Analysis

  • max time kernel
    391s
  • max time network
    393s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-09-2022 11:07

General

  • Target

    Restoro.exe

  • Size

    910KB

  • MD5

    39fef85fe114d96dde745b8ce0659b2e

  • SHA1

    c30e2b541a5268f731824342dc3c3c02671891d7

  • SHA256

    08333e61156e2ccfd7843a924fb671862fc226c89bf98f20ab95ea6125130ef7

  • SHA512

    b5ecb8f469ed8ea2b351b7333356b15f0c73e3101052aa2dbcda8db00b9eabf94f1523601cab71dadb5ac83581f18c76f43ff704355be96af0a981567b9f6bab

  • SSDEEP

    12288:SEiLRLvq1HB+OP6YyUCRXXzE4tyMgq/q7dps1XG2YZhH30DVUr0JImhySZP9ZerJ:StRLvGTK1RzE4t7D1Y4VUwJ77P4J

Malware Config

Signatures

  • Modifies security service 2 TTPs 8 IoCs
  • Modifies system executable filetype association 2 TTPs 3 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 23 IoCs
  • Registers COM server for autorun 1 TTPs 64 IoCs
  • Uses Session Manager for persistence 2 TTPs 1 IoCs

    Creates Session Manager registry key to run executable early in system boot.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates connected drives 3 TTPs 48 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Maps connected drives based on registry 3 TTPs 3 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Modifies WinLogon 2 TTPs 64 IoCs
  • Drops file in Program Files directory 32 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates processes with tasklist 1 TTPs 16 IoCs
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 39 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 11 IoCs
  • Suspicious behavior: EnumeratesProcesses 31 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Restoro.exe
    "C:\Users\Admin\AppData\Local\Temp\Restoro.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1772
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FF.bat" > C:\Users\Admin\AppData\Local\Temp\FF.txt"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2404
      • C:\Users\Admin\AppData\Local\Temp\sqlite3.exe
        "C:\Users\Admin\AppData\Local\Temp\sqlite3.exe" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3cx0qxds.Admin\cookies.sqlite" "select value, expiry from moz_cookies where baseDomain like 'restoro.com' and name='_trackid_product_24';"
        3⤵
        • Executes dropped EXE
        PID:4160
    • C:\Users\Admin\AppData\Local\Temp\sqlite3.exe
      "C:\Users\Admin\AppData\Local\Temp\sqlite3.exe" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cookies" "select value, expires_utc from cookies where host_key like '%restoro.com' and name='_trackid_product_24';"
      2⤵
      • Executes dropped EXE
      PID:4472
    • C:\Users\Admin\AppData\Local\Temp\sqlite3.exe
      "C:\Users\Admin\AppData\Local\Temp\sqlite3.exe" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cookies" "select name, expires_utc from cookies where host_key like '%restoro.com' and name like '_trackid_product_24_%';"
      2⤵
      • Executes dropped EXE
      PID:4352
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FF.bat" > C:\Users\Admin\AppData\Local\Temp\FF.txt"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:260
      • C:\Users\Admin\AppData\Local\Temp\sqlite3.exe
        "C:\Users\Admin\AppData\Local\Temp\sqlite3.exe" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3cx0qxds.Admin\cookies.sqlite" "select value, expiry from moz_cookies where baseDomain like 'restoro.com' and name='_tracking_product_24';"
        3⤵
        • Executes dropped EXE
        PID:4052
    • C:\Users\Admin\AppData\Local\Temp\sqlite3.exe
      "C:\Users\Admin\AppData\Local\Temp\sqlite3.exe" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cookies" "select value, expires_utc from cookies where host_key like '%restoro.com' and name='_tracking_product_24';"
      2⤵
      • Executes dropped EXE
      PID:4328
    • C:\Users\Admin\AppData\Local\Temp\sqlite3.exe
      "C:\Users\Admin\AppData\Local\Temp\sqlite3.exe" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cookies" "select name, expires_utc from cookies where host_key like '%restoro.com' and name like '_tracking_product_24_%';"
      2⤵
      • Executes dropped EXE
      PID:5024
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FF.bat" > C:\Users\Admin\AppData\Local\Temp\FF.txt"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1192
      • C:\Users\Admin\AppData\Local\Temp\sqlite3.exe
        "C:\Users\Admin\AppData\Local\Temp\sqlite3.exe" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3cx0qxds.Admin\cookies.sqlite" "select value, expiry from moz_cookies where baseDomain like 'restoro.com' and name='_campaign_product_24';"
        3⤵
        • Executes dropped EXE
        PID:3636
    • C:\Users\Admin\AppData\Local\Temp\sqlite3.exe
      "C:\Users\Admin\AppData\Local\Temp\sqlite3.exe" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cookies" "select value, expires_utc from cookies where host_key like '%restoro.com' and name='_campaign_product_24';"
      2⤵
      • Executes dropped EXE
      PID:496
    • C:\Users\Admin\AppData\Local\Temp\sqlite3.exe
      "C:\Users\Admin\AppData\Local\Temp\sqlite3.exe" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cookies" "select name, expires_utc from cookies where host_key like '%restoro.com' and name like '_campaign_product_24_%';"
      2⤵
      • Executes dropped EXE
      PID:5008
    • C:\Windows\SysWOW64\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq RestoroMain.exe" > C:\Users\Admin\AppData\Local\Temp\IsProcessActive.txt
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4732
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist /FI "IMAGENAME eq RestoroMain.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:564
    • C:\Windows\SysWOW64\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq avupdate.exe" > C:\Users\Admin\AppData\Local\Temp\IsProcessActive.txt
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4304
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist /FI "IMAGENAME eq avupdate.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:932
    • C:\Windows\SYSTEM32\regsvr32.exe
      regsvr32 /s "C:\Windows\system32\jscript.dll"
      2⤵
      • Registers COM server for autorun
      • Modifies registry class
      PID:4684
    • C:\Windows\SysWOW64\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq RestoroSetup.exe" > C:\Users\Admin\AppData\Local\Temp\IsProcessActive.txt
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:256
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist /FI "IMAGENAME eq RestoroSetup.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:224
    • C:\Windows\SysWOW64\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq HMA! Pro VPN.exe" > C:\Users\Admin\AppData\Local\Temp\IsProcessActive.txt
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:692
      • C:\Windows\SysWOW64\tasklist.exe
        tasklist /FI "IMAGENAME eq HMA! Pro VPN.exe"
        3⤵
        • Enumerates processes with tasklist
        • Suspicious use of AdjustPrivilegeToken
        PID:5004
    • C:\Windows\SysWOW64\cmd.exe
      cmd /C tasklist /FI "IMAGENAME eq GeoProxy.exe" > C:\Users\Admin\AppData\Local\Temp\IsProcessActive.txt
      2⤵
        PID:5112
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist /FI "IMAGENAME eq GeoProxy.exe"
          3⤵
          • Enumerates processes with tasklist
          • Suspicious use of AdjustPrivilegeToken
          PID:4760
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\FF.bat" > C:\Users\Admin\AppData\Local\Temp\FF.txt"
        2⤵
          PID:3888
          • C:\Users\Admin\AppData\Local\Temp\sqlite3.exe
            "C:\Users\Admin\AppData\Local\Temp\sqlite3.exe" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3cx0qxds.Admin\cookies.sqlite" "select value, expiry from moz_cookies where baseDomain like 'restoro.com' and name='_country_product_24';"
            3⤵
            • Executes dropped EXE
            PID:4700
        • C:\Users\Admin\AppData\Local\Temp\sqlite3.exe
          "C:\Users\Admin\AppData\Local\Temp\sqlite3.exe" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cookies" "select value, expires_utc from cookies where host_key like '%restoro.com' and name='_country_product_24';"
          2⤵
          • Executes dropped EXE
          PID:4620
        • C:\Users\Admin\AppData\Local\Temp\sqlite3.exe
          "C:\Users\Admin\AppData\Local\Temp\sqlite3.exe" "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cookies" "select name, expires_utc from cookies where host_key like '%restoro.com' and name like '_country_product_24_%';"
          2⤵
          • Executes dropped EXE
          PID:1680
        • C:\Windows\SysWOW64\cmd.exe
          cmd /C tasklist /FI "IMAGENAME eq Wireshark.exe" > C:\Users\Admin\AppData\Local\Temp\IsProcessActive.txt
          2⤵
            PID:4244
            • C:\Windows\SysWOW64\tasklist.exe
              tasklist /FI "IMAGENAME eq Wireshark.exe"
              3⤵
              • Enumerates processes with tasklist
              • Suspicious use of AdjustPrivilegeToken
              PID:3684
          • C:\Windows\SysWOW64\cmd.exe
            cmd /C tasklist /FI "IMAGENAME eq Fiddler.exe" > C:\Users\Admin\AppData\Local\Temp\IsProcessActive.txt
            2⤵
              PID:4508
              • C:\Windows\SysWOW64\tasklist.exe
                tasklist /FI "IMAGENAME eq Fiddler.exe"
                3⤵
                • Enumerates processes with tasklist
                • Suspicious use of AdjustPrivilegeToken
                PID:1220
            • C:\Windows\SysWOW64\cmd.exe
              cmd /C tasklist /FI "IMAGENAME eq smsniff.exe" > C:\Users\Admin\AppData\Local\Temp\IsProcessActive.txt
              2⤵
                PID:4612
                • C:\Windows\SysWOW64\tasklist.exe
                  tasklist /FI "IMAGENAME eq smsniff.exe"
                  3⤵
                  • Enumerates processes with tasklist
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4440
              • C:\Users\Admin\AppData\Local\Temp\RestoroSetup.exe
                "C:\Users\Admin\AppData\Local\Temp\RestoroSetup.exe" /GUI=http://www.restoro.com/ui/2100/layout.php?consumer=1&trackutil=&MinorSessionID=afb3e638f20d49a2b1d2bf5915&lang_code=en&trial=0&ShowSettings=false "/Location=C:\Users\Admin\AppData\Local\Temp\Restoro.exe" /uninstallX86=TRUE /trackutil= /CookieTracking= /CookieCampaign= /EventUser=New /Update=1 /DownloaderVersion=2100 /RunSilent=false /SessionID=43d74354-5075-474d-8989-019b4a699b61 /IDMinorSession=afb3e638f20d49a2b1d2bf5915 /pxkp=Delete /Language=1033 /GuiLang=en /AgentStatus=ENABLED /StartScan=0 /VersionInfo=versionInfo /ShowSettings=true
                2⤵
                • Executes dropped EXE
                • Checks computer location settings
                • Loads dropped DLL
                • Adds Run key to start application
                • Drops file in Program Files directory
                • Drops file in Windows directory
                PID:4536
                • C:\Windows\SysWOW64\cmd.exe
                  cmd /C tasklist /FI "IMAGENAME eq RestoroMain.exe" > C:\Users\Admin\AppData\Local\Temp\IsProcessActive.txt
                  3⤵
                    PID:100
                    • C:\Windows\SysWOW64\tasklist.exe
                      tasklist /FI "IMAGENAME eq RestoroMain.exe"
                      4⤵
                      • Enumerates processes with tasklist
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1076
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd /C tasklist /FI "IMAGENAME eq avupdate.exe" > C:\Users\Admin\AppData\Local\Temp\IsProcessActive.txt
                    3⤵
                      PID:256
                      • C:\Windows\SysWOW64\tasklist.exe
                        tasklist /FI "IMAGENAME eq avupdate.exe"
                        4⤵
                        • Enumerates processes with tasklist
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4328
                    • C:\Program Files\Restoro\lzma.exe
                      "C:\Program Files\Restoro\lzma.exe" "d" "C:\Program Files\Restoro\ax.lza" "C:\Program Files\Restoro\ax.dll"
                      3⤵
                      • Executes dropped EXE
                      • Drops file in Program Files directory
                      PID:1048
                    • C:\Program Files\Restoro\lzma.exe
                      "C:\Program Files\Restoro\lzma.exe" "d" "C:\Program Files\Restoro\engine.lza" "C:\Program Files\Restoro\engine.dll"
                      3⤵
                      • Executes dropped EXE
                      • Drops file in Program Files directory
                      PID:260
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd /C tasklist /FI "IMAGENAME eq RestoroAM.exe" > C:\Users\Admin\AppData\Local\Temp\IsProcessActive.txt
                      3⤵
                        PID:4764
                        • C:\Windows\SysWOW64\tasklist.exe
                          tasklist /FI "IMAGENAME eq RestoroAM.exe"
                          4⤵
                          • Enumerates processes with tasklist
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3352
                      • C:\Windows\SysWOW64\regsvr32.exe
                        regsvr32 /s "C:\Program Files\Restoro\ax.dll"
                        3⤵
                        • Loads dropped DLL
                        PID:3656
                        • C:\Windows\system32\regsvr32.exe
                          /s "C:\Program Files\Restoro\ax.dll"
                          4⤵
                          • Registers COM server for autorun
                          • Loads dropped DLL
                          • Modifies registry class
                          PID:4748
                      • C:\Windows\SysWOW64\regsvr32.exe
                        regsvr32 /s "C:\Program Files\Restoro\engine.dll"
                        3⤵
                          PID:1572
                          • C:\Windows\system32\regsvr32.exe
                            /s "C:\Program Files\Restoro\engine.dll"
                            4⤵
                              PID:3536
                          • C:\Users\Admin\AppData\Local\Temp\nsj9193.tmp\RestoroUpdater.exe
                            "C:\Users\Admin\AppData\Local\Temp\nsj9193.tmp\RestoroUpdater.exe" /S /MinorSessionID=afb3e638f20d49a2b1d2bf5915 /SessionID=43d74354-5075-474d-8989-019b4a699b61 /TrackID= /AgentLogLocation=C:\C:\ProgramData\Restoro\bin\results /CflLocation=C:\ProgramData\Restoro\cfl.rei /Install=True /DownloaderVersion=2100 /Iav=False
                            3⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            PID:3888
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd /C tasklist /FI "IMAGENAME eq RestoroServiceSetup.exe" > C:\Users\Admin\AppData\Local\Temp\IsProcessActive.txt
                              4⤵
                                PID:4248
                                • C:\Windows\SysWOW64\tasklist.exe
                                  tasklist /FI "IMAGENAME eq RestoroServiceSetup.exe"
                                  5⤵
                                  • Enumerates processes with tasklist
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1152
                              • C:\Users\Admin\AppData\Local\Temp\RestoroServiceSetup.exe
                                "C:\Users\Admin\AppData\Local\Temp\RestoroServiceSetup.exe" /S /MinorSessionID=afb3e638f20d49a2b1d2bf5915 /SessionID=43d74354-5075-474d-8989-019b4a699b61 /Install=true /UpdateOnly=default /InstallPath= /Iav=False /SessionOk=true
                                4⤵
                                • Executes dropped EXE
                                • Drops file in Program Files directory
                                • Drops file in Windows directory
                                PID:772
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd /C tasklist /FI "IMAGENAME eq RestoroScanner.exe" > C:\Users\Admin\AppData\Local\Temp\IsProcessActive.txt
                                  5⤵
                                    PID:632
                                    • C:\Windows\SysWOW64\tasklist.exe
                                      tasklist /FI "IMAGENAME eq RestoroScanner.exe"
                                      6⤵
                                      • Enumerates processes with tasklist
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4320
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd /C tasklist /FI "IMAGENAME eq RestoroUI.exe" > C:\Users\Admin\AppData\Local\Temp\IsProcessActive.txt
                                    5⤵
                                      PID:3012
                                      • C:\Windows\SysWOW64\tasklist.exe
                                        tasklist /FI "IMAGENAME eq RestoroUI.exe"
                                        6⤵
                                        • Enumerates processes with tasklist
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:5088
                                    • C:\Program Files\Restoro\bin\RestoroProtection.exe
                                      "C:\Program Files\Restoro\bin\RestoroProtection.exe" -install
                                      5⤵
                                      • Executes dropped EXE
                                      • Enumerates connected drives
                                      • Modifies system certificate store
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:3024
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd /C tasklist /FI "IMAGENAME eq RestoroProtection.exe" > C:\Users\Admin\AppData\Local\Temp\IsProcessActive.txt
                                  3⤵
                                    PID:256
                                    • C:\Windows\SysWOW64\tasklist.exe
                                      tasklist /FI "IMAGENAME eq RestoroProtection.exe"
                                      4⤵
                                      • Enumerates processes with tasklist
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2688
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd /C tasklist /FI "IMAGENAME eq RestoroApp.exe" > C:\Users\Admin\AppData\Local\Temp\IsProcessActive.txt
                                    3⤵
                                      PID:776
                                      • C:\Windows\SysWOW64\tasklist.exe
                                        tasklist /FI "IMAGENAME eq RestoroApp.exe"
                                        4⤵
                                        • Enumerates processes with tasklist
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:5004
                                    • C:\Windows\SysWOW64\schtasks.exe
                                      schtasks /Delete /TN RestoroActiveProtection /F
                                      3⤵
                                        PID:2672
                                      • C:\Program Files\Restoro\bin\RestoroApp.exe
                                        "C:\Program Files\Restoro\bin\RestoroApp.exe"
                                        3⤵
                                        • Executes dropped EXE
                                        • Suspicious use of FindShellTrayWindow
                                        • Suspicious use of SendNotifyMessage
                                        PID:932
                                      • C:\Program Files\Restoro\RestoroMain.exe
                                        "C:\Program Files\Restoro\RestoroMain.exe" http://www.restoro.com/ui/2100/layout.php?consumer=1&trackutil=&MinorSessionID=afb3e638f20d49a2b1d2bf5915&lang_code=en&trial=0&ShowSettings=false /Locale=1033
                                        3⤵
                                        • Modifies security service
                                        • Modifies system executable filetype association
                                        • Executes dropped EXE
                                        • Registers COM server for autorun
                                        • Uses Session Manager for persistence
                                        • Enumerates connected drives
                                        • Maps connected drives based on registry
                                        • Modifies WinLogon
                                        • Drops file in Windows directory
                                        • Checks processor information in registry
                                        • Enumerates system info in registry
                                        • Modifies Internet Explorer settings
                                        • Modifies registry class
                                        • Modifies system certificate store
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious behavior: GetForegroundWindowSpam
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of FindShellTrayWindow
                                        • Suspicious use of SendNotifyMessage
                                        • Suspicious use of SetWindowsHookEx
                                        PID:4500
                                        • C:\Windows\SYSTEM32\ipconfig.exe
                                          ipconfig /all
                                          4⤵
                                          • Gathers network information
                                          PID:3576
                                        • C:\Program Files\Restoro\RestoroAM.exe
                                          "C:\Program Files\Restoro\RestoroAM.exe" "C:\ProgramData\Restoro\AV"
                                          4⤵
                                          • Executes dropped EXE
                                          PID:2536
                                        • C:\Windows\system32\ipconfig.exe
                                          C:\Windows\system32\ipconfig.exe /all
                                          4⤵
                                          • Gathers network information
                                          PID:3400
                                  • C:\Program Files\Restoro\bin\RestoroProtection.exe
                                    "C:\Program Files\Restoro\bin\RestoroProtection.exe"
                                    1⤵
                                    • Executes dropped EXE
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:1076
                                    • C:\Program Files\Restoro\bin\RestoroService.exe
                                      "C:\Program Files\Restoro\bin\RestoroService.exe"
                                      2⤵
                                      • Executes dropped EXE
                                      PID:2068

                                  Network

                                  MITRE ATT&CK Enterprise v6

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\Temp\FF.bat

                                    Filesize

                                    255B

                                    MD5

                                    8a22848833744f04cfb11598873afc59

                                    SHA1

                                    d0d8aca10b6a110d83bea8ecf21eba873af7bd23

                                    SHA256

                                    070d04bfe6d6a9e17065da490a1e5a641ccaa432246e50634a4d7d80feeb434a

                                    SHA512

                                    bc6e3438905a5e0106545a3462c1c10958b24caade811002e76ea82c902458f0d6fdc509fd572def645e8e7e94f9697864da62a48005403e4c06fe94dea4ef74

                                  • C:\Users\Admin\AppData\Local\Temp\FF.bat

                                    Filesize

                                    255B

                                    MD5

                                    b2b00fc46bd4eebaace7cd36b233d2e1

                                    SHA1

                                    3001979e09a4f42e072afe462aa3fc2145208db3

                                    SHA256

                                    a2fd855b681d762c53b00a2753db4ee3e27bfb903e92c70c73cb05b4df00555a

                                    SHA512

                                    59b64bbe24236fe1245233b580bac717b0fb33acc4c3abdf8b4413a0a781a313c187a901158abe52ea783f7497ed67da05b23349c52b2183f1d16820974018fb

                                  • C:\Users\Admin\AppData\Local\Temp\FF.bat

                                    Filesize

                                    256B

                                    MD5

                                    8330c1a37a650c07d2f87df2cca66aca

                                    SHA1

                                    bb9f7befbca0c3678b01be7b2f6fb705b3d6ac5b

                                    SHA256

                                    0f62049c88352daf433ccdc1e66142624b6990c8a4cac5f321b096f1dd0bb3f7

                                    SHA512

                                    29afbe155041f9573d52ff03178a9df6236ab09447742537022bc9daa9d36c06d7e12766decc4635d6727064eb48ab625236f79e19de3fdf493de088db63533b

                                  • C:\Users\Admin\AppData\Local\Temp\FF.bat

                                    Filesize

                                    256B

                                    MD5

                                    8fbe2ed7528b019d8988b0d4baf967f1

                                    SHA1

                                    ec4e729d35a18c5bdf3aa6ec0a60f1f76512f31f

                                    SHA256

                                    a119f609000b13c66f5798c5898c1548c21e8840d1e102df4a1c6b255a410038

                                    SHA512

                                    bb47621618f78c741793d48d94ef7a6e1eaa82261d1c378cff238a1c920a0d604948431590d83277b63812407d2bf13687375229592c8e0820cdadf53fe7fb49

                                  • C:\Users\Admin\AppData\Local\Temp\IsProcessActive.txt

                                    Filesize

                                    64B

                                    MD5

                                    dea052a2ad11945b1960577c0192f2eb

                                    SHA1

                                    1d02626a05a546a90c05902b2551f32c20eb3708

                                    SHA256

                                    943b315e065238b7073b033f534ef954b6b6461fb3f03a3f5b8555b11bc4c0a2

                                    SHA512

                                    5496b10e2a77aee11055d71bdaaed835df1770e85fa4d0f9433330470bbcf76c932c04778a0b47f4193eee14813db2e2b19ecc50b4a6a193faa19b4019705917

                                  • C:\Users\Admin\AppData\Local\Temp\IsProcessActive.txt

                                    Filesize

                                    64B

                                    MD5

                                    dea052a2ad11945b1960577c0192f2eb

                                    SHA1

                                    1d02626a05a546a90c05902b2551f32c20eb3708

                                    SHA256

                                    943b315e065238b7073b033f534ef954b6b6461fb3f03a3f5b8555b11bc4c0a2

                                    SHA512

                                    5496b10e2a77aee11055d71bdaaed835df1770e85fa4d0f9433330470bbcf76c932c04778a0b47f4193eee14813db2e2b19ecc50b4a6a193faa19b4019705917

                                  • C:\Users\Admin\AppData\Local\Temp\IsProcessActive.txt

                                    Filesize

                                    64B

                                    MD5

                                    dea052a2ad11945b1960577c0192f2eb

                                    SHA1

                                    1d02626a05a546a90c05902b2551f32c20eb3708

                                    SHA256

                                    943b315e065238b7073b033f534ef954b6b6461fb3f03a3f5b8555b11bc4c0a2

                                    SHA512

                                    5496b10e2a77aee11055d71bdaaed835df1770e85fa4d0f9433330470bbcf76c932c04778a0b47f4193eee14813db2e2b19ecc50b4a6a193faa19b4019705917

                                  • C:\Users\Admin\AppData\Local\Temp\IsProcessActive.txt

                                    Filesize

                                    64B

                                    MD5

                                    dea052a2ad11945b1960577c0192f2eb

                                    SHA1

                                    1d02626a05a546a90c05902b2551f32c20eb3708

                                    SHA256

                                    943b315e065238b7073b033f534ef954b6b6461fb3f03a3f5b8555b11bc4c0a2

                                    SHA512

                                    5496b10e2a77aee11055d71bdaaed835df1770e85fa4d0f9433330470bbcf76c932c04778a0b47f4193eee14813db2e2b19ecc50b4a6a193faa19b4019705917

                                  • C:\Users\Admin\AppData\Local\Temp\IsProcessActive.txt

                                    Filesize

                                    64B

                                    MD5

                                    dea052a2ad11945b1960577c0192f2eb

                                    SHA1

                                    1d02626a05a546a90c05902b2551f32c20eb3708

                                    SHA256

                                    943b315e065238b7073b033f534ef954b6b6461fb3f03a3f5b8555b11bc4c0a2

                                    SHA512

                                    5496b10e2a77aee11055d71bdaaed835df1770e85fa4d0f9433330470bbcf76c932c04778a0b47f4193eee14813db2e2b19ecc50b4a6a193faa19b4019705917

                                  • C:\Users\Admin\AppData\Local\Temp\nsyF5F0.tmp\Banner.dll

                                    Filesize

                                    3KB

                                    MD5

                                    e264d0f91103758bc5b088e8547e0ec1

                                    SHA1

                                    24a94ff59668d18b908c78afd2a9563de2819680

                                    SHA256

                                    501b5935fe8e17516b324e3c1da89773e689359c12263e9782f95836dbab8b63

                                    SHA512

                                    a533278355defd265ef713d4169f06066be41dd60b0e7ed5340454c40aabc47afa47c5ce4c0dbcd6cb8380e2b25dbb1762c3c996d11ac9f70ab9763182850205

                                  • C:\Users\Admin\AppData\Local\Temp\nsyF5F0.tmp\ExecDos.dll

                                    Filesize

                                    5KB

                                    MD5

                                    0deb397ca1e716bb7b15e1754e52b2ac

                                    SHA1

                                    fbb9bcf872c5dbb4ca4c80fb21d41519bc273ef5

                                    SHA256

                                    720be35cd1b4a333264713dc146b4ad024f3a7ad0644c2d8c6fcedd3c30e8a1f

                                    SHA512

                                    507db0bee0897660750007e7ce674406acf9e8bf942cf26ded5654c07682757b07c9eb767bead0966478abc554dc9a6461c4288dc35d12cacfadad4c128f1bb7

                                  • C:\Users\Admin\AppData\Local\Temp\nsyF5F0.tmp\ExecDos.dll

                                    Filesize

                                    5KB

                                    MD5

                                    0deb397ca1e716bb7b15e1754e52b2ac

                                    SHA1

                                    fbb9bcf872c5dbb4ca4c80fb21d41519bc273ef5

                                    SHA256

                                    720be35cd1b4a333264713dc146b4ad024f3a7ad0644c2d8c6fcedd3c30e8a1f

                                    SHA512

                                    507db0bee0897660750007e7ce674406acf9e8bf942cf26ded5654c07682757b07c9eb767bead0966478abc554dc9a6461c4288dc35d12cacfadad4c128f1bb7

                                  • C:\Users\Admin\AppData\Local\Temp\nsyF5F0.tmp\ExecDos.dll

                                    Filesize

                                    5KB

                                    MD5

                                    0deb397ca1e716bb7b15e1754e52b2ac

                                    SHA1

                                    fbb9bcf872c5dbb4ca4c80fb21d41519bc273ef5

                                    SHA256

                                    720be35cd1b4a333264713dc146b4ad024f3a7ad0644c2d8c6fcedd3c30e8a1f

                                    SHA512

                                    507db0bee0897660750007e7ce674406acf9e8bf942cf26ded5654c07682757b07c9eb767bead0966478abc554dc9a6461c4288dc35d12cacfadad4c128f1bb7

                                  • C:\Users\Admin\AppData\Local\Temp\nsyF5F0.tmp\ExecDos.dll

                                    Filesize

                                    5KB

                                    MD5

                                    0deb397ca1e716bb7b15e1754e52b2ac

                                    SHA1

                                    fbb9bcf872c5dbb4ca4c80fb21d41519bc273ef5

                                    SHA256

                                    720be35cd1b4a333264713dc146b4ad024f3a7ad0644c2d8c6fcedd3c30e8a1f

                                    SHA512

                                    507db0bee0897660750007e7ce674406acf9e8bf942cf26ded5654c07682757b07c9eb767bead0966478abc554dc9a6461c4288dc35d12cacfadad4c128f1bb7

                                  • C:\Users\Admin\AppData\Local\Temp\nsyF5F0.tmp\ExecDos.dll

                                    Filesize

                                    5KB

                                    MD5

                                    0deb397ca1e716bb7b15e1754e52b2ac

                                    SHA1

                                    fbb9bcf872c5dbb4ca4c80fb21d41519bc273ef5

                                    SHA256

                                    720be35cd1b4a333264713dc146b4ad024f3a7ad0644c2d8c6fcedd3c30e8a1f

                                    SHA512

                                    507db0bee0897660750007e7ce674406acf9e8bf942cf26ded5654c07682757b07c9eb767bead0966478abc554dc9a6461c4288dc35d12cacfadad4c128f1bb7

                                  • C:\Users\Admin\AppData\Local\Temp\nsyF5F0.tmp\ExecDos.dll

                                    Filesize

                                    5KB

                                    MD5

                                    0deb397ca1e716bb7b15e1754e52b2ac

                                    SHA1

                                    fbb9bcf872c5dbb4ca4c80fb21d41519bc273ef5

                                    SHA256

                                    720be35cd1b4a333264713dc146b4ad024f3a7ad0644c2d8c6fcedd3c30e8a1f

                                    SHA512

                                    507db0bee0897660750007e7ce674406acf9e8bf942cf26ded5654c07682757b07c9eb767bead0966478abc554dc9a6461c4288dc35d12cacfadad4c128f1bb7

                                  • C:\Users\Admin\AppData\Local\Temp\nsyF5F0.tmp\ExecDos.dll

                                    Filesize

                                    5KB

                                    MD5

                                    0deb397ca1e716bb7b15e1754e52b2ac

                                    SHA1

                                    fbb9bcf872c5dbb4ca4c80fb21d41519bc273ef5

                                    SHA256

                                    720be35cd1b4a333264713dc146b4ad024f3a7ad0644c2d8c6fcedd3c30e8a1f

                                    SHA512

                                    507db0bee0897660750007e7ce674406acf9e8bf942cf26ded5654c07682757b07c9eb767bead0966478abc554dc9a6461c4288dc35d12cacfadad4c128f1bb7

                                  • C:\Users\Admin\AppData\Local\Temp\nsyF5F0.tmp\ExecDos.dll

                                    Filesize

                                    5KB

                                    MD5

                                    0deb397ca1e716bb7b15e1754e52b2ac

                                    SHA1

                                    fbb9bcf872c5dbb4ca4c80fb21d41519bc273ef5

                                    SHA256

                                    720be35cd1b4a333264713dc146b4ad024f3a7ad0644c2d8c6fcedd3c30e8a1f

                                    SHA512

                                    507db0bee0897660750007e7ce674406acf9e8bf942cf26ded5654c07682757b07c9eb767bead0966478abc554dc9a6461c4288dc35d12cacfadad4c128f1bb7

                                  • C:\Users\Admin\AppData\Local\Temp\nsyF5F0.tmp\LogEx.dll

                                    Filesize

                                    44KB

                                    MD5

                                    0f96d9eb959ad4e8fd205e6d58cf01b8

                                    SHA1

                                    7c45512cbdb24216afd23a9e8cdce0cfeaa7660f

                                    SHA256

                                    57ede354532937e38c4ae9da3710ee295705ea9770c402dfb3a5c56a32fd4314

                                    SHA512

                                    9f3afb61d75ac7b7dc84abcbf1b04f759b7055992d46140dc5dcc269aed22268d044ee8030f5ea260bbb912774e5bbb751560c16e54efa99c700b9fc7d48832c

                                  • C:\Users\Admin\AppData\Local\Temp\nsyF5F0.tmp\System.dll

                                    Filesize

                                    11KB

                                    MD5

                                    bf712f32249029466fa86756f5546950

                                    SHA1

                                    75ac4dc4808ac148ddd78f6b89a51afbd4091c2e

                                    SHA256

                                    7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af

                                    SHA512

                                    13f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4

                                  • C:\Users\Admin\AppData\Local\Temp\nsyF5F0.tmp\UserInfo.dll

                                    Filesize

                                    4KB

                                    MD5

                                    c7ce0e47c83525983fd2c4c9566b4aad

                                    SHA1

                                    38b7ad7bb32ffae35540fce373b8a671878dc54e

                                    SHA256

                                    6293408a5fa6d0f55f0a4d01528eb5b807ee9447a75a28b5986267475ebcd3ae

                                    SHA512

                                    ee9f23ea5210f418d4c559628bbfb3a0f892440bcd5dc4c1901cb8e510078e4481ea8353b262795076a19055e70b88e08fee5fb7e8f35a6f49022096408df20e

                                  • C:\Users\Admin\AppData\Local\Temp\nsyF5F0.tmp\inetc.dll

                                    Filesize

                                    31KB

                                    MD5

                                    5da9df435ff20853a2c45026e7681cef

                                    SHA1

                                    39b1d70a7a03e7c791cb21a53d82fd949706a4b4

                                    SHA256

                                    9c52c74b8e115db0bde90f56382ebcc12aff05eb2232f80a4701e957e09635e2

                                    SHA512

                                    4ab3b1572485a8a11863adada2c6ec01e809a4b09f99d80903c79a95b91f299b8f2cd6cceaa915567e155a46291a33fb8ccb95141d76d4e7b0e040890d51d09f

                                  • C:\Users\Admin\AppData\Local\Temp\nsyF5F0.tmp\inetc.dll

                                    Filesize

                                    31KB

                                    MD5

                                    5da9df435ff20853a2c45026e7681cef

                                    SHA1

                                    39b1d70a7a03e7c791cb21a53d82fd949706a4b4

                                    SHA256

                                    9c52c74b8e115db0bde90f56382ebcc12aff05eb2232f80a4701e957e09635e2

                                    SHA512

                                    4ab3b1572485a8a11863adada2c6ec01e809a4b09f99d80903c79a95b91f299b8f2cd6cceaa915567e155a46291a33fb8ccb95141d76d4e7b0e040890d51d09f

                                  • C:\Users\Admin\AppData\Local\Temp\nsyF5F0.tmp\inetc.dll

                                    Filesize

                                    31KB

                                    MD5

                                    5da9df435ff20853a2c45026e7681cef

                                    SHA1

                                    39b1d70a7a03e7c791cb21a53d82fd949706a4b4

                                    SHA256

                                    9c52c74b8e115db0bde90f56382ebcc12aff05eb2232f80a4701e957e09635e2

                                    SHA512

                                    4ab3b1572485a8a11863adada2c6ec01e809a4b09f99d80903c79a95b91f299b8f2cd6cceaa915567e155a46291a33fb8ccb95141d76d4e7b0e040890d51d09f

                                  • C:\Users\Admin\AppData\Local\Temp\nsyF5F0.tmp\inetc.dll

                                    Filesize

                                    31KB

                                    MD5

                                    5da9df435ff20853a2c45026e7681cef

                                    SHA1

                                    39b1d70a7a03e7c791cb21a53d82fd949706a4b4

                                    SHA256

                                    9c52c74b8e115db0bde90f56382ebcc12aff05eb2232f80a4701e957e09635e2

                                    SHA512

                                    4ab3b1572485a8a11863adada2c6ec01e809a4b09f99d80903c79a95b91f299b8f2cd6cceaa915567e155a46291a33fb8ccb95141d76d4e7b0e040890d51d09f

                                  • C:\Users\Admin\AppData\Local\Temp\nsyF5F0.tmp\inetc.dll

                                    Filesize

                                    31KB

                                    MD5

                                    5da9df435ff20853a2c45026e7681cef

                                    SHA1

                                    39b1d70a7a03e7c791cb21a53d82fd949706a4b4

                                    SHA256

                                    9c52c74b8e115db0bde90f56382ebcc12aff05eb2232f80a4701e957e09635e2

                                    SHA512

                                    4ab3b1572485a8a11863adada2c6ec01e809a4b09f99d80903c79a95b91f299b8f2cd6cceaa915567e155a46291a33fb8ccb95141d76d4e7b0e040890d51d09f

                                  • C:\Users\Admin\AppData\Local\Temp\nsyF5F0.tmp\inetc.dll

                                    Filesize

                                    31KB

                                    MD5

                                    5da9df435ff20853a2c45026e7681cef

                                    SHA1

                                    39b1d70a7a03e7c791cb21a53d82fd949706a4b4

                                    SHA256

                                    9c52c74b8e115db0bde90f56382ebcc12aff05eb2232f80a4701e957e09635e2

                                    SHA512

                                    4ab3b1572485a8a11863adada2c6ec01e809a4b09f99d80903c79a95b91f299b8f2cd6cceaa915567e155a46291a33fb8ccb95141d76d4e7b0e040890d51d09f

                                  • C:\Users\Admin\AppData\Local\Temp\nsyF5F0.tmp\inetc.dll

                                    Filesize

                                    31KB

                                    MD5

                                    5da9df435ff20853a2c45026e7681cef

                                    SHA1

                                    39b1d70a7a03e7c791cb21a53d82fd949706a4b4

                                    SHA256

                                    9c52c74b8e115db0bde90f56382ebcc12aff05eb2232f80a4701e957e09635e2

                                    SHA512

                                    4ab3b1572485a8a11863adada2c6ec01e809a4b09f99d80903c79a95b91f299b8f2cd6cceaa915567e155a46291a33fb8ccb95141d76d4e7b0e040890d51d09f

                                  • C:\Users\Admin\AppData\Local\Temp\nsyF5F0.tmp\inetc.dll

                                    Filesize

                                    31KB

                                    MD5

                                    5da9df435ff20853a2c45026e7681cef

                                    SHA1

                                    39b1d70a7a03e7c791cb21a53d82fd949706a4b4

                                    SHA256

                                    9c52c74b8e115db0bde90f56382ebcc12aff05eb2232f80a4701e957e09635e2

                                    SHA512

                                    4ab3b1572485a8a11863adada2c6ec01e809a4b09f99d80903c79a95b91f299b8f2cd6cceaa915567e155a46291a33fb8ccb95141d76d4e7b0e040890d51d09f

                                  • C:\Users\Admin\AppData\Local\Temp\nsyF5F0.tmp\inetc.dll

                                    Filesize

                                    31KB

                                    MD5

                                    5da9df435ff20853a2c45026e7681cef

                                    SHA1

                                    39b1d70a7a03e7c791cb21a53d82fd949706a4b4

                                    SHA256

                                    9c52c74b8e115db0bde90f56382ebcc12aff05eb2232f80a4701e957e09635e2

                                    SHA512

                                    4ab3b1572485a8a11863adada2c6ec01e809a4b09f99d80903c79a95b91f299b8f2cd6cceaa915567e155a46291a33fb8ccb95141d76d4e7b0e040890d51d09f

                                  • C:\Users\Admin\AppData\Local\Temp\nsyF5F0.tmp\inetc.dll

                                    Filesize

                                    31KB

                                    MD5

                                    5da9df435ff20853a2c45026e7681cef

                                    SHA1

                                    39b1d70a7a03e7c791cb21a53d82fd949706a4b4

                                    SHA256

                                    9c52c74b8e115db0bde90f56382ebcc12aff05eb2232f80a4701e957e09635e2

                                    SHA512

                                    4ab3b1572485a8a11863adada2c6ec01e809a4b09f99d80903c79a95b91f299b8f2cd6cceaa915567e155a46291a33fb8ccb95141d76d4e7b0e040890d51d09f

                                  • C:\Users\Admin\AppData\Local\Temp\nsyF5F0.tmp\inetc.dll

                                    Filesize

                                    31KB

                                    MD5

                                    5da9df435ff20853a2c45026e7681cef

                                    SHA1

                                    39b1d70a7a03e7c791cb21a53d82fd949706a4b4

                                    SHA256

                                    9c52c74b8e115db0bde90f56382ebcc12aff05eb2232f80a4701e957e09635e2

                                    SHA512

                                    4ab3b1572485a8a11863adada2c6ec01e809a4b09f99d80903c79a95b91f299b8f2cd6cceaa915567e155a46291a33fb8ccb95141d76d4e7b0e040890d51d09f

                                  • C:\Users\Admin\AppData\Local\Temp\nsyF5F0.tmp\inetc.dll

                                    Filesize

                                    31KB

                                    MD5

                                    5da9df435ff20853a2c45026e7681cef

                                    SHA1

                                    39b1d70a7a03e7c791cb21a53d82fd949706a4b4

                                    SHA256

                                    9c52c74b8e115db0bde90f56382ebcc12aff05eb2232f80a4701e957e09635e2

                                    SHA512

                                    4ab3b1572485a8a11863adada2c6ec01e809a4b09f99d80903c79a95b91f299b8f2cd6cceaa915567e155a46291a33fb8ccb95141d76d4e7b0e040890d51d09f

                                  • C:\Users\Admin\AppData\Local\Temp\nsyF5F0.tmp\inetc.dll

                                    Filesize

                                    31KB

                                    MD5

                                    5da9df435ff20853a2c45026e7681cef

                                    SHA1

                                    39b1d70a7a03e7c791cb21a53d82fd949706a4b4

                                    SHA256

                                    9c52c74b8e115db0bde90f56382ebcc12aff05eb2232f80a4701e957e09635e2

                                    SHA512

                                    4ab3b1572485a8a11863adada2c6ec01e809a4b09f99d80903c79a95b91f299b8f2cd6cceaa915567e155a46291a33fb8ccb95141d76d4e7b0e040890d51d09f

                                  • C:\Users\Admin\AppData\Local\Temp\nsyF5F0.tmp\inetc.dll

                                    Filesize

                                    31KB

                                    MD5

                                    5da9df435ff20853a2c45026e7681cef

                                    SHA1

                                    39b1d70a7a03e7c791cb21a53d82fd949706a4b4

                                    SHA256

                                    9c52c74b8e115db0bde90f56382ebcc12aff05eb2232f80a4701e957e09635e2

                                    SHA512

                                    4ab3b1572485a8a11863adada2c6ec01e809a4b09f99d80903c79a95b91f299b8f2cd6cceaa915567e155a46291a33fb8ccb95141d76d4e7b0e040890d51d09f

                                  • C:\Users\Admin\AppData\Local\Temp\nsyF5F0.tmp\nsDialogs.dll

                                    Filesize

                                    9KB

                                    MD5

                                    4ccc4a742d4423f2f0ed744fd9c81f63

                                    SHA1

                                    704f00a1acc327fd879cf75fc90d0b8f927c36bc

                                    SHA256

                                    416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6

                                    SHA512

                                    790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb

                                  • C:\Users\Admin\AppData\Local\Temp\nsyF5F0.tmp\nsExec.dll

                                    Filesize

                                    6KB

                                    MD5

                                    132e6153717a7f9710dcea4536f364cd

                                    SHA1

                                    e39bc82c7602e6dd0797115c2bd12e872a5fb2ab

                                    SHA256

                                    d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2

                                    SHA512

                                    9aeb0b3051ce07fb9f03dfee7cea4a5e423425e48cb538173bd2a167817f867a30bd4d27d07875f27ca00031745b24547030b7f146660b049fa717590f1c77e1

                                  • C:\Users\Admin\AppData\Local\Temp\nsyF5F0.tmp\nsExec.dll

                                    Filesize

                                    6KB

                                    MD5

                                    132e6153717a7f9710dcea4536f364cd

                                    SHA1

                                    e39bc82c7602e6dd0797115c2bd12e872a5fb2ab

                                    SHA256

                                    d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2

                                    SHA512

                                    9aeb0b3051ce07fb9f03dfee7cea4a5e423425e48cb538173bd2a167817f867a30bd4d27d07875f27ca00031745b24547030b7f146660b049fa717590f1c77e1

                                  • C:\Users\Admin\AppData\Local\Temp\nsyF5F0.tmp\nsExec.dll

                                    Filesize

                                    6KB

                                    MD5

                                    132e6153717a7f9710dcea4536f364cd

                                    SHA1

                                    e39bc82c7602e6dd0797115c2bd12e872a5fb2ab

                                    SHA256

                                    d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2

                                    SHA512

                                    9aeb0b3051ce07fb9f03dfee7cea4a5e423425e48cb538173bd2a167817f867a30bd4d27d07875f27ca00031745b24547030b7f146660b049fa717590f1c77e1

                                  • C:\Users\Admin\AppData\Local\Temp\nsyF5F0.tmp\nsExec.dll

                                    Filesize

                                    6KB

                                    MD5

                                    132e6153717a7f9710dcea4536f364cd

                                    SHA1

                                    e39bc82c7602e6dd0797115c2bd12e872a5fb2ab

                                    SHA256

                                    d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2

                                    SHA512

                                    9aeb0b3051ce07fb9f03dfee7cea4a5e423425e48cb538173bd2a167817f867a30bd4d27d07875f27ca00031745b24547030b7f146660b049fa717590f1c77e1

                                  • C:\Users\Admin\AppData\Local\Temp\nsyF5F0.tmp\nsExec.dll

                                    Filesize

                                    6KB

                                    MD5

                                    132e6153717a7f9710dcea4536f364cd

                                    SHA1

                                    e39bc82c7602e6dd0797115c2bd12e872a5fb2ab

                                    SHA256

                                    d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2

                                    SHA512

                                    9aeb0b3051ce07fb9f03dfee7cea4a5e423425e48cb538173bd2a167817f867a30bd4d27d07875f27ca00031745b24547030b7f146660b049fa717590f1c77e1

                                  • C:\Users\Admin\AppData\Local\Temp\nsyF5F0.tmp\nsExec.dll

                                    Filesize

                                    6KB

                                    MD5

                                    132e6153717a7f9710dcea4536f364cd

                                    SHA1

                                    e39bc82c7602e6dd0797115c2bd12e872a5fb2ab

                                    SHA256

                                    d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2

                                    SHA512

                                    9aeb0b3051ce07fb9f03dfee7cea4a5e423425e48cb538173bd2a167817f867a30bd4d27d07875f27ca00031745b24547030b7f146660b049fa717590f1c77e1

                                  • C:\Users\Admin\AppData\Local\Temp\nsyF5F0.tmp\nsExec.dll

                                    Filesize

                                    6KB

                                    MD5

                                    132e6153717a7f9710dcea4536f364cd

                                    SHA1

                                    e39bc82c7602e6dd0797115c2bd12e872a5fb2ab

                                    SHA256

                                    d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2

                                    SHA512

                                    9aeb0b3051ce07fb9f03dfee7cea4a5e423425e48cb538173bd2a167817f867a30bd4d27d07875f27ca00031745b24547030b7f146660b049fa717590f1c77e1

                                  • C:\Users\Admin\AppData\Local\Temp\nsyF5F0.tmp\nsExec.dll

                                    Filesize

                                    6KB

                                    MD5

                                    132e6153717a7f9710dcea4536f364cd

                                    SHA1

                                    e39bc82c7602e6dd0797115c2bd12e872a5fb2ab

                                    SHA256

                                    d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2

                                    SHA512

                                    9aeb0b3051ce07fb9f03dfee7cea4a5e423425e48cb538173bd2a167817f867a30bd4d27d07875f27ca00031745b24547030b7f146660b049fa717590f1c77e1

                                  • C:\Users\Admin\AppData\Local\Temp\nsyF5F0.tmp\nsExec.dll

                                    Filesize

                                    6KB

                                    MD5

                                    132e6153717a7f9710dcea4536f364cd

                                    SHA1

                                    e39bc82c7602e6dd0797115c2bd12e872a5fb2ab

                                    SHA256

                                    d29afce2588d8dd7bb94c00ca91cac0e85b80ffa6b221f5ffcb83a2497228eb2

                                    SHA512

                                    9aeb0b3051ce07fb9f03dfee7cea4a5e423425e48cb538173bd2a167817f867a30bd4d27d07875f27ca00031745b24547030b7f146660b049fa717590f1c77e1

                                  • C:\Users\Admin\AppData\Local\Temp\nsyF5F0.tmp\rCrypt.dll

                                    Filesize

                                    283KB

                                    MD5

                                    b5887aa9fa99286a1b0692047a4bd24d

                                    SHA1

                                    d3d72b7516000788a749d567fb4dfb17e15d43a1

                                    SHA256

                                    9207951ffbe8e7633def52bac1d8923336874534a99ad1815d5eb64c83161bf8

                                    SHA512

                                    cd8f9179f741a7976d5f47b070b52a260c469500881a01a20be0929d3b6ea35c38476c19a19804f55c6f3d4c19eedd617c71ddc9bd8077f9b772a7ba30e59a3a

                                  • C:\Users\Admin\AppData\Local\Temp\nsyF5F0.tmp\stack.dll

                                    Filesize

                                    10KB

                                    MD5

                                    867af9bea8b24c78736bf8d0fdb5a78e

                                    SHA1

                                    05839fad98aa2bcd9f6ecb22de4816e0c75bf97d

                                    SHA256

                                    732164fb36f46dd23dafb6d7621531e70f1f81e2967b3053727ec7b5492d0ae9

                                    SHA512

                                    b7f54d52ff08b29a04b4f5887e6e3ae0e74fa45a86e55e0a4d362bc3603426c42c1d6a0b2fc2ef574bec0f6c7152de756ff48415e37ae6a7a9c296303562df4b

                                  • C:\Users\Admin\AppData\Local\Temp\nsyF5F0.tmp\stack.dll

                                    Filesize

                                    10KB

                                    MD5

                                    867af9bea8b24c78736bf8d0fdb5a78e

                                    SHA1

                                    05839fad98aa2bcd9f6ecb22de4816e0c75bf97d

                                    SHA256

                                    732164fb36f46dd23dafb6d7621531e70f1f81e2967b3053727ec7b5492d0ae9

                                    SHA512

                                    b7f54d52ff08b29a04b4f5887e6e3ae0e74fa45a86e55e0a4d362bc3603426c42c1d6a0b2fc2ef574bec0f6c7152de756ff48415e37ae6a7a9c296303562df4b

                                  • C:\Users\Admin\AppData\Local\Temp\nsyF5F0.tmp\xml.dll

                                    Filesize

                                    182KB

                                    MD5

                                    ebce8f5e440e0be57665e1e58dfb7425

                                    SHA1

                                    573dc1abd2b03512f390f569058fd2cf1d02ce91

                                    SHA256

                                    d1aaacc0aaf477b6b9f084697adcb444fc2333b32e8d99d224dca89516e762a7

                                    SHA512

                                    4786c9124973b6543d7291047d4c4a06c05282a3766212dbd3b8ce9b9560afddca20c491f791db2258c14ab767d5d3f480daa4706492949eae2ceb4a35aaef85

                                  • C:\Users\Admin\AppData\Local\Temp\nsyF5F0.tmp\xml.dll

                                    Filesize

                                    182KB

                                    MD5

                                    ebce8f5e440e0be57665e1e58dfb7425

                                    SHA1

                                    573dc1abd2b03512f390f569058fd2cf1d02ce91

                                    SHA256

                                    d1aaacc0aaf477b6b9f084697adcb444fc2333b32e8d99d224dca89516e762a7

                                    SHA512

                                    4786c9124973b6543d7291047d4c4a06c05282a3766212dbd3b8ce9b9560afddca20c491f791db2258c14ab767d5d3f480daa4706492949eae2ceb4a35aaef85

                                  • C:\Users\Admin\AppData\Local\Temp\nsyF5F0.tmp\xml.dll

                                    Filesize

                                    182KB

                                    MD5

                                    ebce8f5e440e0be57665e1e58dfb7425

                                    SHA1

                                    573dc1abd2b03512f390f569058fd2cf1d02ce91

                                    SHA256

                                    d1aaacc0aaf477b6b9f084697adcb444fc2333b32e8d99d224dca89516e762a7

                                    SHA512

                                    4786c9124973b6543d7291047d4c4a06c05282a3766212dbd3b8ce9b9560afddca20c491f791db2258c14ab767d5d3f480daa4706492949eae2ceb4a35aaef85

                                  • C:\Users\Admin\AppData\Local\Temp\nsyF5F0.tmp\xml.dll

                                    Filesize

                                    182KB

                                    MD5

                                    ebce8f5e440e0be57665e1e58dfb7425

                                    SHA1

                                    573dc1abd2b03512f390f569058fd2cf1d02ce91

                                    SHA256

                                    d1aaacc0aaf477b6b9f084697adcb444fc2333b32e8d99d224dca89516e762a7

                                    SHA512

                                    4786c9124973b6543d7291047d4c4a06c05282a3766212dbd3b8ce9b9560afddca20c491f791db2258c14ab767d5d3f480daa4706492949eae2ceb4a35aaef85

                                  • C:\Users\Admin\AppData\Local\Temp\sqlite3.exe

                                    Filesize

                                    477KB

                                    MD5

                                    91cdcea4be94624e198d3012f5442584

                                    SHA1

                                    fab4043494e4bb02efbaf72bcca86c01992d765c

                                    SHA256

                                    ca4c0f1ec0ccbc9988ea3f43ff73fe84228ffb4d76baddc386051dffe7ddd8c2

                                    SHA512

                                    74edd1e31517acaf4d367521df84e17bda0a60743852076bc2edbd9e634c810fb98a06b29562237dfd61fb98fec0e379c3ce5a86b361ed0f2594d10c1a93c11e

                                  • C:\Users\Admin\AppData\Local\Temp\sqlite3.exe

                                    Filesize

                                    477KB

                                    MD5

                                    91cdcea4be94624e198d3012f5442584

                                    SHA1

                                    fab4043494e4bb02efbaf72bcca86c01992d765c

                                    SHA256

                                    ca4c0f1ec0ccbc9988ea3f43ff73fe84228ffb4d76baddc386051dffe7ddd8c2

                                    SHA512

                                    74edd1e31517acaf4d367521df84e17bda0a60743852076bc2edbd9e634c810fb98a06b29562237dfd61fb98fec0e379c3ce5a86b361ed0f2594d10c1a93c11e

                                  • C:\Users\Admin\AppData\Local\Temp\sqlite3.exe

                                    Filesize

                                    477KB

                                    MD5

                                    91cdcea4be94624e198d3012f5442584

                                    SHA1

                                    fab4043494e4bb02efbaf72bcca86c01992d765c

                                    SHA256

                                    ca4c0f1ec0ccbc9988ea3f43ff73fe84228ffb4d76baddc386051dffe7ddd8c2

                                    SHA512

                                    74edd1e31517acaf4d367521df84e17bda0a60743852076bc2edbd9e634c810fb98a06b29562237dfd61fb98fec0e379c3ce5a86b361ed0f2594d10c1a93c11e

                                  • C:\Users\Admin\AppData\Local\Temp\sqlite3.exe

                                    Filesize

                                    477KB

                                    MD5

                                    91cdcea4be94624e198d3012f5442584

                                    SHA1

                                    fab4043494e4bb02efbaf72bcca86c01992d765c

                                    SHA256

                                    ca4c0f1ec0ccbc9988ea3f43ff73fe84228ffb4d76baddc386051dffe7ddd8c2

                                    SHA512

                                    74edd1e31517acaf4d367521df84e17bda0a60743852076bc2edbd9e634c810fb98a06b29562237dfd61fb98fec0e379c3ce5a86b361ed0f2594d10c1a93c11e

                                  • C:\Users\Admin\AppData\Local\Temp\sqlite3.exe

                                    Filesize

                                    477KB

                                    MD5

                                    91cdcea4be94624e198d3012f5442584

                                    SHA1

                                    fab4043494e4bb02efbaf72bcca86c01992d765c

                                    SHA256

                                    ca4c0f1ec0ccbc9988ea3f43ff73fe84228ffb4d76baddc386051dffe7ddd8c2

                                    SHA512

                                    74edd1e31517acaf4d367521df84e17bda0a60743852076bc2edbd9e634c810fb98a06b29562237dfd61fb98fec0e379c3ce5a86b361ed0f2594d10c1a93c11e

                                  • C:\Users\Admin\AppData\Local\Temp\sqlite3.exe

                                    Filesize

                                    477KB

                                    MD5

                                    91cdcea4be94624e198d3012f5442584

                                    SHA1

                                    fab4043494e4bb02efbaf72bcca86c01992d765c

                                    SHA256

                                    ca4c0f1ec0ccbc9988ea3f43ff73fe84228ffb4d76baddc386051dffe7ddd8c2

                                    SHA512

                                    74edd1e31517acaf4d367521df84e17bda0a60743852076bc2edbd9e634c810fb98a06b29562237dfd61fb98fec0e379c3ce5a86b361ed0f2594d10c1a93c11e

                                  • C:\Users\Admin\AppData\Local\Temp\sqlite3.exe

                                    Filesize

                                    477KB

                                    MD5

                                    91cdcea4be94624e198d3012f5442584

                                    SHA1

                                    fab4043494e4bb02efbaf72bcca86c01992d765c

                                    SHA256

                                    ca4c0f1ec0ccbc9988ea3f43ff73fe84228ffb4d76baddc386051dffe7ddd8c2

                                    SHA512

                                    74edd1e31517acaf4d367521df84e17bda0a60743852076bc2edbd9e634c810fb98a06b29562237dfd61fb98fec0e379c3ce5a86b361ed0f2594d10c1a93c11e

                                  • C:\Users\Admin\AppData\Local\Temp\sqlite3.exe

                                    Filesize

                                    477KB

                                    MD5

                                    91cdcea4be94624e198d3012f5442584

                                    SHA1

                                    fab4043494e4bb02efbaf72bcca86c01992d765c

                                    SHA256

                                    ca4c0f1ec0ccbc9988ea3f43ff73fe84228ffb4d76baddc386051dffe7ddd8c2

                                    SHA512

                                    74edd1e31517acaf4d367521df84e17bda0a60743852076bc2edbd9e634c810fb98a06b29562237dfd61fb98fec0e379c3ce5a86b361ed0f2594d10c1a93c11e

                                  • C:\Users\Admin\AppData\Local\Temp\sqlite3.exe

                                    Filesize

                                    477KB

                                    MD5

                                    91cdcea4be94624e198d3012f5442584

                                    SHA1

                                    fab4043494e4bb02efbaf72bcca86c01992d765c

                                    SHA256

                                    ca4c0f1ec0ccbc9988ea3f43ff73fe84228ffb4d76baddc386051dffe7ddd8c2

                                    SHA512

                                    74edd1e31517acaf4d367521df84e17bda0a60743852076bc2edbd9e634c810fb98a06b29562237dfd61fb98fec0e379c3ce5a86b361ed0f2594d10c1a93c11e

                                  • C:\Users\Admin\AppData\Local\Temp\sqlite3.exe

                                    Filesize

                                    477KB

                                    MD5

                                    91cdcea4be94624e198d3012f5442584

                                    SHA1

                                    fab4043494e4bb02efbaf72bcca86c01992d765c

                                    SHA256

                                    ca4c0f1ec0ccbc9988ea3f43ff73fe84228ffb4d76baddc386051dffe7ddd8c2

                                    SHA512

                                    74edd1e31517acaf4d367521df84e17bda0a60743852076bc2edbd9e634c810fb98a06b29562237dfd61fb98fec0e379c3ce5a86b361ed0f2594d10c1a93c11e

                                  • C:\Users\Admin\AppData\Local\Temp\sqlite3.exe

                                    Filesize

                                    477KB

                                    MD5

                                    91cdcea4be94624e198d3012f5442584

                                    SHA1

                                    fab4043494e4bb02efbaf72bcca86c01992d765c

                                    SHA256

                                    ca4c0f1ec0ccbc9988ea3f43ff73fe84228ffb4d76baddc386051dffe7ddd8c2

                                    SHA512

                                    74edd1e31517acaf4d367521df84e17bda0a60743852076bc2edbd9e634c810fb98a06b29562237dfd61fb98fec0e379c3ce5a86b361ed0f2594d10c1a93c11e

                                  • C:\Users\Admin\AppData\Local\Temp\sqlite3.exe

                                    Filesize

                                    477KB

                                    MD5

                                    91cdcea4be94624e198d3012f5442584

                                    SHA1

                                    fab4043494e4bb02efbaf72bcca86c01992d765c

                                    SHA256

                                    ca4c0f1ec0ccbc9988ea3f43ff73fe84228ffb4d76baddc386051dffe7ddd8c2

                                    SHA512

                                    74edd1e31517acaf4d367521df84e17bda0a60743852076bc2edbd9e634c810fb98a06b29562237dfd61fb98fec0e379c3ce5a86b361ed0f2594d10c1a93c11e

                                  • memory/100-240-0x0000000000000000-mapping.dmp

                                  • memory/224-204-0x0000000000000000-mapping.dmp

                                  • memory/256-242-0x0000000000000000-mapping.dmp

                                  • memory/256-203-0x0000000000000000-mapping.dmp

                                  • memory/256-271-0x0000000000000000-mapping.dmp

                                  • memory/260-150-0x0000000000000000-mapping.dmp

                                  • memory/260-245-0x0000000000000000-mapping.dmp

                                  • memory/496-166-0x0000000000000000-mapping.dmp

                                  • memory/564-173-0x0000000000000000-mapping.dmp

                                  • memory/632-261-0x0000000000000000-mapping.dmp

                                  • memory/692-214-0x0000000000000000-mapping.dmp

                                  • memory/772-269-0x0000000002720000-0x000000000272B000-memory.dmp

                                    Filesize

                                    44KB

                                  • memory/772-260-0x0000000000000000-mapping.dmp

                                  • memory/772-268-0x0000000002701000-0x0000000002703000-memory.dmp

                                    Filesize

                                    8KB

                                  • memory/776-274-0x0000000000000000-mapping.dmp

                                  • memory/932-177-0x0000000000000000-mapping.dmp

                                  • memory/932-277-0x0000000000000000-mapping.dmp

                                  • memory/1048-244-0x0000000000000000-mapping.dmp

                                  • memory/1076-241-0x0000000000000000-mapping.dmp

                                  • memory/1152-258-0x0000000000000000-mapping.dmp

                                  • memory/1192-161-0x0000000000000000-mapping.dmp

                                  • memory/1220-234-0x0000000000000000-mapping.dmp

                                  • memory/1572-250-0x0000000000000000-mapping.dmp

                                  • memory/1680-230-0x0000000000000000-mapping.dmp

                                  • memory/1772-198-0x0000000004D80000-0x0000000004D8B000-memory.dmp

                                    Filesize

                                    44KB

                                  • memory/1772-189-0x0000000004D70000-0x0000000004D7B000-memory.dmp

                                    Filesize

                                    44KB

                                  • memory/1772-186-0x0000000004D61000-0x0000000004D63000-memory.dmp

                                    Filesize

                                    8KB

                                  • memory/2068-267-0x0000000000000000-mapping.dmp

                                  • memory/2404-138-0x0000000000000000-mapping.dmp

                                  • memory/2672-276-0x0000000000000000-mapping.dmp

                                  • memory/2688-272-0x0000000000000000-mapping.dmp

                                  • memory/3012-263-0x0000000000000000-mapping.dmp

                                  • memory/3024-266-0x0000000000000000-mapping.dmp

                                  • memory/3352-247-0x0000000000000000-mapping.dmp

                                  • memory/3536-251-0x0000000000000000-mapping.dmp

                                  • memory/3576-284-0x0000000000000000-mapping.dmp

                                  • memory/3636-163-0x0000000000000000-mapping.dmp

                                  • memory/3656-248-0x0000000000000000-mapping.dmp

                                  • memory/3684-232-0x0000000000000000-mapping.dmp

                                  • memory/3888-265-0x0000000073A60000-0x0000000073A6B000-memory.dmp

                                    Filesize

                                    44KB

                                  • memory/3888-254-0x00000000024A1000-0x00000000024A3000-memory.dmp

                                    Filesize

                                    8KB

                                  • memory/3888-222-0x0000000000000000-mapping.dmp

                                  • memory/3888-256-0x0000000002600000-0x000000000260B000-memory.dmp

                                    Filesize

                                    44KB

                                  • memory/3888-255-0x00000000024B0000-0x00000000024BB000-memory.dmp

                                    Filesize

                                    44KB

                                  • memory/3888-252-0x0000000000000000-mapping.dmp

                                  • memory/3888-253-0x0000000073A60000-0x0000000073A6B000-memory.dmp

                                    Filesize

                                    44KB

                                  • memory/4052-152-0x0000000000000000-mapping.dmp

                                  • memory/4160-140-0x0000000000000000-mapping.dmp

                                  • memory/4244-231-0x0000000000000000-mapping.dmp

                                  • memory/4248-257-0x0000000000000000-mapping.dmp

                                  • memory/4304-176-0x0000000000000000-mapping.dmp

                                  • memory/4320-262-0x0000000000000000-mapping.dmp

                                  • memory/4328-155-0x0000000000000000-mapping.dmp

                                  • memory/4328-243-0x0000000000000000-mapping.dmp

                                  • memory/4352-147-0x0000000000000000-mapping.dmp

                                  • memory/4440-236-0x0000000000000000-mapping.dmp

                                  • memory/4472-144-0x0000000000000000-mapping.dmp

                                  • memory/4500-281-0x0000000000000000-mapping.dmp

                                  • memory/4500-283-0x0000024E4D328000-0x0000024E4D330000-memory.dmp

                                    Filesize

                                    32KB

                                  • memory/4508-233-0x0000000000000000-mapping.dmp

                                  • memory/4536-239-0x0000000000000000-mapping.dmp

                                  • memory/4536-278-0x00000000052F0000-0x00000000052FB000-memory.dmp

                                    Filesize

                                    44KB

                                  • memory/4536-273-0x0000000005000000-0x000000000500B000-memory.dmp

                                    Filesize

                                    44KB

                                  • memory/4612-235-0x0000000000000000-mapping.dmp

                                  • memory/4620-227-0x0000000000000000-mapping.dmp

                                  • memory/4684-183-0x0000000000000000-mapping.dmp

                                  • memory/4700-224-0x0000000000000000-mapping.dmp

                                  • memory/4732-172-0x0000000000000000-mapping.dmp

                                  • memory/4748-249-0x0000000000000000-mapping.dmp

                                  • memory/4760-219-0x0000000000000000-mapping.dmp

                                  • memory/4764-246-0x0000000000000000-mapping.dmp

                                  • memory/5004-215-0x0000000000000000-mapping.dmp

                                  • memory/5004-275-0x0000000000000000-mapping.dmp

                                  • memory/5008-169-0x0000000000000000-mapping.dmp

                                  • memory/5024-158-0x0000000000000000-mapping.dmp

                                  • memory/5088-264-0x0000000000000000-mapping.dmp

                                  • memory/5112-218-0x0000000000000000-mapping.dmp