Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    38s
  • max time network
    47s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/10/2022, 00:25

General

  • Target

    895e377b59355afb4c971a6ea9408d630e415ba4a87ff2f3bb8c7f7bdea0c964.exe

  • Size

    65KB

  • MD5

    0ea5db46e0f6a087c5dc98c6fb6c5fe7

  • SHA1

    e9c609d1d75a560d21c5879bcfea37438d2ab067

  • SHA256

    895e377b59355afb4c971a6ea9408d630e415ba4a87ff2f3bb8c7f7bdea0c964

  • SHA512

    f891238f7ad3820f8b9eca963f449757279829db2ab03d5027708fe9d7e64f32bceb419a6f8b2981856f71b97566cb47b2642430eaf9cf94ac8fcb78b30e7829

  • SSDEEP

    768:hQAG+3HJPqwBcNpYje8KnUqWBGuwSG4lNKNeEbMbap2WU3i5nEwekfE9n:hRXJPQDZORb+ecoRwwR

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Modifies Control Panel 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\895e377b59355afb4c971a6ea9408d630e415ba4a87ff2f3bb8c7f7bdea0c964.exe
    "C:\Users\Admin\AppData\Local\Temp\895e377b59355afb4c971a6ea9408d630e415ba4a87ff2f3bb8c7f7bdea0c964.exe"
    1⤵
    • Adds Run key to start application
    • Modifies Control Panel
    • Suspicious use of SetWindowsHookEx
    PID:564
    • C:\Windows\SysWOW64\WishfulThinking.exe
      C:\Windows\system32\WishfulThinking.exe
      2⤵
        PID:4500
        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
          3⤵
            PID:3868
          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
            "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
            3⤵
              PID:3504
            • C:\Windows\SysWOW64\WishfulThinking.exe
              C:\Windows\system32\WishfulThinking.exe
              3⤵
                PID:3756
              • C:\Windows\nEwb0Rn.exe
                C:\Windows\nEwb0Rn.exe
                3⤵
                  PID:1972
              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
                2⤵
                  PID:2084
                  • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                    "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
                    3⤵
                      PID:3628
                    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
                      3⤵
                        PID:3464
                      • C:\Windows\SysWOW64\WishfulThinking.exe
                        C:\Windows\system32\WishfulThinking.exe
                        3⤵
                          PID:556
                        • C:\Windows\nEwb0Rn.exe
                          C:\Windows\nEwb0Rn.exe
                          3⤵
                            PID:3240
                        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
                          2⤵
                            PID:4956
                            • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                              "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
                              3⤵
                                PID:4420
                              • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                                "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
                                3⤵
                                  PID:4632
                                • C:\Windows\SysWOW64\WishfulThinking.exe
                                  C:\Windows\system32\WishfulThinking.exe
                                  3⤵
                                    PID:3720
                                  • C:\Windows\nEwb0Rn.exe
                                    C:\Windows\nEwb0Rn.exe
                                    3⤵
                                      PID:3136
                                  • C:\Windows\nEwb0Rn.exe
                                    C:\Windows\nEwb0Rn.exe
                                    2⤵
                                      PID:1528
                                      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
                                        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
                                        3⤵
                                          PID:2108
                                        • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
                                          "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
                                          3⤵
                                            PID:116
                                          • C:\Windows\SysWOW64\WishfulThinking.exe
                                            C:\Windows\system32\WishfulThinking.exe
                                            3⤵
                                              PID:692
                                            • C:\Windows\nEwb0Rn.exe
                                              C:\Windows\nEwb0Rn.exe
                                              3⤵
                                                PID:3492

                                          Network

                                          MITRE ATT&CK Enterprise v6

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

                                            Filesize

                                            61KB

                                            MD5

                                            6165c478b7e6457e01e46b87efce9018

                                            SHA1

                                            a156b5e0e72e073cab8ad3b2c08bc4278995a831

                                            SHA256

                                            3c8e2e9d104ad86ad9fdcafe6472031defaf845de7b904d775a56cb8cdf65b3e

                                            SHA512

                                            e79186fe18b88863f7c7d445487c97dff3df264f697290a674093b79da693252b4acbbcf979176745f522984ceeab1b1c1265bcfd7f77260b6f257f012fd2372

                                          • C:\Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE

                                            Filesize

                                            48KB

                                            MD5

                                            0170ff09a267490a239d91244d3760b9

                                            SHA1

                                            76a6d23933c6d4a014c80544ce1902f9809b2508

                                            SHA256

                                            637e8256ca1ebc6c7d3ca36603d0ae689681698a02da970e2d63827934a8c049

                                            SHA512

                                            c546a5137a141c112b4c1cf6c7c88b925173df57ad47d40982ff0c9a6fd87ce251481aa539713eb9fdb916ff0f0ae5cde83c3e3ebef27e9d1d6112c82ef50c3a

                                          • C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

                                            Filesize

                                            20KB

                                            MD5

                                            84832a794d782017de320f931f3d3917

                                            SHA1

                                            ad230e12c26b3bc7ca47dbd5c61742e34369f92f

                                            SHA256

                                            2ecf0e24e5815a5ea193db417746fb44c59680b1b7c946fe6a389339ffb8c12d

                                            SHA512

                                            776c510b85fb99d6b989d9d6af308b6638bb15db519b5a709af326808dfc0cfb04ef9bfc9dc771690ef76c1efdc4241640bb57945ab049d48d727190ad153704

                                          • C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

                                            Filesize

                                            22KB

                                            MD5

                                            ffd60b04be2b468470944ba62b5da98f

                                            SHA1

                                            0e056b6c6d44b89d30f0572b8d7af6965d4effb9

                                            SHA256

                                            1ae052c78e7e479c7a18cda3fe621fe34272dbf871200664a7d8d5e3c3b80e09

                                            SHA512

                                            48f40333e13c7012d56f55c6f8643276c6d1ea712c83d6eb1c8a4c2274c1d5c39ccb002f9da1b4fc51446572a4ad4a8e16f0e6bc8aff4e10dbc4f7b91a2ae583

                                          • C:\Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE

                                            Filesize

                                            47KB

                                            MD5

                                            6f4ce5926b4e1a78898692f718ecc209

                                            SHA1

                                            2ef08e6489cd8851573e634d8f5509f4362b107c

                                            SHA256

                                            64b514fefe7e6517e5c8c111d854bdd2382932b4b5e0fff7075320f076db0850

                                            SHA512

                                            d9f12260aa55296ca47acebd571339658472bf9274004949c9d429c390fcd1b8f4f02265c77f7693fc937842913d9b7a27f9170a6584fc1402ee6f5025674d60

                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE

                                            Filesize

                                            40KB

                                            MD5

                                            f665fcfcf8cf77612d3237a1827403af

                                            SHA1

                                            b9203fde8be95869325c1ddc7d83fe22a4dc0780

                                            SHA256

                                            b475831b317cb836787aed0b032b156db00280a5201e64e3febdade32ebed247

                                            SHA512

                                            7a8fb73657dc90a95dc4b244bf0af346fd45c0e5ed3cfc92ab49b11e37843e1e22841dd2bfd07e0cfc31d66bedc102f7fef738ddd5da72a0c387db651a6a6b86

                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE

                                            Filesize

                                            28KB

                                            MD5

                                            b9ba40a8a1c89eaf62dcc65120cd509c

                                            SHA1

                                            d2a09243ad734ddb086e0b1217e8f0d186919614

                                            SHA256

                                            70a8301ac2bf213369f120294434b19f31c030e34457e6de51b3d9cbba70f1c7

                                            SHA512

                                            6fe7574b2361b1c3ddc354927e0e0f7bc4c83166baacb34f755c4016944def95c2ae27173fabca5f53a1d05c86073d2d43da08d57e76ff9d869740013492f655

                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE

                                            Filesize

                                            42KB

                                            MD5

                                            33f0c426fd54ef0f37322250f8f2c9cf

                                            SHA1

                                            e6974fd0299fb5a72cb2281d7bd1f7021b5c2898

                                            SHA256

                                            aee370bc171035a6324660e5c3e1f1ca29a989c95b0429105271e966f2a98893

                                            SHA512

                                            158aa6f0d29ccb544399d6fafd259ba9acbe865894474f7bb048faa4b68dd349d718046670e5c5f45892558ee68f679a16c275d408195e3095f1930b0b24417c

                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\CSRSS.EXE

                                            Filesize

                                            54KB

                                            MD5

                                            6015ee288559b0538fafd4dfeab6bfe6

                                            SHA1

                                            7317c27a08f5928155bd484d6964d46efe4f6992

                                            SHA256

                                            cb3de5d30e2d632b4150d268c14a739b57d2e652f954fa901b412d1d3dab4e55

                                            SHA512

                                            5fa23ee8ef9d68e409e6e19608a6c8f9c512de830a878db7aa5fa3deb02c04ce2ab8df31db671870956bf587c6392b2989a38eef8fa197c60331197b94f51c92

                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE

                                            Filesize

                                            46KB

                                            MD5

                                            6e7efdd09c7f5506d828732b42567660

                                            SHA1

                                            3a6cea1367e5bb32dbbf5131750e52ff82b6ca79

                                            SHA256

                                            59bf0a258308d9172c6a3fcab888c4eaa114610ed29cd6d7c1e52f5a9a2c86d6

                                            SHA512

                                            b527f217a877ed342159cf14602d4755bb40fa553eccf0540bf535366c82460b4c2edb3425f4bd8e5ef2cb2511a8969c4de64a5eb32774f3fdd5acda6fb2f218

                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE

                                            Filesize

                                            36KB

                                            MD5

                                            e0e9a47140ac387897fb5033819e465b

                                            SHA1

                                            f329956ed03feca11574148b17410bd8f2de3ff5

                                            SHA256

                                            727707a1ec69b98d535b957a4d54ccdd47cfd31aea10dd60504e72fca50450fa

                                            SHA512

                                            74899841d70885cb0ffde66b7b4418dfd6a58847bab26660bd45da53ba4c0b9596612255e88b33e2134df01f12635de13ad408ac444f2bfd916ac6a1ea93a04e

                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE

                                            Filesize

                                            51KB

                                            MD5

                                            ec9810ec2e5684b6753c9da289383dbd

                                            SHA1

                                            6defaab232bbf103c26d26e7e539b92bf51f2154

                                            SHA256

                                            bfa9108b954182000a9685fd9cb5decfe1a3399e34d9ef56002f9f29f5659f0a

                                            SHA512

                                            5a39946e024825f82f176c309e9bbd1d838cfdc57ba5804eb5c12a5ea000cbb91e6bf44bfc0dfb98770726f6797ae7c37c7d65b46c084764bebbbc19cb55a7ef

                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\LSASS.EXE

                                            Filesize

                                            43KB

                                            MD5

                                            8fb66df1923c9d7e5a17d5024162fa5f

                                            SHA1

                                            719b8dded08660fcbb327f1ad0bf398927855d74

                                            SHA256

                                            59d5f27a911b1d92ca7a2aaaa85c9c557dd8985d9e5e9b7b6a2cba1e246e1027

                                            SHA512

                                            74dc72b880e07a3498b572961915c5e8852967d06b30a02a8033c3d9167bdaa1c2c2c232a79b3c11f3b19d6b3a536ff1db1af7f7a7045db1408dd8e32c568a27

                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE

                                            Filesize

                                            43KB

                                            MD5

                                            f0e317cab07cef9b501701a53e8c7f6c

                                            SHA1

                                            93d65c932abb4841e4db7c75bebf36981d1553e7

                                            SHA256

                                            8a41edcae88d06488d8244716c3a245922d364bd8360b5785bee73e337338719

                                            SHA512

                                            759ca224d40e46916555b903f227eb0868786c03a271ca3233d51aef201b155145005f2c5263e7e0cfdf5ddecc5be48e92b3301cdd8c759cfbd82965e0023f35

                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE

                                            Filesize

                                            42KB

                                            MD5

                                            48af11a0ccd48c7260bf302ce3240567

                                            SHA1

                                            31c74fa68ab7c04ee96706c68bf58238b8720af0

                                            SHA256

                                            979abb023a5699801957a6dc798d29f488db1c580713876a39e7d4f66f92d633

                                            SHA512

                                            246c549ac9d80dd82a23c65667c165220e17e7ee66149e3a1dc938bd8ac4d884cf230a99fd109b5525025bc0ccf0a87cf227a0f0588227bf057ab5046d8e3ce7

                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE

                                            Filesize

                                            62KB

                                            MD5

                                            2b3ea1f7a80883d182e048010acc4d61

                                            SHA1

                                            979377ba3a1c5d48c03f40f0534e9a5486bae9e9

                                            SHA256

                                            a142fe2beed4729bcba2fa17770029410efa4ed4218266e2a5e1556069958c3f

                                            SHA512

                                            589429cf2ff291657e6e58a03230e04079d22f30040b64c70e007f3ce19be8d2a04857f1ae2311059a77a48d6b575e6004ecc5e0362a4d5a59523a63e4a1a0fb

                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE

                                            Filesize

                                            38KB

                                            MD5

                                            3fb8b7e722f745bcb198284285654de8

                                            SHA1

                                            e50a839aaba3c3c79634990d2609b174765f5078

                                            SHA256

                                            f7991f0994a4018db2e03ef57c0b318cf1353675e9c6e0d08fabc212c7fd1b76

                                            SHA512

                                            7097a2f2aa1ff8dd730b075f6387f448c4a1e45bba12e64429fb8e09bf158b2296397ce844e9eb7602774884b7c9dacea9590ae981d0e49cdf5f06d6e8c147b5

                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SMSS.EXE

                                            Filesize

                                            45KB

                                            MD5

                                            128ff735389bf593720ecd114aa10a43

                                            SHA1

                                            3ce1c46f00c63f279afe60c16896ff8bf407a64a

                                            SHA256

                                            941af9d4846b27cba8459e499942aa2112250c9764ce9124383ab202416bad23

                                            SHA512

                                            2c357216ac89ea4b37c45de117bb411a7fd43705e0cafd31536e0673704caa7325fd11ac7204d2f7c7bce501ef50a136225c23a0fa10d24d10a47b1be8e0bf68

                                          • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE

                                            Filesize

                                            42KB

                                            MD5

                                            fbba419e60e7de5ea7ab601653ef915c

                                            SHA1

                                            60b2e9f8fb0825ed082630b6950b28b0288b6ce4

                                            SHA256

                                            186f072a1d312ff481de4832a70d251f76b48baa4593950ab3871aa152929ccc

                                            SHA512

                                            89b8f7f01b9379d2741bdac35aff287de4516ac1efdd27e27c08314b64e745519b99f3b7cabffbae1199e99e5e2fcdd77d76c1934015f48e95d1d2b0cad7bc48

                                          • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

                                            Filesize

                                            27KB

                                            MD5

                                            5a4786f0b02519d7ab25ea78b41f7a87

                                            SHA1

                                            bdfbeb72c05d68de5ea78d7e021f091e64335286

                                            SHA256

                                            0b556087c4efa6454ecc15f8b40b379e58123e8c239d2387b1c31f315d2f6e9b

                                            SHA512

                                            c971e96168f8885a7ee606cfc5d695baace5aea2b10f66d90ea465d5c5aca952bf45efaa87195819f4247cc926a67e44454c8da7caf3e39b35750c9575e3d6ec

                                          • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

                                            Filesize

                                            22KB

                                            MD5

                                            8459d8b5e62391a148484ba75766ebf9

                                            SHA1

                                            e08ff97c8d11e385c9cdb4371ab1a33ae31eff0f

                                            SHA256

                                            d197893a5bf8244a9b714cbcc7f906a87f9225f4ad96940e7eb0077e36b6f380

                                            SHA512

                                            25d4ef9dfdc1c837617dda71cdb4ecbb81529a6a9324aef983de7dfb9580bebf457cbef1f2c6865d35e72163d96f1be4019741dde98182ec451c70f95b5d40d3

                                          • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

                                            Filesize

                                            36KB

                                            MD5

                                            77a9d6103aca522a4c5f103fe8f6b6aa

                                            SHA1

                                            b2f45fd038ac1bf3a8b9ca67d54ab89268e92c5d

                                            SHA256

                                            82a4ccd34b0eee4aec0a2c0bfd5dc34b40d39814166bb905856bf2b137a9bcac

                                            SHA512

                                            55d8cd51c524ae1b25465d99dce06a46eb49ff02b4c20530738d00dbe79d0232dae42ff27e01c9bcbb333a7f509be9313c259e0d258f5ddad9c6f32fd7d92526

                                          • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

                                            Filesize

                                            37KB

                                            MD5

                                            c332da32a5710cde28233b2eacc51924

                                            SHA1

                                            1b54fc263f36efd561f3e839dfa4bdf89e2ebab2

                                            SHA256

                                            c3e6d9fdc8c2c2c7a2ab657b70dfc6eed7ca7020ad0b7d713571825727eb077f

                                            SHA512

                                            09a10433375472ce4dfbd3ed2e2a5764663e2f72f525cc0b390fa78dafc7b721c52c4028364b9125155bed47bb9cf3d01b55c35193fbfe90c84954af27577698

                                          • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

                                            Filesize

                                            36KB

                                            MD5

                                            4f3b65035995348c2c2423fc11008d7f

                                            SHA1

                                            25746f07df2efe835e7a63b3625cc73b08abce40

                                            SHA256

                                            07ec7cf855c003cf8e922b30a0a4099131ec50ad5976653e7bfd56671fb3294a

                                            SHA512

                                            c2b8e09f8582f551ff13a296de899f9ae5a1e7ad60a92eedd43fdf7778644059ecff7a78d8bcdf5462a674c23d5e913ed2b6ab2fcbce44587625d459995cd958

                                          • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif

                                            Filesize

                                            46KB

                                            MD5

                                            1ae85368762d57eb73238195a1ba05a0

                                            SHA1

                                            e5009ea98b9f0fc52da8291e4a92ddb45b9f2243

                                            SHA256

                                            f458df69285cd91db580f20783e68b6c17fda7189db125d99b007790cfe5673d

                                            SHA512

                                            b4b2e1a548e80850ad8afd8c878d6487d0e0a6b81cc060fd5c545f0d89f95eb212254dc7147b41b611b7dac749a196f756c241ed3984d0dfd747beb344bab300

                                          • C:\Windows\MSVBVM60.DLL

                                            Filesize

                                            31KB

                                            MD5

                                            81b50ee4631461625acb4380072fff36

                                            SHA1

                                            d4d19b0bbb2b32ebbf5f587e0dcd66e06d6304f8

                                            SHA256

                                            19630bbe17b5e340deccb2fbc2cfcfb80e847be09a427e890a3c2fc764b0f40f

                                            SHA512

                                            31a0ac9a108ff9b8d2f5781de22baa0948ed0480b3082fdf1fa9696f8157407a0cef8bdff12c3254fff5bcda05f4e6d0d0cb6a4b6d96d188bd01c20922a989cb

                                          • C:\Windows\SysWOW64\DamageControl.scr

                                            Filesize

                                            28KB

                                            MD5

                                            3177ff1cc1fed3627d42265578a02d50

                                            SHA1

                                            ad25367e3db10bd380a1b592959925c0d02042d5

                                            SHA256

                                            068715044ca7f948a6868d06eb435f365c52ceb79ff987450165c5046ce06cba

                                            SHA512

                                            fad4d2b50cd7c5bd7928f5f5a002506e9a3c3364354353ae629f043a3a2095a59de8cfc0d4210ea190ba54dd6fb10f4180019a47f4f77516e3112419691c3dd9

                                          • C:\Windows\SysWOW64\DamageControl.scr

                                            Filesize

                                            46KB

                                            MD5

                                            5d194a0ae749189efaed35c2e7d62fb3

                                            SHA1

                                            06f2d6894fafb2012fd3cfc8de2368d54b69daef

                                            SHA256

                                            6f1bb137fd7a4dab1124117496859ed081e3d112375ad8eedcc3d681de728046

                                            SHA512

                                            21f36dc6dfd25032b6408855372e20858e61ef5cd66dc73b2e587779916be779ac97a619b7a60b84eb5c7b436fba46fce15911b2f3f2a34e3b325b78ff7f9334

                                          • C:\Windows\SysWOW64\DamageControl.scr

                                            Filesize

                                            25KB

                                            MD5

                                            c6dfea28f8b9b0cd2271cb1945580b91

                                            SHA1

                                            2cca0549300d6d2f0396c985b8150ab1ffffa42d

                                            SHA256

                                            eb1f615840622931e84b402d7a5b0f31b57a8c4624a25a72e77c748ddf9713a7

                                            SHA512

                                            f6bd43a7a0911be1641287a1e30fbe8f95dc74bb42f75d32fe6213d1911e9ca7fa7ab32e142644fff39c77c5ecba2d97ae73766d3b5eb3b2e2274e233a90f5b7

                                          • C:\Windows\SysWOW64\DamageControl.scr

                                            Filesize

                                            36KB

                                            MD5

                                            0dee78762a17b220df2b26a6453e696a

                                            SHA1

                                            8dfed679e8f25c74feaed7fa20317123012948cf

                                            SHA256

                                            325fd185df4535dea629a0a7e17c645742c4cb1f1fb985eee255b7de3a5c5ac4

                                            SHA512

                                            7552e29a1c24b5db7cf949a3c549211e8b178817700668b9cbb49ea608d91aa39f15583fee4a2e5038454738666c05c1cd7a83c3b441adbb17ee722fa1c4a3e3

                                          • C:\Windows\SysWOW64\DamageControl.scr

                                            Filesize

                                            25KB

                                            MD5

                                            023389775cafd3e77255743821ffb488

                                            SHA1

                                            3dae1c8962a6bf045ca1c5a572dd039accb5e7cf

                                            SHA256

                                            9a8161d2eab205a789615b77d12963fa27d7df862a2176346ceb496524d3f2d5

                                            SHA512

                                            884588a357bc25ab6c21e291c182760183873faa0e1147e425ef3e0734dbd62f3fa8f23100e9232513e031a79ad01f2a028622a57aecb80f8168f853d77bc14b

                                          • C:\Windows\SysWOW64\DamageControl.scr

                                            Filesize

                                            53KB

                                            MD5

                                            95f1a964cedc3bb082480b6e67439d6e

                                            SHA1

                                            7d86a3295155cb86603c0f6623a3eed089d5d188

                                            SHA256

                                            8d8d068f422030342f58073d7363f7472a6bad4a2210e772dc6d333dd07a6532

                                            SHA512

                                            4c51beb40307b30299a7a98818cf1224454c3dce35732f8e233bdcbd0d745ccf2b603f7efcc6f67aeae886d02d8c595e477efda64fe357cdd6d4017810289988

                                          • C:\Windows\SysWOW64\JawsOfLife.exe

                                            Filesize

                                            32KB

                                            MD5

                                            8cf58fa3155d7a7c695653a89931c2ec

                                            SHA1

                                            f24bf8c9505e6b90c5c41d4f793b01990e74e25e

                                            SHA256

                                            1ed54a1254f7f6bad10ee776a48ed185e694469ec7815b227e4993e6ee27ba24

                                            SHA512

                                            4ae4cbc2f09d64f64c57e61c379210d8bd3560ec5c868b52acfd8c88598461f457eecdbe7cb0ff9abca1f64264a4639fded3c71436291b4ebb44ee9db1d54dd5

                                          • C:\Windows\SysWOW64\JawsOfLife.exe

                                            Filesize

                                            28KB

                                            MD5

                                            c1fbf4b080c019ee067574dd3ef7e716

                                            SHA1

                                            c88377e2fe3eee776536f1e3c1dada2d9e559ea3

                                            SHA256

                                            063e0f5a2e5f0950ebc5204b921199af9141ac6ada945aaa5aa2e1e1ca278129

                                            SHA512

                                            582b7daf47be431f3cad7632867eb70f6c755ec59e5fb2c87f0e997909eade8c81f3611ee0bae7c401be5de0137fd7cfd76ccc050735b865fa2bb843d308e18c

                                          • C:\Windows\SysWOW64\JawsOfLife.exe

                                            Filesize

                                            48KB

                                            MD5

                                            7582b034082654b78337bce50891760c

                                            SHA1

                                            6463f6c5af9d46b975e615abdb0f76abc33943a2

                                            SHA256

                                            08c1f636dba5e8f72b24271f45d057870144520ef5361de99e762bf0561ffb45

                                            SHA512

                                            9c4fb6bfeebbb3b999545436264b7e6f4c2c82b85dda6f3b713c67860ddc796a250234d8d970b67f0f6d04c392c920277e4bf916763e39e7baa195b47ae0a976

                                          • C:\Windows\SysWOW64\JawsOfLife.exe

                                            Filesize

                                            65KB

                                            MD5

                                            3e8899e2381998137dbcb08cbe9d1bc3

                                            SHA1

                                            d0b645359d08494848ec0a555736bc6c4f59ff48

                                            SHA256

                                            9e47daa4f8aa2c0c0471ff44041cdad1264fa85e8520c583d32a2fa2d3ceca3f

                                            SHA512

                                            ecb04943155058b9d86a72466a817df57a13df6265f1cf4c9616378c062fae7a22d6c8fd9f03db3c51503cbbc5c303d5199e359b5d7e24c39e4458dcb67ab99a

                                          • C:\Windows\SysWOW64\JawsOfLife.exe

                                            Filesize

                                            50KB

                                            MD5

                                            9d65b56f69468693501dd7655f0256d9

                                            SHA1

                                            57e12c557a2475eb8261c1a93eeafa476ded659b

                                            SHA256

                                            2f725ea49e4399e2ce77c71e1420e82a9401999aca018ef0d29bd935df672609

                                            SHA512

                                            3aa119ecc97d94f95f8f4f2540e188b6cb6b177f8033cfef83bc614a256fa47004d7f3979468ecac1d01341d5110f49ece910d0145c09f8d4de7d63b3da2a6c8

                                          • C:\Windows\SysWOW64\JawsOfLife.exe

                                            Filesize

                                            52KB

                                            MD5

                                            1e702a689c5f4f1455c9078c8374efe1

                                            SHA1

                                            84aa057cacb4be5f95bb8cf5fb1af87f95bc61b0

                                            SHA256

                                            b6c30f6ecca93459c3dcdee014b67c1c4bc10142e7e2a3d8313e3cd85f69f44d

                                            SHA512

                                            5cd8e32069c19af718d847fd62afc99f772193139c4481ff66ee37cf94aefc263e1f9978fd0eb79123a93fec6381f9d6142e2ff66705cbd12dd73882003dbad6

                                          • C:\Windows\SysWOW64\WishfulThinking.exe

                                            Filesize

                                            17KB

                                            MD5

                                            96cac7983f000483a2fe91cfce9f1ec5

                                            SHA1

                                            ac79b349b54ac72b6e168d670e08575950dfd373

                                            SHA256

                                            3c219a55d11245f344c336cd0c10c435080f08c7338ae7bcbd7e345c7fcb8b81

                                            SHA512

                                            ccf2edd41b02dc2f05a129afc14c67a19e4cbff38a3b4149017b6f200cfcb775106bb8ae5b7fda5f10856832c18e78c0e7a55699f4a6ad8203b13ca24ed69db8

                                          • C:\Windows\SysWOW64\WishfulThinking.exe

                                            Filesize

                                            27KB

                                            MD5

                                            012054960f17a21e386f4a26b87112af

                                            SHA1

                                            26fbbaefd9a4a503cf70a0b5112df501841e9f5a

                                            SHA256

                                            57ed15e12bd39b104936ada916962af66f2fa6d312caa9ef21e930fbdc459fed

                                            SHA512

                                            31984ca80daf54797c96320cf50ac23db973841772b0b5c3ecc230a866bd09b3474c97d040474e760a961acb04d0f4e9da9a23a0fcf06da7318f7ca75066adcf

                                          • C:\Windows\SysWOW64\WishfulThinking.exe

                                            Filesize

                                            20KB

                                            MD5

                                            7893f2079528ebbca74f0170528ce85f

                                            SHA1

                                            f4cf556fa5f9fefc09a0416f1de64fd56794d886

                                            SHA256

                                            065797ac5d84277b7428a1f7a1e8f29809ebb45f3386d4b578e45b5752747fac

                                            SHA512

                                            a3a62f7968347fda63da11245e7c4026ff5f3ab8e52b2b07a0f429703c5dec8dba8efcbe494337b14ff4ed56ea8bbf071ad17e40f1f45d7dc2a0e88cb42898fb

                                          • C:\Windows\SysWOW64\WishfulThinking.exe

                                            Filesize

                                            23KB

                                            MD5

                                            e248975b31fc527bc2b9eef7ce8d7b42

                                            SHA1

                                            a5e1b5c27c6b397fa8b5152ec92b0b0f3815ac17

                                            SHA256

                                            80b4abc9946d663c18b9b1b14d41c0bccc7d3ef9fbd3779afd58c634021868e3

                                            SHA512

                                            bcc3ad7a963a8b8d9abddd6e8e308723c44efb91d33417d193486ea31960caf8be3f5b856eb769e1145fa5e00b89750ffaf278e39e20b30afc31be9fc0e2e6c6

                                          • C:\Windows\SysWOW64\WishfulThinking.exe

                                            Filesize

                                            49KB

                                            MD5

                                            0271193b869d130c0911d20993351aaf

                                            SHA1

                                            f96c646195188141ecd3fb3d22a67b632226a76f

                                            SHA256

                                            eff1d36010fa3561d6162d80c9bb59871394fe5a812f828fd230a231ced184ed

                                            SHA512

                                            3b3d523a9499efb411076a816ce327f869fcad5682ddfa34a401382a41ac888f7e923a5689b925bcf3ad9e1f74c3aea20e92150c6d77129c82207a73203ddf5a

                                          • C:\Windows\SysWOW64\WishfulThinking.exe

                                            Filesize

                                            35KB

                                            MD5

                                            2a0057a50a10ee20fd2ec8c23453c7ab

                                            SHA1

                                            7e604ea52f8cddf4ffaa375e4172e2983ce32fa1

                                            SHA256

                                            98bd924e8e0d11f0de5e38c2e76ccd2becdf664b7248ec240301173db191e3b6

                                            SHA512

                                            0cc2d4ecb68eded54ce5467584c6ec7596d34240f9655d073f5762555dbf95a0124d6c2f7d97b6416b666aa8422ad6bf2170ebbca21e820a2d1d575c3e3958fc

                                          • C:\Windows\msvbvm60.dll

                                            Filesize

                                            60KB

                                            MD5

                                            c37d41730a77566a2a9ec4d62aa66722

                                            SHA1

                                            3fcd5284f18371f0262f308171c8a70a1cb128fd

                                            SHA256

                                            53bcf12607b11e86a46c0478a23ce6baa35a22d5e5f69a4f4852fd79536d584c

                                            SHA512

                                            98c21ab801be4601c7567ad1205a03db5981d796e2da54bc4ed87ad7210d721f33eebb6e37c623e732339ee777ce66ae3c96c0c5fa42d4e700ac5400e0ff7af2

                                          • C:\Windows\msvbvm60.dll

                                            Filesize

                                            38KB

                                            MD5

                                            3f35efa17cf2f757dd6d8504d4707781

                                            SHA1

                                            c495977256a52f93f42101298a4cc9f5a16d4f93

                                            SHA256

                                            de1cefb04aa5c5c01b910225211d50c21dfc95e94574292642d1d4ac3865d924

                                            SHA512

                                            20670e433ff62b28cf1fbb6fafb763e42a00720a1317c0d2198c5c177e6f425ae784d95003e2084c14b0ffe848bc7fc17f6e2559bc2fa5ef127421b7a95ec04a

                                          • C:\Windows\msvbvm60.dll

                                            Filesize

                                            33KB

                                            MD5

                                            6c7f551bc25a68527dbefe6ab913f2c5

                                            SHA1

                                            796d0927893b133858c6347d10cad34bf620e544

                                            SHA256

                                            247456dfdf037507957b67867738a1f4502f5e61c75cea6b094ed1baa767fb68

                                            SHA512

                                            673e7dc3ce366c197bce9f98c77f7669b33fdc6702dbf2350746729e5aaa75b3c5d9f90149f732d14a98b65b096390e7d01b664a23dce25d4b4c5a854724ea5f

                                          • C:\Windows\msvbvm60.dll

                                            Filesize

                                            34KB

                                            MD5

                                            e1c4e420e7916faa7cd2090007b8fa85

                                            SHA1

                                            e1c0157224604fd25eab44b128a0c738d971fcaa

                                            SHA256

                                            7011be8132d13661219b27f643a9f63b77124d2dbf43b2302e43f2c46ed18c40

                                            SHA512

                                            edb767a2f38ee2eee1ac0a5dff0eae16726256b498d9e530d37a340ace72f9d5bc6d3c4fcdbbfcf58d6fe78e474edd19d21258b13484d4195520599cade396b0

                                          • C:\Windows\nEwb0Rn.exe

                                            Filesize

                                            40KB

                                            MD5

                                            3ed4c1f73ece47b61abb7675697a0c18

                                            SHA1

                                            c65b0e6741d4cf749e58b95f4fea78ddbf419346

                                            SHA256

                                            68c41486c27f1daee933bbf9c7909fb997eda1ad91aaac8d8cfc5f1862d2ffd2

                                            SHA512

                                            709ab35cf550c09c47ef89dd53a1e6f82bb8a70ae8cfc8c25c7317e786bfa08d81fe5e8c6b8c3de91d27e3c4cb380254ed94ad763c23c28f712a279600f4fa39

                                          • C:\Windows\nEwb0Rn.exe

                                            Filesize

                                            27KB

                                            MD5

                                            24b4518bed0fdbeeff4893fff5c0c9eb

                                            SHA1

                                            23786a37975710f8e3a70b3b8960c2b5aa2a24d4

                                            SHA256

                                            528de3285d1b9873a8778c7fed5eb75a25504d98e1c009e151c009a00ac25af0

                                            SHA512

                                            d5c67a4a0633cde0706e44cea3c7b3ea1e4e8743ad0551a16af396284e929a8a52f9ca2c4272fdc4f2bafe3f92ec0cf45551c3cb32760adfcb8c00a4ba41bfff

                                          • C:\Windows\nEwb0Rn.exe

                                            Filesize

                                            43KB

                                            MD5

                                            416a0fac133f88c6a0df59718871027d

                                            SHA1

                                            304872dccc189d2a79d888d2a1e1d0f790eb9867

                                            SHA256

                                            6157f8558fdc1bf0beffb41129b1b712beed324ce9b862509fd09c9b4de1dea1

                                            SHA512

                                            f095113fb2a902ff19e7b5f9600d713e7298567ab055a9472feb56aaee206fb0888baa4654315cfe956ec9619ad892ee8ed31054f318a20f1328e7f7090cd229

                                          • C:\Windows\nEwb0Rn.exe

                                            Filesize

                                            47KB

                                            MD5

                                            31e8d3f1f5531d4827fe68410e968258

                                            SHA1

                                            d8deeef55f62bfb0045d7a2ff7740a2f0d5fd104

                                            SHA256

                                            a9a78bb36b1a655a666f48ef2df16fb50e448da707c64b992bfefd8327274ac5

                                            SHA512

                                            4b31c84efbd0cb01edf1c4c77aae585e35e7086f7d299a71285755afd2dc2d36b71f997e431c9d5d55d52f28a32b575aeb6f3a69f0c746c3509fa1851ff7cdd1

                                          • C:\Windows\nEwb0Rn.exe

                                            Filesize

                                            31KB

                                            MD5

                                            9c0560beaf4e2eabd912191ce648d439

                                            SHA1

                                            f617ee7dd8581e7e68973ec7d5b76c4eb13e23da

                                            SHA256

                                            84e1ad70a708e41581fa6f51cc2c365d2f7bcc755264390367fb1bb864cfa1b8

                                            SHA512

                                            7c3c690498f06056a6623906fa103161b6db1d79a64201d62ac0edf9adb41e3c28ca11e4f53953d745447b6c59189a9e0c7bbfa07c4f0608382276e7c443002f

                                          • C:\Windows\nEwb0Rn.exe

                                            Filesize

                                            39KB

                                            MD5

                                            cc6ffeaa5fdaf87e59508e672d77f0fd

                                            SHA1

                                            605a3316128088d733dec0f66a6fb54fa956e034

                                            SHA256

                                            9d0d8c4ea5382ac3012e0afb926f4a6dd2994202f7c4f7a1c1a171436657c170

                                            SHA512

                                            f1742be2733c7b62c80d309d940cd5b4552d140c59006ec8cd652d5743cd3fe6f632ce367318aa12005f969580b326542e1b3a787482a04da1fcec247d521504

                                          • C:\about.htm

                                            Filesize

                                            2KB

                                            MD5

                                            94c0c5518c4f4bb044842a006d04932a

                                            SHA1

                                            23d9a914f6681d65e2b1faa171f4cf492562ebdb

                                            SHA256

                                            224c4e5cdc0e7495c5fb5d1f52d76807092b5cc2d0a7c95fa612ff7b1412706e

                                            SHA512

                                            79cb2cd9e19ac3cc8bd94f1a20369e61224f8db02bc04d1f5768d62163b68467a3d317808a942bc7cca6ca84c221bb54a76e097f543c88bb89f0a3c9534ff3bb

                                          • C:\about.htm

                                            Filesize

                                            2KB

                                            MD5

                                            94c0c5518c4f4bb044842a006d04932a

                                            SHA1

                                            23d9a914f6681d65e2b1faa171f4cf492562ebdb

                                            SHA256

                                            224c4e5cdc0e7495c5fb5d1f52d76807092b5cc2d0a7c95fa612ff7b1412706e

                                            SHA512

                                            79cb2cd9e19ac3cc8bd94f1a20369e61224f8db02bc04d1f5768d62163b68467a3d317808a942bc7cca6ca84c221bb54a76e097f543c88bb89f0a3c9534ff3bb

                                          • C:\about.htm

                                            Filesize

                                            2KB

                                            MD5

                                            94c0c5518c4f4bb044842a006d04932a

                                            SHA1

                                            23d9a914f6681d65e2b1faa171f4cf492562ebdb

                                            SHA256

                                            224c4e5cdc0e7495c5fb5d1f52d76807092b5cc2d0a7c95fa612ff7b1412706e

                                            SHA512

                                            79cb2cd9e19ac3cc8bd94f1a20369e61224f8db02bc04d1f5768d62163b68467a3d317808a942bc7cca6ca84c221bb54a76e097f543c88bb89f0a3c9534ff3bb

                                          • C:\about.htm

                                            Filesize

                                            2KB

                                            MD5

                                            94c0c5518c4f4bb044842a006d04932a

                                            SHA1

                                            23d9a914f6681d65e2b1faa171f4cf492562ebdb

                                            SHA256

                                            224c4e5cdc0e7495c5fb5d1f52d76807092b5cc2d0a7c95fa612ff7b1412706e

                                            SHA512

                                            79cb2cd9e19ac3cc8bd94f1a20369e61224f8db02bc04d1f5768d62163b68467a3d317808a942bc7cca6ca84c221bb54a76e097f543c88bb89f0a3c9534ff3bb

                                          • C:\nEwb0Rn.exe

                                            Filesize

                                            32KB

                                            MD5

                                            e87be45219c1a6f281aedbab64a41b52

                                            SHA1

                                            a592c6ab30c31cc6768071ea03fea4776d3aa59a

                                            SHA256

                                            bd9ee98eed10c1590ac28db92947a03fd616b7bc084150c31d994899e3137be4

                                            SHA512

                                            e0e3fb23649fcc1640aac4f42ff4cbd38645d7caf36a50a5aacab3ff4d72bd0dc30f58774197ff2c51f400a1ab37e5788af59f885e7bb88ac26379147790be99

                                          • C:\nEwb0Rn.exe

                                            Filesize

                                            31KB

                                            MD5

                                            b35bbc6d05a1bfb995a4dcaf1aa0bbc1

                                            SHA1

                                            14817da76b2d1d9a658fb4ac15143f97531da08b

                                            SHA256

                                            c4bf2ce77a8c6a87e0c25169432ebc5d3204ce43f40dfa1da6c1f589111758dd

                                            SHA512

                                            b5436ead9e644ac367bb9d3894acb4657e335b8bc20d8eb021511a1c0aa410227a91a561d144cebb7084ae6f21fddd8257364c5c4ed53f45f1c51adc653fcc26

                                          • C:\nEwb0Rn.exe

                                            Filesize

                                            17KB

                                            MD5

                                            ac0e182114217db1ac0520dc390bd357

                                            SHA1

                                            4457dab3a655e769fddee591f447b2c927dcc2e6

                                            SHA256

                                            13c8389229942954579a6163100fcdf54189835a5b70c50d7b296283e66040e8

                                            SHA512

                                            2ff59e448f566517fd956e435038c8d953d219013f291d3b84fb27ed61d206138b7cb9ad878307f399d4322978c82da4732332a313f54c093a879d48df6dcf70

                                          • C:\nEwb0Rn.exe

                                            Filesize

                                            43KB

                                            MD5

                                            9a3db68e25e239c104c425327929da1f

                                            SHA1

                                            71bfa2f7ba58e5eb3583ae27f0b2c139d49e7dd2

                                            SHA256

                                            72f1ec59a632892acc24e4e02117014ab16288981aafad7f091aa44613fd1db3

                                            SHA512

                                            874125fd673469e87df90ac53a883446844040b8dddfb71dbd21a561afe080b9eb0f23fb315e57f6a5f69670180d4522033525ae20c1d3907e80b0b70aa69daf

                                          • C:\nEwb0Rn.exe

                                            Filesize

                                            25KB

                                            MD5

                                            acfe6562da420f34a255e8627606163f

                                            SHA1

                                            60495c649ded993d3981499acf9a452f9e17148a

                                            SHA256

                                            e4dbaa64aa87c96dfe525723229d78e4e864078239479f1a32c52f9a8cff6b8c

                                            SHA512

                                            c40342687d0eb8b9dd8cb90286e3ea717949f202e94cab6a33d82d97219edf8d0e94d7c7b51fb83b4f5175e214ef019fec05ef3d9769feccffbe351511d773e3

                                          • C:\nEwb0Rn.exe

                                            Filesize

                                            44KB

                                            MD5

                                            127a086e44ad602d2c91fcbc3504fc13

                                            SHA1

                                            4d59c22fa4319c4093d56a19132b8dbee12914e6

                                            SHA256

                                            f3aa31f44115d2af5993e1e9645321c05115acf71520d250312beb7fd51327c1

                                            SHA512

                                            d0be7ae8ffa7cf4f2b8ba183b210bfc12d271da139aa58d39fb5ef3855e12f58ffe6c2c0a0c898e3f2f6acf88bd295b88581e7cd4666a3310a1ea07a440fb061

                                          • memory/116-232-0x0000000000400000-0x000000000043B000-memory.dmp

                                            Filesize

                                            236KB

                                          • memory/556-258-0x0000000000400000-0x000000000043B000-memory.dmp

                                            Filesize

                                            236KB

                                          • memory/564-157-0x0000000000400000-0x000000000043B000-memory.dmp

                                            Filesize

                                            236KB

                                          • memory/564-132-0x0000000000400000-0x000000000043B000-memory.dmp

                                            Filesize

                                            236KB

                                          • memory/692-187-0x0000000000400000-0x000000000043B000-memory.dmp

                                            Filesize

                                            236KB

                                          • memory/1528-143-0x0000000000400000-0x000000000043B000-memory.dmp

                                            Filesize

                                            236KB

                                          • memory/1972-231-0x0000000000400000-0x000000000043B000-memory.dmp

                                            Filesize

                                            236KB

                                          • memory/2084-174-0x0000000000400000-0x000000000043B000-memory.dmp

                                            Filesize

                                            236KB

                                          • memory/2108-257-0x0000000000400000-0x000000000043B000-memory.dmp

                                            Filesize

                                            236KB

                                          • memory/3136-241-0x0000000000400000-0x000000000043B000-memory.dmp

                                            Filesize

                                            236KB

                                          • memory/3240-239-0x0000000000400000-0x000000000043B000-memory.dmp

                                            Filesize

                                            236KB

                                          • memory/3492-173-0x0000000000400000-0x000000000043B000-memory.dmp

                                            Filesize

                                            236KB

                                          • memory/3504-269-0x0000000000400000-0x000000000043B000-memory.dmp

                                            Filesize

                                            236KB

                                          • memory/3628-270-0x0000000000400000-0x000000000043B000-memory.dmp

                                            Filesize

                                            236KB

                                          • memory/3720-259-0x0000000000400000-0x000000000043B000-memory.dmp

                                            Filesize

                                            236KB

                                          • memory/3756-245-0x0000000000400000-0x000000000043B000-memory.dmp

                                            Filesize

                                            236KB

                                          • memory/3868-256-0x0000000000400000-0x000000000043B000-memory.dmp

                                            Filesize

                                            236KB

                                          • memory/4420-278-0x0000000000400000-0x000000000043B000-memory.dmp

                                            Filesize

                                            236KB

                                          • memory/4500-144-0x0000000000400000-0x000000000043B000-memory.dmp

                                            Filesize

                                            236KB

                                          • memory/4632-271-0x0000000000400000-0x000000000043B000-memory.dmp

                                            Filesize

                                            236KB

                                          • memory/4956-175-0x0000000000400000-0x000000000043B000-memory.dmp

                                            Filesize

                                            236KB