Resubmissions

16/09/2022, 06:07

220916-gvaj4saeen 10

16/09/2022, 06:06

220916-gtp86segh5 1

16/09/2022, 05:24

220916-f36rvaaeal 10

15/09/2022, 08:38

220915-kj2e8scdh7 10

Analysis

  • max time kernel
    1714s
  • max time network
    1764s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    15/09/2022, 08:38

General

Malware Config

Extracted

Family

privateloader

C2

http://163.123.143.4/proxies.txt

http://107.182.129.251/server.txt

pastebin.com/raw/A7dSG1te

http://wfsdragon.ru/api/setStats.php

163.123.143.12

Attributes
  • payload_url

    https://vipsofts.xyz/files/mega.bmp

Extracted

Family

nymaim

C2

208.67.104.97

85.31.46.167

Extracted

Family

redline

Botnet

nam6.2

C2

103.89.90.61:34589

Attributes
  • auth_value

    4040fe7c77de89cf1a6f4cebd515c54c

Extracted

Family

redline

Botnet

ruzki14

C2

176.113.115.146:9582

Attributes
  • auth_value

    688c6d70531c05d3fba22723e72366f6

Extracted

Family

redline

Botnet

RRMoney

C2

81.161.229.243:28479

Attributes
  • auth_value

    c8bfeb3e3eb6477db90f28556d840227

Extracted

Family

redline

Botnet

3108_RUZKI

C2

213.219.247.199:9452

Attributes
  • auth_value

    f71fed1cd094e4e1eb7ad1c53e542bca

Signatures

  • NyMaim

    NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 22 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 18 IoCs
  • VMProtect packed file 7 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Checks BIOS information in registry 2 TTPs 6 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL 32 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 3 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 3 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 5 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 17 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 22 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\services.exe
    C:\Windows\system32\services.exe
    1⤵
      PID:464
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Drops file in System32 directory
        • Suspicious use of SetThreadContext
        • Drops file in Windows directory
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:876
        • C:\Windows\system32\taskeng.exe
          taskeng.exe {890262F1-15C7-4319-8A68-6B30BEC59A71} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]
          3⤵
            PID:96788
            • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
              C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
              4⤵
              • Identifies VirtualBox via ACPI registry values (likely anti-VM)
              • Executes dropped EXE
              • Checks BIOS information in registry
              • Checks whether UAC is enabled
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious behavior: EnumeratesProcesses
              PID:96824
              • C:\Windows\SysWOW64\schtasks.exe
                /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
                5⤵
                • Creates scheduled task(s)
                PID:97112
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k WspService
          2⤵
          • Drops file in System32 directory
          • Checks processor information in registry
          • Modifies data under HKEY_USERS
          • Modifies registry class
          • Suspicious behavior: GetForegroundWindowSpam
          PID:27340
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" https://www.dropbox.com/s/v74d5j0q01fe6uk/File.zip?dl=0
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1184
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1184 CREDAT:275457 /prefetch:2
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1040
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        1⤵
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:344
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6224f50,0x7fef6224f60,0x7fef6224f70
          2⤵
            PID:1424
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1008,18045848351276407770,12984344555971855142,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1040 /prefetch:2
            2⤵
              PID:1964
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1008,18045848351276407770,12984344555971855142,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1420 /prefetch:8
              2⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:2020
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1008,18045848351276407770,12984344555971855142,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1628 /prefetch:8
              2⤵
                PID:792
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,18045848351276407770,12984344555971855142,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1920 /prefetch:1
                2⤵
                  PID:1260
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,18045848351276407770,12984344555971855142,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2064 /prefetch:1
                  2⤵
                    PID:1576
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1008,18045848351276407770,12984344555971855142,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
                    2⤵
                      PID:1948
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1008,18045848351276407770,12984344555971855142,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3340 /prefetch:2
                      2⤵
                        PID:2064
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,18045848351276407770,12984344555971855142,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
                        2⤵
                          PID:2108
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1008,18045848351276407770,12984344555971855142,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3556 /prefetch:8
                          2⤵
                            PID:2172
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1008,18045848351276407770,12984344555971855142,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3672 /prefetch:8
                            2⤵
                              PID:2180
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,18045848351276407770,12984344555971855142,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3936 /prefetch:1
                              2⤵
                                PID:2252
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,18045848351276407770,12984344555971855142,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2312 /prefetch:1
                                2⤵
                                  PID:2364
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,18045848351276407770,12984344555971855142,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2064 /prefetch:1
                                  2⤵
                                    PID:2376
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,18045848351276407770,12984344555971855142,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:1
                                    2⤵
                                      PID:2520
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1008,18045848351276407770,12984344555971855142,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2196 /prefetch:8
                                      2⤵
                                        PID:2604
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1008,18045848351276407770,12984344555971855142,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=772 /prefetch:8
                                        2⤵
                                          PID:2756
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1008,18045848351276407770,12984344555971855142,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3148 /prefetch:8
                                          2⤵
                                            PID:2816
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1008,18045848351276407770,12984344555971855142,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2000 /prefetch:8
                                            2⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:2856
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1008,18045848351276407770,12984344555971855142,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4944 /prefetch:8
                                            2⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:2928
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1008,18045848351276407770,12984344555971855142,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4884 /prefetch:8
                                            2⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:2488
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1008,18045848351276407770,12984344555971855142,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1144 /prefetch:8
                                            2⤵
                                              PID:1732
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1008,18045848351276407770,12984344555971855142,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4852 /prefetch:8
                                              2⤵
                                                PID:2496
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1008,18045848351276407770,12984344555971855142,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1952 /prefetch:8
                                                2⤵
                                                  PID:2468
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1008,18045848351276407770,12984344555971855142,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4340 /prefetch:1
                                                  2⤵
                                                    PID:2936
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1008,18045848351276407770,12984344555971855142,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1988 /prefetch:8
                                                    2⤵
                                                      PID:95672
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1008,18045848351276407770,12984344555971855142,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4984 /prefetch:8
                                                      2⤵
                                                        PID:97388
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1008,18045848351276407770,12984344555971855142,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4900 /prefetch:8
                                                        2⤵
                                                          PID:97580
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1008,18045848351276407770,12984344555971855142,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=956 /prefetch:8
                                                          2⤵
                                                            PID:97860
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1008,18045848351276407770,12984344555971855142,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4920 /prefetch:8
                                                            2⤵
                                                              PID:98048
                                                          • C:\Users\Admin\Downloads\File\Install.exe
                                                            "C:\Users\Admin\Downloads\File\Install.exe"
                                                            1⤵
                                                            • Loads dropped DLL
                                                            • Drops file in System32 directory
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:2312
                                                            • C:\Users\Admin\Pictures\Minor Policy\cZjfA1Yau9Vz7mlJZRPpPin6.exe
                                                              "C:\Users\Admin\Pictures\Minor Policy\cZjfA1Yau9Vz7mlJZRPpPin6.exe"
                                                              2⤵
                                                              • Executes dropped EXE
                                                              PID:1908
                                                            • C:\Users\Admin\Pictures\Minor Policy\i3WuYYjN1Yt8MOTfFKSw3Zhq.exe
                                                              "C:\Users\Admin\Pictures\Minor Policy\i3WuYYjN1Yt8MOTfFKSw3Zhq.exe"
                                                              2⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Drops file in Program Files directory
                                                              PID:1356
                                                              • C:\Users\Admin\Documents\Tc84YgGqGmzo0kAYFltV4_B9.exe
                                                                "C:\Users\Admin\Documents\Tc84YgGqGmzo0kAYFltV4_B9.exe"
                                                                3⤵
                                                                • Executes dropped EXE
                                                                PID:1896
                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
                                                                3⤵
                                                                • Creates scheduled task(s)
                                                                PID:2344
                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
                                                                3⤵
                                                                • Creates scheduled task(s)
                                                                PID:2272
                                                            • C:\Users\Admin\Pictures\Minor Policy\CpxsH4xt09m1eSwF_g1_5PNd.exe
                                                              "C:\Users\Admin\Pictures\Minor Policy\CpxsH4xt09m1eSwF_g1_5PNd.exe"
                                                              2⤵
                                                              • Executes dropped EXE
                                                              PID:2040
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "C:\Windows\System32\cmd.exe" /c taskkill /im "CpxsH4xt09m1eSwF_g1_5PNd.exe" /f & erase "C:\Users\Admin\Pictures\Minor Policy\CpxsH4xt09m1eSwF_g1_5PNd.exe" & exit
                                                                3⤵
                                                                  PID:1960
                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                    taskkill /im "CpxsH4xt09m1eSwF_g1_5PNd.exe" /f
                                                                    4⤵
                                                                    • Kills process with taskkill
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:33032
                                                              • C:\Users\Admin\Pictures\Minor Policy\ph1FIBHzHfA3oymqQKyXNUo_.exe
                                                                "C:\Users\Admin\Pictures\Minor Policy\ph1FIBHzHfA3oymqQKyXNUo_.exe"
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetThreadContext
                                                                PID:2820
                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                  "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"
                                                                  3⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:96248
                                                              • C:\Users\Admin\Pictures\Minor Policy\IEQIdWzfqeUO0KTNHcfxQ9bw.exe
                                                                "C:\Users\Admin\Pictures\Minor Policy\IEQIdWzfqeUO0KTNHcfxQ9bw.exe"
                                                                2⤵
                                                                • Executes dropped EXE
                                                                PID:732
                                                                • C:\Windows\SysWOW64\regsvr32.exe
                                                                  "C:\Windows\System32\regsvr32.exe" /S .\Ovo~u1.sQ -U
                                                                  3⤵
                                                                  • Loads dropped DLL
                                                                  PID:36332
                                                              • C:\Users\Admin\Pictures\Minor Policy\54P1DY7v51CgYA4uIaZFVWYr.exe
                                                                "C:\Users\Admin\Pictures\Minor Policy\54P1DY7v51CgYA4uIaZFVWYr.exe"
                                                                2⤵
                                                                • Executes dropped EXE
                                                                PID:2376
                                                                • C:\Windows\system32\WerFault.exe
                                                                  C:\Windows\system32\WerFault.exe -u -p 2376 -s 100
                                                                  3⤵
                                                                  • Loads dropped DLL
                                                                  • Program crash
                                                                  PID:2752
                                                              • C:\Users\Admin\Pictures\Minor Policy\sNwYFN7Re21w68FjfjcvIeqm.exe
                                                                "C:\Users\Admin\Pictures\Minor Policy\sNwYFN7Re21w68FjfjcvIeqm.exe"
                                                                2⤵
                                                                • Executes dropped EXE
                                                                PID:2216
                                                                • C:\Users\Admin\Pictures\Minor Policy\sNwYFN7Re21w68FjfjcvIeqm.exe
                                                                  "C:\Users\Admin\Pictures\Minor Policy\sNwYFN7Re21w68FjfjcvIeqm.exe" -h
                                                                  3⤵
                                                                  • Executes dropped EXE
                                                                  PID:17808
                                                              • C:\Users\Admin\Pictures\Minor Policy\WqNapljhuuFNZUAkzoUgfSgO.exe
                                                                "C:\Users\Admin\Pictures\Minor Policy\WqNapljhuuFNZUAkzoUgfSgO.exe"
                                                                2⤵
                                                                • Executes dropped EXE
                                                                PID:2356
                                                              • C:\Users\Admin\Pictures\Minor Policy\Cs9NC3GxUtmHhUHLuY2Je4m1.exe
                                                                "C:\Users\Admin\Pictures\Minor Policy\Cs9NC3GxUtmHhUHLuY2Je4m1.exe"
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetThreadContext
                                                                PID:2504
                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                                                                  3⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:112440
                                                              • C:\Users\Admin\Pictures\Minor Policy\Vez51LgGQ2cTTu8mGc0PrYXY.exe
                                                                "C:\Users\Admin\Pictures\Minor Policy\Vez51LgGQ2cTTu8mGc0PrYXY.exe"
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:1732
                                                              • C:\Users\Admin\Pictures\Minor Policy\KEZKWuipCn00Eig_gFQCvfnK.exe
                                                                "C:\Users\Admin\Pictures\Minor Policy\KEZKWuipCn00Eig_gFQCvfnK.exe"
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:2484
                                                                • C:\Users\Admin\AppData\Local\Temp\Updater.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\Updater.exe"
                                                                  3⤵
                                                                  • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                  • Executes dropped EXE
                                                                  • Checks BIOS information in registry
                                                                  • Checks whether UAC is enabled
                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:95776
                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                    /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
                                                                    4⤵
                                                                    • Creates scheduled task(s)
                                                                    PID:96332
                                                              • C:\Users\Admin\Pictures\Minor Policy\xNCErmKh28u5VQmrJvo1CtRO.exe
                                                                "C:\Users\Admin\Pictures\Minor Policy\xNCErmKh28u5VQmrJvo1CtRO.exe"
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetThreadContext
                                                                PID:2900
                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
                                                                  3⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:94756
                                                              • C:\Users\Admin\Pictures\Minor Policy\gF1KFuFn04BBtLWwzHtVpG_4.exe
                                                                "C:\Users\Admin\Pictures\Minor Policy\gF1KFuFn04BBtLWwzHtVpG_4.exe"
                                                                2⤵
                                                                • Executes dropped EXE
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:2880
                                                              • C:\Users\Admin\Pictures\Minor Policy\BGknlUQLE7PyueItynID0QG0.exe
                                                                "C:\Users\Admin\Pictures\Minor Policy\BGknlUQLE7PyueItynID0QG0.exe"
                                                                2⤵
                                                                • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                                                • Executes dropped EXE
                                                                • Checks BIOS information in registry
                                                                • Checks whether UAC is enabled
                                                                • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                PID:2908
                                                            • C:\Windows\system32\rundll32.exe
                                                              rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
                                                              1⤵
                                                              • Process spawned unexpected child process
                                                              PID:27020
                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
                                                                2⤵
                                                                • Loads dropped DLL
                                                                • Modifies registry class
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:27092
                                                            • C:\Windows\system32\taskmgr.exe
                                                              "C:\Windows\system32\taskmgr.exe" /4
                                                              1⤵
                                                              • Loads dropped DLL
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious behavior: GetForegroundWindowSpam
                                                              PID:97264

                                                            Network

                                                            MITRE ATT&CK Enterprise v6

                                                            Replay Monitor

                                                            Loading Replay Monitor...

                                                            Downloads

                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

                                                              Filesize

                                                              1KB

                                                              MD5

                                                              2f82f0c5da898f7895c974bb2dcf8827

                                                              SHA1

                                                              901132937e72629ba440ae21290812b0cb208617

                                                              SHA256

                                                              66e64c7a254e419172d039df54e005895892376ec3e7dbb09391d8cbc3451ee9

                                                              SHA512

                                                              dd66ebb5cdc32fe1d76057c9359c6520b0147fe1762494f36aa9a4f1ee479a2a1a8f644c5782f11c2a74526bb6161d530037daa639bdc9cfea0ab7c571da7ec9

                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\35DDEDF268117918D1D277A171D8DF7B_72E9B602DBBE8F382B48D98F49AE6328

                                                              Filesize

                                                              471B

                                                              MD5

                                                              cff5ad58b3105b5ab17e81ffe2b69007

                                                              SHA1

                                                              c3f9d9cb5dbd155fb6948a7a035c9344aa914ae4

                                                              SHA256

                                                              08e8ae7111d6cb807b4dd3d73eb3faab5984b38beeb239655e2a5b45a76688c5

                                                              SHA512

                                                              5dc55f6198b3f53e53cdcea6a1e5ec017ee04a55fb8fe78ceb26a90d0329c8bc488c9c0864ab2197c3c3de4d2a7a3f3c77f39578312241fc34758ae851c89e40

                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

                                                              Filesize

                                                              471B

                                                              MD5

                                                              b98ab820b3f99b4cc31656d5160564e4

                                                              SHA1

                                                              41d156bde9de3cc9f9f4c5659d947474c7c1007b

                                                              SHA256

                                                              897b47ec49bf138fa05bc468e74e4bc5844c64b602e49e5606b1c768e9b79cf9

                                                              SHA512

                                                              6c9fd07d4bb06228298a703fe8e17b948faffb70357290fe99ca355ebfee661f422df6091f8011300e31d04b8a1ff85d35d924ef71487ae9808d8214c7f7bd7c

                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB

                                                              Filesize

                                                              471B

                                                              MD5

                                                              ea358883eec0d542ebd2e703426e7041

                                                              SHA1

                                                              47dc817751733ae2d89d298b4447f1d4cb5d698b

                                                              SHA256

                                                              3d5627509ad772ad27de7b390e45b27b69e9d05286d9564fd5711aa0e8d5aabd

                                                              SHA512

                                                              1995c46f1a06a3a6ec690099320d9a1e51b6f0b80ea7ff4ae5558ecf1bf50cf988a5cfe345db8389fee3bdf0cce72b004da60efde5d0c723488aaedbd541f7f4

                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

                                                              Filesize

                                                              410B

                                                              MD5

                                                              e59d1c97141111069c0a8d8d63ab8897

                                                              SHA1

                                                              742ac9749d1f779cad425f98102e070611e53a9d

                                                              SHA256

                                                              da72017a54bf6ad2605eb34c38d6da8deb12c6af6346656b9ec6ac765ca24583

                                                              SHA512

                                                              0fdac1f53cd7ed8bc43cb427bf91ece3011db5086fa3d96f270d6389fe0a45446a9681daa6bb5d9107851af6d346a762ab644447efcbdc359e8b9bacfb3b2473

                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\35DDEDF268117918D1D277A171D8DF7B_72E9B602DBBE8F382B48D98F49AE6328

                                                              Filesize

                                                              408B

                                                              MD5

                                                              b969ad591cb97d78f705e5f67c6b6223

                                                              SHA1

                                                              f365a56930c4679acca717c6b22373ef6738722d

                                                              SHA256

                                                              f65cd7fcaa6bae7cc0fb84a2ea0453f1bcd0dcd18d074c8f8e05396e26962d30

                                                              SHA512

                                                              ca0d1c6fdf0b463b77fcd4955e43d75b694e2be1db6371bbe208af8373c9f2da44aa1286736d8e9d43fa255aedecfc52ed896b50cd29795141784a0c379a50ce

                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                              Filesize

                                                              344B

                                                              MD5

                                                              f41ca613098dac137e1befdca3e0c32d

                                                              SHA1

                                                              ec43c5b496cd8856758ebe597da97216f3327e14

                                                              SHA256

                                                              088449154cb0579849d0b5cbd1ce8f01257601046299766738ba16e0ca4e59ce

                                                              SHA512

                                                              d5e4401c8b203d0571abe1f59feda5c7593a6ff571c7ac09efc9869a59055a3fa35127199877739453b6d0c8a9c58b7aa4153e24a223030866366008aa66339a

                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                              Filesize

                                                              344B

                                                              MD5

                                                              479a353ed86730750231eb9e4af6e30f

                                                              SHA1

                                                              9041cf040a21985950a863be1c52edf6078889e0

                                                              SHA256

                                                              b70e4fdbd445d647fc78700b2d7a93024ee9c7cca53d5acb8d863da28d995023

                                                              SHA512

                                                              813d5516b5919183f47b43d9ede30af91dba9cec34d71d66033e881837e5838e31e8873cb1f4792d5eee182ef355c48c7a13991e8c02ec3020bd7226b5c2a14c

                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

                                                              Filesize

                                                              400B

                                                              MD5

                                                              266d57e7adb08c35bc2e81be51018767

                                                              SHA1

                                                              84d2c45083f4ccfdf28a3c3c1694688d65ec95d5

                                                              SHA256

                                                              4ce7e101cf0438e08e8c50c3f83a27d0d4f8ee790c259c18ab6bc9cf4416afdd

                                                              SHA512

                                                              069d2dfd602fb35cfea46ba2cb9ca2600b1e80b5bebeaed29f42915c0b418406e9937358eb7ac789d9f6428c15d4a5cd318e0e17d3fbf1037ab50b917fb449eb

                                                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EDC238BFF48A31D55A97E1E93892934B_C20E0DA2D0F89FE526E1490F4A2EE5AB

                                                              Filesize

                                                              396B

                                                              MD5

                                                              a279b20701bed4f1cf2a5f0c6eb23267

                                                              SHA1

                                                              8eaa6994f580d788e19595e43b0ad49a524588f2

                                                              SHA256

                                                              8b0ba6acf586c4f4f78707c2ff2d886a09aa299c08daa67b912772bbb7b3d9e5

                                                              SHA512

                                                              0d4b7302570fa7c928728bd3f81925fa74970c04eac1cdd50a768aa63c3af3edd21ab82ac8ab23453df11a1cb6863d223a7746b889fc1394dbee16123607ea00

                                                            • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\XK06LDQA.txt

                                                              Filesize

                                                              608B

                                                              MD5

                                                              c8d2606fbb3631562bb7993fef55fbec

                                                              SHA1

                                                              6d71afeb07e8e60ddb188b70e237d9ad1467317d

                                                              SHA256

                                                              345559b9b7ecc4fd4b1779038794e3d65387a359704ee0c4f4651d0558b0a62d

                                                              SHA512

                                                              1f9d4bfa24ad31b94ed7a92fc1c0dc1ba9f02c9608b40695a8d056e8e7428e4cad0856faa0d05bdc9d4dd57a1906d614c05713fa1661cf72c1dc88f379733fbe

                                                            • C:\Users\Admin\Pictures\Minor Policy\54P1DY7v51CgYA4uIaZFVWYr.exe

                                                              Filesize

                                                              3.5MB

                                                              MD5

                                                              1052035ac557a9deda0fc39038159d23

                                                              SHA1

                                                              ff12bc2d43224b3ac06f017243961cdf7088045f

                                                              SHA256

                                                              6da85e0e847a77dc8e91dd59937d136e9a2f4e3f8bdd364d75e88b9149ea6ad3

                                                              SHA512

                                                              d260cc7bf3585a098e6b93734208c536c225d77d5a69fefb40cd6c0820efab70dbd6c78ff4f95dfb8909b5c0a1f3b3f1274665460b36cdd9cb3e07a9c0fc8788

                                                            • C:\Users\Admin\Pictures\Minor Policy\CpxsH4xt09m1eSwF_g1_5PNd.exe

                                                              Filesize

                                                              341KB

                                                              MD5

                                                              c2b0d011647bc38575ab8531195ba70c

                                                              SHA1

                                                              9f73e32a01c57bb1b9de75db3a8f0be6fc69bef8

                                                              SHA256

                                                              96e4cd33506a7cac32f459e8ce2062bb9f8b5b32c8b9270710c1d141273cd867

                                                              SHA512

                                                              9295421938560e46c2fa0a3125c4d297fb21e3274bea72530dcd0174a83776f067cfe660ccfe15d59b573282f200b305ce2b0ab372cbf2e1779d85dab1ae7699

                                                            • C:\Users\Admin\Pictures\Minor Policy\IEQIdWzfqeUO0KTNHcfxQ9bw.exe

                                                              Filesize

                                                              1.9MB

                                                              MD5

                                                              36a0b52d5646ee2ab92f1134d1f126ad

                                                              SHA1

                                                              ceaecb2a297e3ec37c69ed61f32a123835b0b83d

                                                              SHA256

                                                              1e601e2f1db7e2256431116f16d8fbb2033c48e5a7179a51a51c234569600835

                                                              SHA512

                                                              c0347b593a979639606989592e8b755e4d26610a32467e1b477b67c230f357a6bd8ebd61efdbd9e849a102f373b2436c4edc9fd0eb8cdb1a59959d9485c2cd92

                                                            • C:\Users\Admin\Pictures\Minor Policy\cZjfA1Yau9Vz7mlJZRPpPin6.exe

                                                              Filesize

                                                              382KB

                                                              MD5

                                                              9b57e42650ac3801c41097a7a67c8797

                                                              SHA1

                                                              047b845b1fe47b819de4b31ade6e504aa0288e06

                                                              SHA256

                                                              322f8b985672fe452211e1299a29037be69a9b467e8a8cdcad02afd0835e1dee

                                                              SHA512

                                                              2361e69ad10dd9c75c732bcbbc01edf85b3bb0b07b357718e27657576a04d468cfc7a17c427e4cb8a3a3999c589077dd87fc3404a5bdde41de03278aba54ba85

                                                            • C:\Users\Admin\Pictures\Minor Policy\i3WuYYjN1Yt8MOTfFKSw3Zhq.exe

                                                              Filesize

                                                              400KB

                                                              MD5

                                                              9519c85c644869f182927d93e8e25a33

                                                              SHA1

                                                              eadc9026e041f7013056f80e068ecf95940ea060

                                                              SHA256

                                                              f0dc8fa1a18901ac46f4448e434c3885a456865a3a309840a1c4ac67fd56895b

                                                              SHA512

                                                              dcc1dd25bba19aaf75ec4a1a69dc215eb519e9ee3b8f7b1bd16164b736b3aa81389c076ed4e8a17a1cbfaec2e0b3155df039d1bca3c7186cfeb9950369bccf23

                                                            • C:\Users\Admin\Pictures\Minor Policy\i3WuYYjN1Yt8MOTfFKSw3Zhq.exe

                                                              Filesize

                                                              400KB

                                                              MD5

                                                              9519c85c644869f182927d93e8e25a33

                                                              SHA1

                                                              eadc9026e041f7013056f80e068ecf95940ea060

                                                              SHA256

                                                              f0dc8fa1a18901ac46f4448e434c3885a456865a3a309840a1c4ac67fd56895b

                                                              SHA512

                                                              dcc1dd25bba19aaf75ec4a1a69dc215eb519e9ee3b8f7b1bd16164b736b3aa81389c076ed4e8a17a1cbfaec2e0b3155df039d1bca3c7186cfeb9950369bccf23

                                                            • C:\Users\Admin\Pictures\Minor Policy\ph1FIBHzHfA3oymqQKyXNUo_.exe

                                                              Filesize

                                                              3.8MB

                                                              MD5

                                                              cd6124575280dd513412db5bd233d32a

                                                              SHA1

                                                              a99cd43c0cf24a8379f74d32ca81067d502b0914

                                                              SHA256

                                                              dfafcfd68e719844dd2b7626752cbf7c818e9de768fee5e5888d94e242baeabf

                                                              SHA512

                                                              e5a1f17913ceecc6a58f6b41b606718594bcaff033e717102f1698992dffb988b82daa2e70b8a1ac335d11b7fcdd85d163f7180a8f614b38b8741a936ee46717

                                                            • C:\Users\Admin\Pictures\Minor Policy\ph1FIBHzHfA3oymqQKyXNUo_.exe

                                                              Filesize

                                                              3.8MB

                                                              MD5

                                                              cd6124575280dd513412db5bd233d32a

                                                              SHA1

                                                              a99cd43c0cf24a8379f74d32ca81067d502b0914

                                                              SHA256

                                                              dfafcfd68e719844dd2b7626752cbf7c818e9de768fee5e5888d94e242baeabf

                                                              SHA512

                                                              e5a1f17913ceecc6a58f6b41b606718594bcaff033e717102f1698992dffb988b82daa2e70b8a1ac335d11b7fcdd85d163f7180a8f614b38b8741a936ee46717

                                                            • \Users\Admin\Pictures\Minor Policy\54P1DY7v51CgYA4uIaZFVWYr.exe

                                                              Filesize

                                                              3.5MB

                                                              MD5

                                                              1052035ac557a9deda0fc39038159d23

                                                              SHA1

                                                              ff12bc2d43224b3ac06f017243961cdf7088045f

                                                              SHA256

                                                              6da85e0e847a77dc8e91dd59937d136e9a2f4e3f8bdd364d75e88b9149ea6ad3

                                                              SHA512

                                                              d260cc7bf3585a098e6b93734208c536c225d77d5a69fefb40cd6c0820efab70dbd6c78ff4f95dfb8909b5c0a1f3b3f1274665460b36cdd9cb3e07a9c0fc8788

                                                            • \Users\Admin\Pictures\Minor Policy\54P1DY7v51CgYA4uIaZFVWYr.exe

                                                              Filesize

                                                              3.5MB

                                                              MD5

                                                              1052035ac557a9deda0fc39038159d23

                                                              SHA1

                                                              ff12bc2d43224b3ac06f017243961cdf7088045f

                                                              SHA256

                                                              6da85e0e847a77dc8e91dd59937d136e9a2f4e3f8bdd364d75e88b9149ea6ad3

                                                              SHA512

                                                              d260cc7bf3585a098e6b93734208c536c225d77d5a69fefb40cd6c0820efab70dbd6c78ff4f95dfb8909b5c0a1f3b3f1274665460b36cdd9cb3e07a9c0fc8788

                                                            • \Users\Admin\Pictures\Minor Policy\54P1DY7v51CgYA4uIaZFVWYr.exe

                                                              Filesize

                                                              3.5MB

                                                              MD5

                                                              1052035ac557a9deda0fc39038159d23

                                                              SHA1

                                                              ff12bc2d43224b3ac06f017243961cdf7088045f

                                                              SHA256

                                                              6da85e0e847a77dc8e91dd59937d136e9a2f4e3f8bdd364d75e88b9149ea6ad3

                                                              SHA512

                                                              d260cc7bf3585a098e6b93734208c536c225d77d5a69fefb40cd6c0820efab70dbd6c78ff4f95dfb8909b5c0a1f3b3f1274665460b36cdd9cb3e07a9c0fc8788

                                                            • \Users\Admin\Pictures\Minor Policy\54P1DY7v51CgYA4uIaZFVWYr.exe

                                                              Filesize

                                                              3.5MB

                                                              MD5

                                                              1052035ac557a9deda0fc39038159d23

                                                              SHA1

                                                              ff12bc2d43224b3ac06f017243961cdf7088045f

                                                              SHA256

                                                              6da85e0e847a77dc8e91dd59937d136e9a2f4e3f8bdd364d75e88b9149ea6ad3

                                                              SHA512

                                                              d260cc7bf3585a098e6b93734208c536c225d77d5a69fefb40cd6c0820efab70dbd6c78ff4f95dfb8909b5c0a1f3b3f1274665460b36cdd9cb3e07a9c0fc8788

                                                            • \Users\Admin\Pictures\Minor Policy\54P1DY7v51CgYA4uIaZFVWYr.exe

                                                              Filesize

                                                              3.5MB

                                                              MD5

                                                              1052035ac557a9deda0fc39038159d23

                                                              SHA1

                                                              ff12bc2d43224b3ac06f017243961cdf7088045f

                                                              SHA256

                                                              6da85e0e847a77dc8e91dd59937d136e9a2f4e3f8bdd364d75e88b9149ea6ad3

                                                              SHA512

                                                              d260cc7bf3585a098e6b93734208c536c225d77d5a69fefb40cd6c0820efab70dbd6c78ff4f95dfb8909b5c0a1f3b3f1274665460b36cdd9cb3e07a9c0fc8788

                                                            • \Users\Admin\Pictures\Minor Policy\BGknlUQLE7PyueItynID0QG0.exe

                                                              Filesize

                                                              4.6MB

                                                              MD5

                                                              488ed95ee5ce3db2f1bb19959b09a421

                                                              SHA1

                                                              31cb520b2fb333c9b2e6f410b1ae9d465275db6e

                                                              SHA256

                                                              665586b871e206ad81dcd24ca088cde672a618185182a0736c2ab7cad77a5a58

                                                              SHA512

                                                              280dc9e12d765fd7f62d8da5655d9dc4320dc3bd9bc79c4e13d701bb00d5b243cd755d65272ca07c0731000943b580baac5af835741cb7da898db21a8c2729cc

                                                            • \Users\Admin\Pictures\Minor Policy\CpxsH4xt09m1eSwF_g1_5PNd.exe

                                                              Filesize

                                                              341KB

                                                              MD5

                                                              c2b0d011647bc38575ab8531195ba70c

                                                              SHA1

                                                              9f73e32a01c57bb1b9de75db3a8f0be6fc69bef8

                                                              SHA256

                                                              96e4cd33506a7cac32f459e8ce2062bb9f8b5b32c8b9270710c1d141273cd867

                                                              SHA512

                                                              9295421938560e46c2fa0a3125c4d297fb21e3274bea72530dcd0174a83776f067cfe660ccfe15d59b573282f200b305ce2b0ab372cbf2e1779d85dab1ae7699

                                                            • \Users\Admin\Pictures\Minor Policy\CpxsH4xt09m1eSwF_g1_5PNd.exe

                                                              Filesize

                                                              341KB

                                                              MD5

                                                              c2b0d011647bc38575ab8531195ba70c

                                                              SHA1

                                                              9f73e32a01c57bb1b9de75db3a8f0be6fc69bef8

                                                              SHA256

                                                              96e4cd33506a7cac32f459e8ce2062bb9f8b5b32c8b9270710c1d141273cd867

                                                              SHA512

                                                              9295421938560e46c2fa0a3125c4d297fb21e3274bea72530dcd0174a83776f067cfe660ccfe15d59b573282f200b305ce2b0ab372cbf2e1779d85dab1ae7699

                                                            • \Users\Admin\Pictures\Minor Policy\Cs9NC3GxUtmHhUHLuY2Je4m1.exe

                                                              Filesize

                                                              1.5MB

                                                              MD5

                                                              b2490e41f089cd37b69ca7e9f7866552

                                                              SHA1

                                                              54b5293f55843582a10da5566b67f92d301fc3e9

                                                              SHA256

                                                              59e899850342fd8cec14c516dddf3394fe846f043b0959e3daa856969454587f

                                                              SHA512

                                                              af6f06aff683ac0a907110100e138c563b83b44c5f51a1530425c76c310c92071e72b0f32fdeec539003a9507ed7db6f055cbc4c072c401a833e48d750b71b7f

                                                            • \Users\Admin\Pictures\Minor Policy\IEQIdWzfqeUO0KTNHcfxQ9bw.exe

                                                              Filesize

                                                              1.9MB

                                                              MD5

                                                              36a0b52d5646ee2ab92f1134d1f126ad

                                                              SHA1

                                                              ceaecb2a297e3ec37c69ed61f32a123835b0b83d

                                                              SHA256

                                                              1e601e2f1db7e2256431116f16d8fbb2033c48e5a7179a51a51c234569600835

                                                              SHA512

                                                              c0347b593a979639606989592e8b755e4d26610a32467e1b477b67c230f357a6bd8ebd61efdbd9e849a102f373b2436c4edc9fd0eb8cdb1a59959d9485c2cd92

                                                            • \Users\Admin\Pictures\Minor Policy\KEZKWuipCn00Eig_gFQCvfnK.exe

                                                              Filesize

                                                              4.5MB

                                                              MD5

                                                              bb6d7034fdf78ba8c3aabeb9373609fc

                                                              SHA1

                                                              9fe99724e83e83d1bc1c9619e03c7738e76b86ae

                                                              SHA256

                                                              21037a51be5cb0df608545d07be89cad1948d0f4f02c607410f48dc8bccf5df5

                                                              SHA512

                                                              8814b71b52f1b868cac0d936b4afe49b0538fd7bcee3030b9a9cbde82d8c761c9321ec591bde4e7386e77012c6b33f3c1d3bebc6ccdd3a9198b1059be9d2d29b

                                                            • \Users\Admin\Pictures\Minor Policy\Vez51LgGQ2cTTu8mGc0PrYXY.exe

                                                              Filesize

                                                              4.5MB

                                                              MD5

                                                              140add24a025fce67149c992b1d57d41

                                                              SHA1

                                                              77fe8596d0c9f8243fc026be9049464b91cceeff

                                                              SHA256

                                                              4d8faa87daf25e68ad293923d1878400f0ffb4bd6599591bf4c7d89421912de3

                                                              SHA512

                                                              ee5ce78d2ca75e03933819071866e3233216ea9120b9c301ed4bf73a91c7e094a1fde9b26d318fa61e622cb244738a21ac8516b7f5ccdc01b63c52793bcaf6bb

                                                            • \Users\Admin\Pictures\Minor Policy\WqNapljhuuFNZUAkzoUgfSgO.exe

                                                              Filesize

                                                              258KB

                                                              MD5

                                                              41d38523fc8d1c92d163ab98d44df332

                                                              SHA1

                                                              1cfedd3c872e579b200b11809e9e655ff3547ef9

                                                              SHA256

                                                              08e913af4a86466aea86203b3a75fe51cf8765fd72c76f8f9a402d42d61c70e2

                                                              SHA512

                                                              a472bd34f416157a064939560df142a173324ff28fdf21a0ac6d42f4c195301147d0d8667d808dbde08619d9b56a44f85b478b8e5ef2f18d333914167823a6bd

                                                            • \Users\Admin\Pictures\Minor Policy\WqNapljhuuFNZUAkzoUgfSgO.exe

                                                              Filesize

                                                              258KB

                                                              MD5

                                                              41d38523fc8d1c92d163ab98d44df332

                                                              SHA1

                                                              1cfedd3c872e579b200b11809e9e655ff3547ef9

                                                              SHA256

                                                              08e913af4a86466aea86203b3a75fe51cf8765fd72c76f8f9a402d42d61c70e2

                                                              SHA512

                                                              a472bd34f416157a064939560df142a173324ff28fdf21a0ac6d42f4c195301147d0d8667d808dbde08619d9b56a44f85b478b8e5ef2f18d333914167823a6bd

                                                            • \Users\Admin\Pictures\Minor Policy\cZjfA1Yau9Vz7mlJZRPpPin6.exe

                                                              Filesize

                                                              382KB

                                                              MD5

                                                              9b57e42650ac3801c41097a7a67c8797

                                                              SHA1

                                                              047b845b1fe47b819de4b31ade6e504aa0288e06

                                                              SHA256

                                                              322f8b985672fe452211e1299a29037be69a9b467e8a8cdcad02afd0835e1dee

                                                              SHA512

                                                              2361e69ad10dd9c75c732bcbbc01edf85b3bb0b07b357718e27657576a04d468cfc7a17c427e4cb8a3a3999c589077dd87fc3404a5bdde41de03278aba54ba85

                                                            • \Users\Admin\Pictures\Minor Policy\gF1KFuFn04BBtLWwzHtVpG_4.exe

                                                              Filesize

                                                              137KB

                                                              MD5

                                                              1cd36877d5e6e6fafa38f1c9f21cedf3

                                                              SHA1

                                                              e02d4dfad2a1a82a5bc5f6125bb421a02c42d363

                                                              SHA256

                                                              d273fc08938b54321f5d01dfa9200573efdf9d6fb9a2daf038aedd9d1f85ad65

                                                              SHA512

                                                              98756c55b5a2d2497c854edd0a8b47cd36a22467280989ab3cc520b68307d08f91346f594453c6bbba73d296faca46bc7d996caf3fb0e261587efbb6c207569a

                                                            • \Users\Admin\Pictures\Minor Policy\i3WuYYjN1Yt8MOTfFKSw3Zhq.exe

                                                              Filesize

                                                              400KB

                                                              MD5

                                                              9519c85c644869f182927d93e8e25a33

                                                              SHA1

                                                              eadc9026e041f7013056f80e068ecf95940ea060

                                                              SHA256

                                                              f0dc8fa1a18901ac46f4448e434c3885a456865a3a309840a1c4ac67fd56895b

                                                              SHA512

                                                              dcc1dd25bba19aaf75ec4a1a69dc215eb519e9ee3b8f7b1bd16164b736b3aa81389c076ed4e8a17a1cbfaec2e0b3155df039d1bca3c7186cfeb9950369bccf23

                                                            • \Users\Admin\Pictures\Minor Policy\ph1FIBHzHfA3oymqQKyXNUo_.exe

                                                              Filesize

                                                              3.8MB

                                                              MD5

                                                              cd6124575280dd513412db5bd233d32a

                                                              SHA1

                                                              a99cd43c0cf24a8379f74d32ca81067d502b0914

                                                              SHA256

                                                              dfafcfd68e719844dd2b7626752cbf7c818e9de768fee5e5888d94e242baeabf

                                                              SHA512

                                                              e5a1f17913ceecc6a58f6b41b606718594bcaff033e717102f1698992dffb988b82daa2e70b8a1ac335d11b7fcdd85d163f7180a8f614b38b8741a936ee46717

                                                            • \Users\Admin\Pictures\Minor Policy\sNwYFN7Re21w68FjfjcvIeqm.exe

                                                              Filesize

                                                              72KB

                                                              MD5

                                                              338057ba65f786f4238be340d64daf08

                                                              SHA1

                                                              6571744dbdf2150179e46fbf4de2ce8ba715cbf2

                                                              SHA256

                                                              bfb5009ee0d70c0e594a9f35fb56d541b91a9e7ab1f396ba01b986f1567e5bac

                                                              SHA512

                                                              37e2a8a12dab1481bcb60fa8afdc9613cbff8e5d873754e3c6142e882d742c0f9ea19f1bac6ce1f6644b3e1c1022a7aab73105f53c2ccf4e9a71405fac89de34

                                                            • \Users\Admin\Pictures\Minor Policy\sNwYFN7Re21w68FjfjcvIeqm.exe

                                                              Filesize

                                                              72KB

                                                              MD5

                                                              338057ba65f786f4238be340d64daf08

                                                              SHA1

                                                              6571744dbdf2150179e46fbf4de2ce8ba715cbf2

                                                              SHA256

                                                              bfb5009ee0d70c0e594a9f35fb56d541b91a9e7ab1f396ba01b986f1567e5bac

                                                              SHA512

                                                              37e2a8a12dab1481bcb60fa8afdc9613cbff8e5d873754e3c6142e882d742c0f9ea19f1bac6ce1f6644b3e1c1022a7aab73105f53c2ccf4e9a71405fac89de34

                                                            • \Users\Admin\Pictures\Minor Policy\xNCErmKh28u5VQmrJvo1CtRO.exe

                                                              Filesize

                                                              1.2MB

                                                              MD5

                                                              268a9c9150fbe19f367acc7756a780f7

                                                              SHA1

                                                              bdc3f307ba963ed9470a01722035ac0dfcf906e7

                                                              SHA256

                                                              ad47a277b5ee673253ef0ea9aaeb5b1f053d1c1ba7950d91a858595974390ef1

                                                              SHA512

                                                              3b3d52ce816f06d852d0dab080ab95b05a5f57c3d53077601c20a43600a18084adb46e430bf712447ce4b14e06547a730e6d6dde79ea8949eeefbbbc7f28fe97

                                                            • \Users\Admin\Pictures\Minor Policy\xNCErmKh28u5VQmrJvo1CtRO.exe

                                                              Filesize

                                                              1.2MB

                                                              MD5

                                                              268a9c9150fbe19f367acc7756a780f7

                                                              SHA1

                                                              bdc3f307ba963ed9470a01722035ac0dfcf906e7

                                                              SHA256

                                                              ad47a277b5ee673253ef0ea9aaeb5b1f053d1c1ba7950d91a858595974390ef1

                                                              SHA512

                                                              3b3d52ce816f06d852d0dab080ab95b05a5f57c3d53077601c20a43600a18084adb46e430bf712447ce4b14e06547a730e6d6dde79ea8949eeefbbbc7f28fe97

                                                            • memory/876-189-0x00000000009B0000-0x00000000009FD000-memory.dmp

                                                              Filesize

                                                              308KB

                                                            • memory/876-190-0x0000000003B20000-0x0000000003B92000-memory.dmp

                                                              Filesize

                                                              456KB

                                                            • memory/876-638-0x00000000009B0000-0x00000000009FD000-memory.dmp

                                                              Filesize

                                                              308KB

                                                            • memory/1732-159-0x0000000004CE0000-0x0000000004D28000-memory.dmp

                                                              Filesize

                                                              288KB

                                                            • memory/1732-142-0x0000000002620000-0x000000000266A000-memory.dmp

                                                              Filesize

                                                              296KB

                                                            • memory/1732-135-0x0000000000400000-0x0000000000889000-memory.dmp

                                                              Filesize

                                                              4.5MB

                                                            • memory/1732-187-0x0000000000400000-0x0000000000889000-memory.dmp

                                                              Filesize

                                                              4.5MB

                                                            • memory/1732-130-0x0000000000400000-0x0000000000889000-memory.dmp

                                                              Filesize

                                                              4.5MB

                                                            • memory/1732-479-0x0000000000400000-0x0000000000889000-memory.dmp

                                                              Filesize

                                                              4.5MB

                                                            • memory/1908-195-0x000000000065C000-0x000000000068D000-memory.dmp

                                                              Filesize

                                                              196KB

                                                            • memory/1908-199-0x0000000000320000-0x000000000032D000-memory.dmp

                                                              Filesize

                                                              52KB

                                                            • memory/1908-197-0x0000000000400000-0x00000000005BC000-memory.dmp

                                                              Filesize

                                                              1.7MB

                                                            • memory/1908-196-0x00000000002C0000-0x0000000000300000-memory.dmp

                                                              Filesize

                                                              256KB

                                                            • memory/1908-198-0x0000000000230000-0x0000000000239000-memory.dmp

                                                              Filesize

                                                              36KB

                                                            • memory/2040-126-0x0000000000400000-0x000000000045A000-memory.dmp

                                                              Filesize

                                                              360KB

                                                            • memory/2040-153-0x0000000000400000-0x000000000045A000-memory.dmp

                                                              Filesize

                                                              360KB

                                                            • memory/2040-151-0x000000000030E000-0x0000000000335000-memory.dmp

                                                              Filesize

                                                              156KB

                                                            • memory/2040-97-0x000000000030E000-0x0000000000335000-memory.dmp

                                                              Filesize

                                                              156KB

                                                            • memory/2040-98-0x00000000001B0000-0x00000000001F3000-memory.dmp

                                                              Filesize

                                                              268KB

                                                            • memory/2040-152-0x00000000001B0000-0x00000000001F3000-memory.dmp

                                                              Filesize

                                                              268KB

                                                            • memory/2312-138-0x00000000002A0000-0x0000000000D62000-memory.dmp

                                                              Filesize

                                                              10.8MB

                                                            • memory/2312-63-0x0000000075A11000-0x0000000075A13000-memory.dmp

                                                              Filesize

                                                              8KB

                                                            • memory/2312-64-0x00000000002A0000-0x0000000000D62000-memory.dmp

                                                              Filesize

                                                              10.8MB

                                                            • memory/2312-89-0x00000000002A0000-0x0000000000D62000-memory.dmp

                                                              Filesize

                                                              10.8MB

                                                            • memory/2312-128-0x0000000006F20000-0x000000000788C000-memory.dmp

                                                              Filesize

                                                              9.4MB

                                                            • memory/2312-77-0x0000000004490000-0x00000000044EA000-memory.dmp

                                                              Filesize

                                                              360KB

                                                            • memory/2312-67-0x00000000002A0000-0x0000000000D62000-memory.dmp

                                                              Filesize

                                                              10.8MB

                                                            • memory/2376-92-0x0000000140000000-0x0000000140608000-memory.dmp

                                                              Filesize

                                                              6.0MB

                                                            • memory/2484-201-0x0000000000400000-0x000000000088B000-memory.dmp

                                                              Filesize

                                                              4.5MB

                                                            • memory/2484-137-0x0000000000400000-0x000000000088B000-memory.dmp

                                                              Filesize

                                                              4.5MB

                                                            • memory/2484-553-0x0000000000400000-0x000000000088B000-memory.dmp

                                                              Filesize

                                                              4.5MB

                                                            • memory/2484-143-0x0000000000400000-0x000000000088B000-memory.dmp

                                                              Filesize

                                                              4.5MB

                                                            • memory/2484-160-0x0000000004D50000-0x0000000004D98000-memory.dmp

                                                              Filesize

                                                              288KB

                                                            • memory/2484-146-0x0000000002600000-0x000000000264A000-memory.dmp

                                                              Filesize

                                                              296KB

                                                            • memory/2820-641-0x00000000009B0000-0x00000000009DC000-memory.dmp

                                                              Filesize

                                                              176KB

                                                            • memory/2820-145-0x0000000000170000-0x0000000000538000-memory.dmp

                                                              Filesize

                                                              3.8MB

                                                            • memory/2880-139-0x0000000001380000-0x00000000013A8000-memory.dmp

                                                              Filesize

                                                              160KB

                                                            • memory/2908-140-0x0000000000F00000-0x000000000186C000-memory.dmp

                                                              Filesize

                                                              9.4MB

                                                            • memory/2908-637-0x0000000076F90000-0x0000000077110000-memory.dmp

                                                              Filesize

                                                              1.5MB

                                                            • memory/2908-200-0x0000000076F90000-0x0000000077110000-memory.dmp

                                                              Filesize

                                                              1.5MB

                                                            • memory/2908-141-0x0000000076F90000-0x0000000077110000-memory.dmp

                                                              Filesize

                                                              1.5MB

                                                            • memory/2908-636-0x0000000000F00000-0x000000000186C000-memory.dmp

                                                              Filesize

                                                              9.4MB

                                                            • memory/27092-186-0x0000000001FF0000-0x00000000020F1000-memory.dmp

                                                              Filesize

                                                              1.0MB

                                                            • memory/27092-188-0x0000000000280000-0x00000000002DE000-memory.dmp

                                                              Filesize

                                                              376KB

                                                            • memory/27340-699-0x0000000002FB0000-0x00000000030BA000-memory.dmp

                                                              Filesize

                                                              1.0MB

                                                            • memory/27340-700-0x0000000000430000-0x0000000000450000-memory.dmp

                                                              Filesize

                                                              128KB

                                                            • memory/27340-191-0x0000000000060000-0x00000000000AD000-memory.dmp

                                                              Filesize

                                                              308KB

                                                            • memory/27340-698-0x0000000000410000-0x000000000042B000-memory.dmp

                                                              Filesize

                                                              108KB

                                                            • memory/27340-776-0x0000000002FB0000-0x00000000030BA000-memory.dmp

                                                              Filesize

                                                              1.0MB

                                                            • memory/27340-701-0x0000000000450000-0x000000000046B000-memory.dmp

                                                              Filesize

                                                              108KB

                                                            • memory/27340-203-0x0000000000390000-0x0000000000402000-memory.dmp

                                                              Filesize

                                                              456KB

                                                            • memory/27340-656-0x0000000000390000-0x0000000000402000-memory.dmp

                                                              Filesize

                                                              456KB

                                                            • memory/27340-202-0x0000000000060000-0x00000000000AD000-memory.dmp

                                                              Filesize

                                                              308KB

                                                            • memory/36332-158-0x0000000001F30000-0x0000000002116000-memory.dmp

                                                              Filesize

                                                              1.9MB

                                                            • memory/36332-179-0x0000000000210000-0x00000000002B9000-memory.dmp

                                                              Filesize

                                                              676KB

                                                            • memory/36332-182-0x0000000002630000-0x000000000275C000-memory.dmp

                                                              Filesize

                                                              1.2MB

                                                            • memory/36332-173-0x0000000002630000-0x000000000275C000-memory.dmp

                                                              Filesize

                                                              1.2MB

                                                            • memory/36332-172-0x0000000002390000-0x00000000024F8000-memory.dmp

                                                              Filesize

                                                              1.4MB

                                                            • memory/36332-178-0x0000000000720000-0x00000000007DE000-memory.dmp

                                                              Filesize

                                                              760KB

                                                            • memory/94756-371-0x0000000000090000-0x00000000000B8000-memory.dmp

                                                              Filesize

                                                              160KB

                                                            • memory/94756-362-0x0000000000090000-0x00000000000B8000-memory.dmp

                                                              Filesize

                                                              160KB

                                                            • memory/94756-370-0x0000000000090000-0x00000000000B8000-memory.dmp

                                                              Filesize

                                                              160KB

                                                            • memory/94756-364-0x0000000000090000-0x00000000000B8000-memory.dmp

                                                              Filesize

                                                              160KB

                                                            • memory/95776-554-0x0000000001130000-0x00000000015EC000-memory.dmp

                                                              Filesize

                                                              4.7MB

                                                            • memory/95776-774-0x0000000001130000-0x00000000015EC000-memory.dmp

                                                              Filesize

                                                              4.7MB

                                                            • memory/95776-639-0x0000000076F90000-0x0000000077110000-memory.dmp

                                                              Filesize

                                                              1.5MB

                                                            • memory/95776-657-0x0000000001130000-0x00000000015EC000-memory.dmp

                                                              Filesize

                                                              4.7MB

                                                            • memory/95776-655-0x0000000076F90000-0x0000000077110000-memory.dmp

                                                              Filesize

                                                              1.5MB

                                                            • memory/96248-647-0x0000000000400000-0x0000000000420000-memory.dmp

                                                              Filesize

                                                              128KB

                                                            • memory/96248-646-0x0000000000400000-0x0000000000420000-memory.dmp

                                                              Filesize

                                                              128KB

                                                            • memory/96248-650-0x0000000000400000-0x0000000000420000-memory.dmp

                                                              Filesize

                                                              128KB

                                                            • memory/96248-652-0x0000000000400000-0x0000000000420000-memory.dmp

                                                              Filesize

                                                              128KB

                                                            • memory/96248-645-0x0000000000400000-0x0000000000420000-memory.dmp

                                                              Filesize

                                                              128KB

                                                            • memory/96248-643-0x0000000000400000-0x0000000000420000-memory.dmp

                                                              Filesize

                                                              128KB

                                                            • memory/96248-642-0x0000000000400000-0x0000000000420000-memory.dmp

                                                              Filesize

                                                              128KB

                                                            • memory/96824-778-0x0000000076F90000-0x0000000077110000-memory.dmp

                                                              Filesize

                                                              1.5MB

                                                            • memory/96824-775-0x0000000000350000-0x000000000080C000-memory.dmp

                                                              Filesize

                                                              4.7MB

                                                            • memory/96824-779-0x0000000000350000-0x000000000080C000-memory.dmp

                                                              Filesize

                                                              4.7MB

                                                            • memory/96824-777-0x0000000000350000-0x000000000080C000-memory.dmp

                                                              Filesize

                                                              4.7MB

                                                            • memory/96824-723-0x0000000000350000-0x000000000080C000-memory.dmp

                                                              Filesize

                                                              4.7MB

                                                            • memory/96824-772-0x0000000076F90000-0x0000000077110000-memory.dmp

                                                              Filesize

                                                              1.5MB

                                                            • memory/97264-781-0x0000000140000000-0x00000001405E8000-memory.dmp

                                                              Filesize

                                                              5.9MB

                                                            • memory/97264-782-0x0000000140000000-0x00000001405E8000-memory.dmp

                                                              Filesize

                                                              5.9MB

                                                            • memory/112440-169-0x0000000000400000-0x0000000000460000-memory.dmp

                                                              Filesize

                                                              384KB

                                                            • memory/112440-163-0x0000000000400000-0x0000000000460000-memory.dmp

                                                              Filesize

                                                              384KB

                                                            • memory/112440-161-0x0000000000400000-0x0000000000460000-memory.dmp

                                                              Filesize

                                                              384KB

                                                            • memory/112440-177-0x00000000003D0000-0x00000000003D6000-memory.dmp

                                                              Filesize

                                                              24KB

                                                            • memory/112440-170-0x0000000000400000-0x0000000000460000-memory.dmp

                                                              Filesize

                                                              384KB