Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    28-09-2022 18:51

General

  • Target

    75271feed4bf55fea11b5af1d9c72f6d2c124241927a2eacefbd615ca0ff4401.exe

  • Size

    294KB

  • MD5

    e5477b2c7ef4fb0b73e4230664296c76

  • SHA1

    d481b394959e77d195aacb6a046c5b34ee221aa4

  • SHA256

    75271feed4bf55fea11b5af1d9c72f6d2c124241927a2eacefbd615ca0ff4401

  • SHA512

    e66b256fc266a57a117fdc4165ae313815d11e10d2bbc0ca598d5726413308e063f6afad474dadc90c3c8866b5ad6694b7d8472ef53b5a6cf6cbf91b75603ce6

  • SSDEEP

    3072:1Xho2vKL4QAWP3Mvtm1b5pI8ZSIJOYstTcMTR0KDknHhrePSSsxkgaBChEpZa9u4:x62YH3Wt6l8uMTR0tnwUigavwVfI

Malware Config

Extracted

Family

redline

Botnet

32489234

C2

78.153.144.6:2510

Attributes
  • auth_value

    ad7ebeff731e5655a1b7feb5e468ead2

Extracted

Family

djvu

C2

http://winnlinne.com/lancer/get.php

Attributes
  • extension

    .ofww

  • offline_id

    xkNzhkB1wvgoDI7Uo0HPNLY3qCuwoFpP7nlhlut1

  • payload_url

    http://rgyui.top/dl/build2.exe

    http://winnlinne.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-EWKSsSJiVn Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: support@bestyourmail.ch Reserve e-mail address to contact us: datarestorehelp@airmail.cc Your personal ID: 0569Jhyjd

rsa_pubkey.plain

Extracted

Family

vidar

Version

54.7

Botnet

517

C2

https://t.me/trampapanam

https://nerdculture.de/@yoxhyp

Attributes
  • profile_id

    517

Signatures

  • Detected Djvu ransomware 7 IoCs
  • Detects Smokeloader packer 1 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Downloads MZ/PE file
  • Executes dropped EXE 11 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\75271feed4bf55fea11b5af1d9c72f6d2c124241927a2eacefbd615ca0ff4401.exe
    "C:\Users\Admin\AppData\Local\Temp\75271feed4bf55fea11b5af1d9c72f6d2c124241927a2eacefbd615ca0ff4401.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:2700
  • C:\Users\Admin\AppData\Local\Temp\EC78.exe
    C:\Users\Admin\AppData\Local\Temp\EC78.exe
    1⤵
    • Executes dropped EXE
    PID:2088
  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\F4F5.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4808
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\F4F5.dll
      2⤵
      • Loads dropped DLL
      PID:4856
  • C:\Users\Admin\AppData\Local\Temp\15A.exe
    C:\Users\Admin\AppData\Local\Temp\15A.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1364
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:84100
  • C:\Users\Admin\AppData\Local\Temp\497.exe
    C:\Users\Admin\AppData\Local\Temp\497.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4908
    • C:\Users\Admin\AppData\Local\Temp\497.exe
      C:\Users\Admin\AppData\Local\Temp\497.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:84804
      • C:\Windows\SysWOW64\icacls.exe
        icacls "C:\Users\Admin\AppData\Local\0fefad3c-7b30-4518-b9dd-aed3c638e3d5" /deny *S-1-1-0:(OI)(CI)(DE,DC)
        3⤵
        • Modifies file permissions
        PID:4172
      • C:\Users\Admin\AppData\Local\Temp\497.exe
        "C:\Users\Admin\AppData\Local\Temp\497.exe" --Admin IsNotAutoStart IsNotTask
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4300
        • C:\Users\Admin\AppData\Local\Temp\497.exe
          "C:\Users\Admin\AppData\Local\Temp\497.exe" --Admin IsNotAutoStart IsNotTask
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2848
          • C:\Users\Admin\AppData\Local\59561b88-3dca-4f23-92f4-ff91efbf0107\build2.exe
            "C:\Users\Admin\AppData\Local\59561b88-3dca-4f23-92f4-ff91efbf0107\build2.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            PID:2296
            • C:\Users\Admin\AppData\Local\59561b88-3dca-4f23-92f4-ff91efbf0107\build2.exe
              "C:\Users\Admin\AppData\Local\59561b88-3dca-4f23-92f4-ff91efbf0107\build2.exe"
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Checks processor information in registry
              PID:5948
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\59561b88-3dca-4f23-92f4-ff91efbf0107\build2.exe" & del C:\PrograData\*.dll & exit
                7⤵
                  PID:8468
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /im build2.exe /f
                    8⤵
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:8548
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout /t 6
                    8⤵
                    • Delays execution with timeout.exe
                    PID:8752
            • C:\Users\Admin\AppData\Local\59561b88-3dca-4f23-92f4-ff91efbf0107\build3.exe
              "C:\Users\Admin\AppData\Local\59561b88-3dca-4f23-92f4-ff91efbf0107\build3.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:5432
              • C:\Windows\SysWOW64\schtasks.exe
                /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                6⤵
                • Creates scheduled task(s)
                PID:5720
    • C:\Users\Admin\AppData\Local\Temp\AA3.exe
      C:\Users\Admin\AppData\Local\Temp\AA3.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:26820
    • C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      1⤵
      • Accesses Microsoft Outlook profiles
      • outlook_office_path
      • outlook_win_path
      PID:37736
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe
      1⤵
        PID:58212
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        1⤵
          PID:6312
        • C:\Windows\explorer.exe
          C:\Windows\explorer.exe
          1⤵
            PID:6576
          • C:\Windows\SysWOW64\explorer.exe
            C:\Windows\SysWOW64\explorer.exe
            1⤵
              PID:6788
            • C:\Windows\explorer.exe
              C:\Windows\explorer.exe
              1⤵
                PID:6992
              • C:\Windows\SysWOW64\explorer.exe
                C:\Windows\SysWOW64\explorer.exe
                1⤵
                  PID:7244
                • C:\Windows\SysWOW64\explorer.exe
                  C:\Windows\SysWOW64\explorer.exe
                  1⤵
                    PID:7516
                  • C:\Windows\SysWOW64\explorer.exe
                    C:\Windows\SysWOW64\explorer.exe
                    1⤵
                      PID:8180
                    • C:\Windows\explorer.exe
                      C:\Windows\explorer.exe
                      1⤵
                        PID:7756
                      • C:\Windows\SysWOW64\explorer.exe
                        C:\Windows\SysWOW64\explorer.exe
                        1⤵
                          PID:7960
                        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                          C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                          1⤵
                          • Executes dropped EXE
                          PID:8868
                          • C:\Windows\SysWOW64\schtasks.exe
                            /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                            2⤵
                            • Creates scheduled task(s)
                            PID:9024

                        Network

                        MITRE ATT&CK Matrix ATT&CK v6

                        Execution

                        Scheduled Task

                        1
                        T1053

                        Persistence

                        Registry Run Keys / Startup Folder

                        1
                        T1060

                        Scheduled Task

                        1
                        T1053

                        Privilege Escalation

                        Scheduled Task

                        1
                        T1053

                        Defense Evasion

                        File Permissions Modification

                        1
                        T1222

                        Modify Registry

                        1
                        T1112

                        Credential Access

                        Credentials in Files

                        3
                        T1081

                        Discovery

                        Query Registry

                        3
                        T1012

                        System Information Discovery

                        3
                        T1082

                        Peripheral Device Discovery

                        1
                        T1120

                        Collection

                        Data from Local System

                        3
                        T1005

                        Email Collection

                        1
                        T1114

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
                          Filesize

                          2KB

                          MD5

                          3229b6929fc9caec79e3e5ad740250c6

                          SHA1

                          d677cb89c767b4c4a444fedfa53dd6c8aa1d7d6e

                          SHA256

                          ece826b5b4484d173ea804773ca9a13c7248d2f6f3c8a7efeea2a9e3691d7628

                          SHA512

                          79b5ab3c41f03f913c0c947c6b6c66f396af97f7f69b3df72622beb9fddf8c6cc1a4f830d3edbd91ec570ce59531f09db54e51a2694a8b330ded69fd932036d1

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                          Filesize

                          1KB

                          MD5

                          edcd4c783b2b2c906602519bd8f697f4

                          SHA1

                          fc56fded4065d6960c6507cac4264dfd2b038004

                          SHA256

                          367e0ac4e24f1d1530de05a6abf81d6b572c0546b5aa134c246fa1514582fd90

                          SHA512

                          cb23a82c06211121e39ed0dbec5928b1a85aca7c25f2c060d609350e3a94bf82e9159a2a4d5e67295fc29bac22c95d525ea2461a0000d24c6c4cb630520f68d0

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
                          Filesize

                          488B

                          MD5

                          4df3b221eae4a79c68d0fe799502ddff

                          SHA1

                          75f88b02305e81dd1bdd3cf518a870c0d3b6013c

                          SHA256

                          39ada5e575c5756aa777ec9a9fadc8cb54aa85d07f801ddfeca5f2d50d4251a6

                          SHA512

                          c187b591ddf9dac4e2afe773a765b995c4e02bbb045252f95660573f03325148b0ede362dc247e1f2499f297b70a6cdc2bfbad2447e941ea4823a71919983030

                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                          Filesize

                          482B

                          MD5

                          6053325565a71675c84b9a927f3746cd

                          SHA1

                          21f92eea78802379983651c6614295dfb79320be

                          SHA256

                          5987ddb5c8569cd98a0c36fdecb8837a7c014603e9dea28e902d83356aca8870

                          SHA512

                          6319335a71c5a09261ba1145e1b411b078ccdf6e3914a18f15f29d057dfc8903f14f216437946b16a89f442232600b1e503314b1841672a6156d9bb3ac406ef4

                        • C:\Users\Admin\AppData\Local\0fefad3c-7b30-4518-b9dd-aed3c638e3d5\497.exe
                          Filesize

                          815KB

                          MD5

                          1f0aacb506ee16071fd5d0fdee1db2a3

                          SHA1

                          a94db3eb4115a70f52049644874cdb78e6030868

                          SHA256

                          47d7b98eef7bbcd2b53f48c0001a1845c397b99857474cc554217a1eff9761e6

                          SHA512

                          7d646cd067222d275d6406eb61ea2fcb716583fc61832fe22884e51859c15a43ea126f9f5059e2a1c7bfe19416d551915f29d3605c7a36f9e726451047fd4cbe

                        • C:\Users\Admin\AppData\Local\59561b88-3dca-4f23-92f4-ff91efbf0107\build2.exe
                          Filesize

                          418KB

                          MD5

                          bc47d3a0d4a74adc40b3a7035344becb

                          SHA1

                          dd80bbe70106b62ea58924173a364cc936a0b1f4

                          SHA256

                          06d1366df3628a010416384f7c77c493ac35f13ee05e010751708d681ebe5169

                          SHA512

                          4a4ef35c5fcbfc5a6b86dd6235f8b1b4f048ee5b5bd74fd9173a65cd450ec0f58fcf74f5fd2e58dd5dee486c0e41c2523cd6d7528d56fc2627fbdf8b598a29e4

                        • C:\Users\Admin\AppData\Local\59561b88-3dca-4f23-92f4-ff91efbf0107\build2.exe
                          Filesize

                          418KB

                          MD5

                          bc47d3a0d4a74adc40b3a7035344becb

                          SHA1

                          dd80bbe70106b62ea58924173a364cc936a0b1f4

                          SHA256

                          06d1366df3628a010416384f7c77c493ac35f13ee05e010751708d681ebe5169

                          SHA512

                          4a4ef35c5fcbfc5a6b86dd6235f8b1b4f048ee5b5bd74fd9173a65cd450ec0f58fcf74f5fd2e58dd5dee486c0e41c2523cd6d7528d56fc2627fbdf8b598a29e4

                        • C:\Users\Admin\AppData\Local\59561b88-3dca-4f23-92f4-ff91efbf0107\build2.exe
                          Filesize

                          418KB

                          MD5

                          bc47d3a0d4a74adc40b3a7035344becb

                          SHA1

                          dd80bbe70106b62ea58924173a364cc936a0b1f4

                          SHA256

                          06d1366df3628a010416384f7c77c493ac35f13ee05e010751708d681ebe5169

                          SHA512

                          4a4ef35c5fcbfc5a6b86dd6235f8b1b4f048ee5b5bd74fd9173a65cd450ec0f58fcf74f5fd2e58dd5dee486c0e41c2523cd6d7528d56fc2627fbdf8b598a29e4

                        • C:\Users\Admin\AppData\Local\59561b88-3dca-4f23-92f4-ff91efbf0107\build3.exe
                          Filesize

                          9KB

                          MD5

                          9ead10c08e72ae41921191f8db39bc16

                          SHA1

                          abe3bce01cd34afc88e2c838173f8c2bd0090ae1

                          SHA256

                          8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

                          SHA512

                          aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

                        • C:\Users\Admin\AppData\Local\59561b88-3dca-4f23-92f4-ff91efbf0107\build3.exe
                          Filesize

                          9KB

                          MD5

                          9ead10c08e72ae41921191f8db39bc16

                          SHA1

                          abe3bce01cd34afc88e2c838173f8c2bd0090ae1

                          SHA256

                          8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

                          SHA512

                          aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

                        • C:\Users\Admin\AppData\Local\Temp\15A.exe
                          Filesize

                          2.6MB

                          MD5

                          32a4bbafbd8eb26adce26fde9e3f40b5

                          SHA1

                          4df6e3bf4f2dc5e5dc566b7a7bc442c42ee756cb

                          SHA256

                          fff8acb5b2c33fd994733fdc6ede29cf6c55a923f8cae2d66c2b8712521add02

                          SHA512

                          7e2173dc572e28cb3747c711ae1f2d997549484a0ea3e3bb74e4e92f93cbab7b6e04ae5ef7f03a98e8f9fad4b10499efbb9bb0e1d008d477ef7f85ccad3ba4ba

                        • C:\Users\Admin\AppData\Local\Temp\15A.exe
                          Filesize

                          2.6MB

                          MD5

                          32a4bbafbd8eb26adce26fde9e3f40b5

                          SHA1

                          4df6e3bf4f2dc5e5dc566b7a7bc442c42ee756cb

                          SHA256

                          fff8acb5b2c33fd994733fdc6ede29cf6c55a923f8cae2d66c2b8712521add02

                          SHA512

                          7e2173dc572e28cb3747c711ae1f2d997549484a0ea3e3bb74e4e92f93cbab7b6e04ae5ef7f03a98e8f9fad4b10499efbb9bb0e1d008d477ef7f85ccad3ba4ba

                        • C:\Users\Admin\AppData\Local\Temp\497.exe
                          Filesize

                          815KB

                          MD5

                          1f0aacb506ee16071fd5d0fdee1db2a3

                          SHA1

                          a94db3eb4115a70f52049644874cdb78e6030868

                          SHA256

                          47d7b98eef7bbcd2b53f48c0001a1845c397b99857474cc554217a1eff9761e6

                          SHA512

                          7d646cd067222d275d6406eb61ea2fcb716583fc61832fe22884e51859c15a43ea126f9f5059e2a1c7bfe19416d551915f29d3605c7a36f9e726451047fd4cbe

                        • C:\Users\Admin\AppData\Local\Temp\497.exe
                          Filesize

                          815KB

                          MD5

                          1f0aacb506ee16071fd5d0fdee1db2a3

                          SHA1

                          a94db3eb4115a70f52049644874cdb78e6030868

                          SHA256

                          47d7b98eef7bbcd2b53f48c0001a1845c397b99857474cc554217a1eff9761e6

                          SHA512

                          7d646cd067222d275d6406eb61ea2fcb716583fc61832fe22884e51859c15a43ea126f9f5059e2a1c7bfe19416d551915f29d3605c7a36f9e726451047fd4cbe

                        • C:\Users\Admin\AppData\Local\Temp\497.exe
                          Filesize

                          815KB

                          MD5

                          1f0aacb506ee16071fd5d0fdee1db2a3

                          SHA1

                          a94db3eb4115a70f52049644874cdb78e6030868

                          SHA256

                          47d7b98eef7bbcd2b53f48c0001a1845c397b99857474cc554217a1eff9761e6

                          SHA512

                          7d646cd067222d275d6406eb61ea2fcb716583fc61832fe22884e51859c15a43ea126f9f5059e2a1c7bfe19416d551915f29d3605c7a36f9e726451047fd4cbe

                        • C:\Users\Admin\AppData\Local\Temp\497.exe
                          Filesize

                          815KB

                          MD5

                          1f0aacb506ee16071fd5d0fdee1db2a3

                          SHA1

                          a94db3eb4115a70f52049644874cdb78e6030868

                          SHA256

                          47d7b98eef7bbcd2b53f48c0001a1845c397b99857474cc554217a1eff9761e6

                          SHA512

                          7d646cd067222d275d6406eb61ea2fcb716583fc61832fe22884e51859c15a43ea126f9f5059e2a1c7bfe19416d551915f29d3605c7a36f9e726451047fd4cbe

                        • C:\Users\Admin\AppData\Local\Temp\497.exe
                          Filesize

                          815KB

                          MD5

                          1f0aacb506ee16071fd5d0fdee1db2a3

                          SHA1

                          a94db3eb4115a70f52049644874cdb78e6030868

                          SHA256

                          47d7b98eef7bbcd2b53f48c0001a1845c397b99857474cc554217a1eff9761e6

                          SHA512

                          7d646cd067222d275d6406eb61ea2fcb716583fc61832fe22884e51859c15a43ea126f9f5059e2a1c7bfe19416d551915f29d3605c7a36f9e726451047fd4cbe

                        • C:\Users\Admin\AppData\Local\Temp\AA3.exe
                          Filesize

                          295KB

                          MD5

                          86345902abc8dc824054e4072baa1b64

                          SHA1

                          0b568cfd96818707561dc4fa9ccb58555bf6547a

                          SHA256

                          6014786b41622c5201cdb283d606c70831da00f1d890087b2be68fb4f5515e71

                          SHA512

                          1c3113717337af7e0d4382f07ffbb4905e5f8e42c0c598f6e071fdefd7ee28fd0b13f811697e32898b6b25cb78f76bd799a2eb3ed94d037050f1a7010a4db3c4

                        • C:\Users\Admin\AppData\Local\Temp\AA3.exe
                          Filesize

                          295KB

                          MD5

                          86345902abc8dc824054e4072baa1b64

                          SHA1

                          0b568cfd96818707561dc4fa9ccb58555bf6547a

                          SHA256

                          6014786b41622c5201cdb283d606c70831da00f1d890087b2be68fb4f5515e71

                          SHA512

                          1c3113717337af7e0d4382f07ffbb4905e5f8e42c0c598f6e071fdefd7ee28fd0b13f811697e32898b6b25cb78f76bd799a2eb3ed94d037050f1a7010a4db3c4

                        • C:\Users\Admin\AppData\Local\Temp\EC78.exe
                          Filesize

                          7.8MB

                          MD5

                          20883f9be310e657471161adcb9482e3

                          SHA1

                          7c5b768a1d5f4bc1560d7f4a232b2ab33bdf8ec4

                          SHA256

                          a4251b5ce425ab74b835a36c850623cda073258045e9c5de17e213000317f1b0

                          SHA512

                          ae5a1801ee2d445ca68b1d72296d42078df42d1e8913e2b85e0a9ece1510b888f9ee3734aac7cc82a5cab572e8bd6e7fc4e01b8bcd21b255c727b4a3a054691d

                        • C:\Users\Admin\AppData\Local\Temp\EC78.exe
                          Filesize

                          7.8MB

                          MD5

                          20883f9be310e657471161adcb9482e3

                          SHA1

                          7c5b768a1d5f4bc1560d7f4a232b2ab33bdf8ec4

                          SHA256

                          a4251b5ce425ab74b835a36c850623cda073258045e9c5de17e213000317f1b0

                          SHA512

                          ae5a1801ee2d445ca68b1d72296d42078df42d1e8913e2b85e0a9ece1510b888f9ee3734aac7cc82a5cab572e8bd6e7fc4e01b8bcd21b255c727b4a3a054691d

                        • C:\Users\Admin\AppData\Local\Temp\F4F5.dll
                          Filesize

                          1.9MB

                          MD5

                          67fdb82fdbc2b7c96197e1e7910221d5

                          SHA1

                          a04e893b5e681ec1dd4b4518704b1e8f4e3ea2d4

                          SHA256

                          8a914b14659e7c2346089fa7a6f43755d94cf89fd56de4c1a7f6aa60ab451a2e

                          SHA512

                          5ad03c8b6b9e242b84f85cc0a8637164d1a0aaa5dd1994a9f2d567de65beac2b19ba2533277eeb22c068122eb5fca45435799398fc0e3031384bffdeeb1078fc

                        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                          Filesize

                          9KB

                          MD5

                          9ead10c08e72ae41921191f8db39bc16

                          SHA1

                          abe3bce01cd34afc88e2c838173f8c2bd0090ae1

                          SHA256

                          8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

                          SHA512

                          aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

                        • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                          Filesize

                          9KB

                          MD5

                          9ead10c08e72ae41921191f8db39bc16

                          SHA1

                          abe3bce01cd34afc88e2c838173f8c2bd0090ae1

                          SHA256

                          8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

                          SHA512

                          aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

                        • \ProgramData\mozglue.dll
                          Filesize

                          593KB

                          MD5

                          c8fd9be83bc728cc04beffafc2907fe9

                          SHA1

                          95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                          SHA256

                          ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                          SHA512

                          fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

                        • \ProgramData\nss3.dll
                          Filesize

                          2.0MB

                          MD5

                          1cc453cdf74f31e4d913ff9c10acdde2

                          SHA1

                          6e85eae544d6e965f15fa5c39700fa7202f3aafe

                          SHA256

                          ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                          SHA512

                          dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

                        • \Users\Admin\AppData\Local\Temp\F4F5.dll
                          Filesize

                          1.9MB

                          MD5

                          67fdb82fdbc2b7c96197e1e7910221d5

                          SHA1

                          a04e893b5e681ec1dd4b4518704b1e8f4e3ea2d4

                          SHA256

                          8a914b14659e7c2346089fa7a6f43755d94cf89fd56de4c1a7f6aa60ab451a2e

                          SHA512

                          5ad03c8b6b9e242b84f85cc0a8637164d1a0aaa5dd1994a9f2d567de65beac2b19ba2533277eeb22c068122eb5fca45435799398fc0e3031384bffdeeb1078fc

                        • memory/1364-212-0x0000000000000000-mapping.dmp
                        • memory/2088-158-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2088-170-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2088-168-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2088-167-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2088-165-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2088-164-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2088-163-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2088-169-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2088-160-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2088-154-0x0000000000000000-mapping.dmp
                        • memory/2088-161-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2088-156-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2088-157-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2088-159-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2296-843-0x0000000000000000-mapping.dmp
                        • memory/2700-149-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2700-125-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2700-152-0x0000000000400000-0x000000000044E000-memory.dmp
                          Filesize

                          312KB

                        • memory/2700-150-0x0000000000450000-0x000000000059A000-memory.dmp
                          Filesize

                          1.3MB

                        • memory/2700-151-0x00000000001D0000-0x00000000001D9000-memory.dmp
                          Filesize

                          36KB

                        • memory/2700-117-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2700-136-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2700-144-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2700-146-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2700-148-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2700-147-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2700-145-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2700-118-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2700-119-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2700-120-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2700-121-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2700-122-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2700-124-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2700-153-0x0000000000400000-0x000000000044E000-memory.dmp
                          Filesize

                          312KB

                        • memory/2700-126-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2700-127-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2700-128-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2700-129-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2700-116-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2700-130-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2700-131-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2700-132-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2700-133-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2700-134-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2700-135-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2700-137-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2700-143-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2700-142-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2700-141-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2700-138-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2700-140-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2700-139-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/2848-1196-0x0000000000400000-0x0000000000537000-memory.dmp
                          Filesize

                          1.2MB

                        • memory/2848-716-0x0000000000424141-mapping.dmp
                        • memory/2848-791-0x0000000000400000-0x0000000000537000-memory.dmp
                          Filesize

                          1.2MB

                        • memory/4172-545-0x0000000000000000-mapping.dmp
                        • memory/4300-589-0x0000000000000000-mapping.dmp
                        • memory/4808-166-0x0000000000000000-mapping.dmp
                        • memory/4856-184-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4856-178-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4856-549-0x0000000005350000-0x0000000005499000-memory.dmp
                          Filesize

                          1.3MB

                        • memory/4856-183-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4856-182-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4856-181-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4856-186-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4856-180-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4856-179-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4856-174-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4856-187-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4856-190-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4856-189-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4856-185-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4856-177-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4856-176-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4856-175-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4856-173-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4856-512-0x0000000005070000-0x00000000051FC000-memory.dmp
                          Filesize

                          1.5MB

                        • memory/4856-514-0x0000000005350000-0x0000000005499000-memory.dmp
                          Filesize

                          1.3MB

                        • memory/4856-172-0x0000000000000000-mapping.dmp
                        • memory/4856-188-0x0000000077A60000-0x0000000077BEE000-memory.dmp
                          Filesize

                          1.6MB

                        • memory/4908-430-0x00000000021D0000-0x00000000022EB000-memory.dmp
                          Filesize

                          1.1MB

                        • memory/4908-427-0x0000000000750000-0x00000000007EF000-memory.dmp
                          Filesize

                          636KB

                        • memory/4908-227-0x0000000000000000-mapping.dmp
                        • memory/5432-944-0x0000000000000000-mapping.dmp
                        • memory/5720-1012-0x0000000000000000-mapping.dmp
                        • memory/5948-1135-0x0000000000400000-0x000000000045B000-memory.dmp
                          Filesize

                          364KB

                        • memory/5948-1063-0x000000000042094D-mapping.dmp
                        • memory/5948-1623-0x0000000000400000-0x000000000045B000-memory.dmp
                          Filesize

                          364KB

                        • memory/6312-1699-0x0000000003070000-0x0000000003077000-memory.dmp
                          Filesize

                          28KB

                        • memory/6312-1298-0x0000000003070000-0x0000000003077000-memory.dmp
                          Filesize

                          28KB

                        • memory/6312-1144-0x0000000000000000-mapping.dmp
                        • memory/6312-1303-0x0000000003060000-0x000000000306B000-memory.dmp
                          Filesize

                          44KB

                        • memory/6576-1696-0x00000000001C0000-0x00000000001C9000-memory.dmp
                          Filesize

                          36KB

                        • memory/6576-1249-0x00000000001C0000-0x00000000001C9000-memory.dmp
                          Filesize

                          36KB

                        • memory/6576-1199-0x0000000000000000-mapping.dmp
                        • memory/6576-1253-0x00000000001B0000-0x00000000001BF000-memory.dmp
                          Filesize

                          60KB

                        • memory/6788-1751-0x00000000030A0000-0x00000000030A5000-memory.dmp
                          Filesize

                          20KB

                        • memory/6788-1247-0x0000000000000000-mapping.dmp
                        • memory/6788-1363-0x0000000003090000-0x0000000003099000-memory.dmp
                          Filesize

                          36KB

                        • memory/6788-1360-0x00000000030A0000-0x00000000030A5000-memory.dmp
                          Filesize

                          20KB

                        • memory/6992-1290-0x0000000000000000-mapping.dmp
                        • memory/6992-1701-0x0000000000D90000-0x0000000000D96000-memory.dmp
                          Filesize

                          24KB

                        • memory/6992-1302-0x0000000000D80000-0x0000000000D8C000-memory.dmp
                          Filesize

                          48KB

                        • memory/6992-1299-0x0000000000D90000-0x0000000000D96000-memory.dmp
                          Filesize

                          24KB

                        • memory/7244-1752-0x0000000003090000-0x00000000030B2000-memory.dmp
                          Filesize

                          136KB

                        • memory/7244-1434-0x0000000003060000-0x0000000003087000-memory.dmp
                          Filesize

                          156KB

                        • memory/7244-1431-0x0000000003090000-0x00000000030B2000-memory.dmp
                          Filesize

                          136KB

                        • memory/7244-1343-0x0000000000000000-mapping.dmp
                        • memory/7516-1526-0x0000000000640000-0x0000000000645000-memory.dmp
                          Filesize

                          20KB

                        • memory/7516-1753-0x0000000000640000-0x0000000000645000-memory.dmp
                          Filesize

                          20KB

                        • memory/7516-1406-0x0000000000000000-mapping.dmp
                        • memory/7516-1570-0x0000000000630000-0x0000000000639000-memory.dmp
                          Filesize

                          36KB

                        • memory/7756-1754-0x0000000000EB0000-0x0000000000EB7000-memory.dmp
                          Filesize

                          28KB

                        • memory/7756-1496-0x0000000000000000-mapping.dmp
                        • memory/7756-1519-0x0000000000EB0000-0x0000000000EB7000-memory.dmp
                          Filesize

                          28KB

                        • memory/7756-1523-0x0000000000EA0000-0x0000000000EAD000-memory.dmp
                          Filesize

                          52KB

                        • memory/7960-1540-0x0000000000000000-mapping.dmp
                        • memory/7960-1755-0x0000000000500000-0x0000000000508000-memory.dmp
                          Filesize

                          32KB

                        • memory/7960-1626-0x0000000000500000-0x0000000000508000-memory.dmp
                          Filesize

                          32KB

                        • memory/7960-1628-0x00000000004F0000-0x00000000004FB000-memory.dmp
                          Filesize

                          44KB

                        • memory/8180-1573-0x0000000000460000-0x0000000000466000-memory.dmp
                          Filesize

                          24KB

                        • memory/8180-1454-0x0000000000000000-mapping.dmp
                        • memory/8180-1625-0x0000000000450000-0x000000000045B000-memory.dmp
                          Filesize

                          44KB

                        • memory/8468-1620-0x0000000000000000-mapping.dmp
                        • memory/8548-1630-0x0000000000000000-mapping.dmp
                        • memory/8752-1673-0x0000000000000000-mapping.dmp
                        • memory/9024-1732-0x0000000000000000-mapping.dmp
                        • memory/26820-597-0x0000000000400000-0x0000000000489000-memory.dmp
                          Filesize

                          548KB

                        • memory/26820-248-0x0000000000000000-mapping.dmp
                        • memory/26820-460-0x00000000004E0000-0x000000000058E000-memory.dmp
                          Filesize

                          696KB

                        • memory/26820-458-0x00000000004E0000-0x000000000058E000-memory.dmp
                          Filesize

                          696KB

                        • memory/26820-455-0x0000000000400000-0x0000000000489000-memory.dmp
                          Filesize

                          548KB

                        • memory/37736-253-0x0000000000000000-mapping.dmp
                        • memory/37736-359-0x0000000003200000-0x0000000003275000-memory.dmp
                          Filesize

                          468KB

                        • memory/37736-408-0x0000000002F80000-0x0000000002FEB000-memory.dmp
                          Filesize

                          428KB

                        • memory/37736-361-0x0000000002F80000-0x0000000002FEB000-memory.dmp
                          Filesize

                          428KB

                        • memory/58212-267-0x0000000000000000-mapping.dmp
                        • memory/58212-273-0x0000000000BF0000-0x0000000000BFC000-memory.dmp
                          Filesize

                          48KB

                        • memory/84100-362-0x0000000000400000-0x0000000000428000-memory.dmp
                          Filesize

                          160KB

                        • memory/84100-542-0x000000000A3A0000-0x000000000A89E000-memory.dmp
                          Filesize

                          5.0MB

                        • memory/84100-395-0x0000000009310000-0x0000000009322000-memory.dmp
                          Filesize

                          72KB

                        • memory/84100-548-0x0000000009780000-0x00000000097E6000-memory.dmp
                          Filesize

                          408KB

                        • memory/84100-402-0x00000000094F0000-0x000000000953B000-memory.dmp
                          Filesize

                          300KB

                        • memory/84100-393-0x00000000093E0000-0x00000000094EA000-memory.dmp
                          Filesize

                          1.0MB

                        • memory/84100-392-0x0000000009890000-0x0000000009E96000-memory.dmp
                          Filesize

                          6.0MB

                        • memory/84100-289-0x0000000000422122-mapping.dmp
                        • memory/84100-540-0x00000000096E0000-0x0000000009772000-memory.dmp
                          Filesize

                          584KB

                        • memory/84100-397-0x0000000009370000-0x00000000093AE000-memory.dmp
                          Filesize

                          248KB

                        • memory/84100-797-0x000000000AE40000-0x000000000AE90000-memory.dmp
                          Filesize

                          320KB

                        • memory/84100-588-0x000000000AA70000-0x000000000AC32000-memory.dmp
                          Filesize

                          1.8MB

                        • memory/84100-796-0x000000000ADC0000-0x000000000AE36000-memory.dmp
                          Filesize

                          472KB

                        • memory/84100-593-0x000000000B170000-0x000000000B69C000-memory.dmp
                          Filesize

                          5.2MB

                        • memory/84804-591-0x0000000000400000-0x0000000000537000-memory.dmp
                          Filesize

                          1.2MB

                        • memory/84804-515-0x0000000000400000-0x0000000000537000-memory.dmp
                          Filesize

                          1.2MB

                        • memory/84804-442-0x0000000000424141-mapping.dmp