.dmp

                      Filesize

                      1.0MB

                    • memory/2184-202-0x00000000027B0000-0x00000000027C2000-memory.dmp

                      Filesize

                      72KB

                    • memory/2184-201-0x00000000055F0000-0x0000000005BF6000-memory.dmp

                      Filesize

                      6.0MB

                    • memory/2184-199-0x0000000000D70000-0x0000000000E36000-memory.dmp

                      Filesize

                      792KB

                    • memory/2184-200-0x0000000072000000-0x0000000072080000-memory.dmp

                      Filesize

                      512KB

                    • memory/2184-198-0x0000000000D70000-0x0000000000E36000-memory.dmp

                      Filesize

                      792KB

                    • memory/2184-197-0x0000000075B20000-0x0000000075C11000-memory.dmp

                      Filesize

                      964KB

                    • memory/2348-177-0x0000000000400000-0x000000000055E000-memory.dmp

                      Filesize

                      1.4MB

                    • memory/2348-175-0x0000000000D00000-0x0000000000D13000-memory.dmp

                      Filesize

                      76KB

                    • memory/2380-178-0x00000000003C9A6B-mapping.dmp

                    • memory/2380-182-0x00000000002D0000-0x00000000002D1000-memory.dmp

                      Filesize

                      4KB

                    • memory/2380-181-0x00000000002D0000-0x00000000002D1000-memory.dmp

                      Filesize

                      4KB

                    • memory/2380-176-0x00000000003C0000-0x00000000003D5000-memory.dmp

                      Filesize

                      84KB

                    • memory/2716-221-0x0000000000000000-mapping.dmp

                    • memory/2716-223-0x0000000000940000-0x000000000094C000-memory.dmp

                      Filesize

                      48KB

                    • memory/2716-222-0x0000000000950000-0x0000000000957000-memory.dmp

                      Filesize

                      28KB

                    • memory/2736-117-0x0000000000402F47-mapping.dmp

                    • memory/2736-116-0x0000000000400000-0x0000000000409000-memory.dmp

                      Filesize

                      36KB

                    • memory/2780-296-0x00000000769D0000-0x0000000076B92000-memory.dmp

                      Filesize

                      1.8MB

                    • memory/2780-305-0x0000000000400000-0x00000000007AD000-memory.dmp

                      Filesize

                      3.7MB

                    • memory/2780-304-0x0000000000400000-0x00000000007AD000-memory.dmp

                      Filesize

                      3.7MB

                    • memory/2780-295-0x00000000001E0000-0x00000000001E1000-memory.dmp

                      Filesize

                      4KB

                    • memory/2780-294-0x0000000000400000-0x00000000007AD000-memory.dmp

                      Filesize

                      3.7MB

                    • memory/2780-293-0x0000000000400000-0x00000000007AD000-memory.dmp

                      Filesize

                      3.7MB

                    • memory/2780-291-0x0000000000400000-0x00000000007AD000-memory.dmp

                      Filesize

                      3.7MB

                    • memory/2780-292-0x0000000000400000-0x00000000007AD000-memory.dmp

                      Filesize

                      3.7MB

                    • memory/2780-288-0x0000000000000000-mapping.dmp

                    • memory/2804-282-0x0000000000000000-mapping.dmp

                    • memory/2812-158-0x0000000000400000-0x000000000055E000-memory.dmp

                      Filesize

                      1.4MB

                    • memory/2812-152-0x0000000000560000-0x00000000006AA000-memory.dmp

                      Filesize

                      1.3MB

                    • memory/2812-148-0x000000000079A000-0x00000000007AA000-memory.dmp

                      Filesize

                      64KB

                    • memory/2812-138-0x0000000000000000-mapping.dmp

                    • memory/2968-258-0x0000000000000000-mapping.dmp

                    • memory/2996-303-0x0000000000000000-mapping.dmp

                    • memory/3004-119-0x0000000000DD0000-0x0000000000DE6000-memory.dmp

                      Filesize

                      88KB

                    • memory/3004-161-0x00000000030B0000-0x00000000030C6000-memory.dmp

                      Filesize

                      88KB

                    • memory/3120-128-0x0000000000402F47-mapping.dmp

                    • memory/3380-159-0x0000000000000000-mapping.dmp

                    • memory/3384-132-0x0000000000460000-0x00000000005AA000-memory.dmp

                      Filesize

                      1.3MB

                    • memory/3384-135-0x0000000000400000-0x0000000000452000-memory.dmp

                      Filesize

                      328KB

                    • memory/3384-130-0x0000000000460000-0x00000000005AA000-memory.dmp

                      Filesize

                      1.3MB

                    • memory/3384-120-0x0000000000000000-mapping.dmp

                    • memory/4052-160-0x0000000000000000-mapping.dmp

                    • memory/4900-328-0x0000000000400000-0x0000000000420000-memory.dmp

                      Filesize

                      128KB

                    • memory/4900-329-0x00000000004191A2-mapping.dmp