Analysis

  • max time kernel
    210s
  • max time network
    32s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    24-11-2022 07:59

General

  • Target

    0a1fdee1f4689277a8a1c28a5d1480318165cee9214fc9cc1e713c40d1dc8e37.exe

  • Size

    16.8MB

  • MD5

    3bb0f3e6002f2cb6e31ffb5d37b8597f

  • SHA1

    1ffb6bfade784a8ab31b08a16b74d8e9cc539d5c

  • SHA256

    0a1fdee1f4689277a8a1c28a5d1480318165cee9214fc9cc1e713c40d1dc8e37

  • SHA512

    19c392ddb6f8359f441bf207f89e4b8ec3fca559f6b520abbdf6a5eb978bf689345d91a82202c4fbea18cb4bc8d31ad10a3bceddef5889dc837c20c757b8404a

  • SSDEEP

    393216:osY3LfRJUA5K2ypy0BKDLmtRmzQU/ztTYggQVvhTLgV6vCV:os85KA5K290knemzQ+YggAvVLRv0

Score
8/10
upx

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 64 IoCs
  • Drops file in System32 directory 2 IoCs
  • Kills process with taskkill 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: LoadsDriver 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0a1fdee1f4689277a8a1c28a5d1480318165cee9214fc9cc1e713c40d1dc8e37.exe
    "C:\Users\Admin\AppData\Local\Temp\0a1fdee1f4689277a8a1c28a5d1480318165cee9214fc9cc1e713c40d1dc8e37.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1096
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\jjh.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:820
      • C:\Users\Admin\AppData\Local\Temp\jjh.exe
        C:\Users\Admin\AppData\Local\Temp\jjh.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: LoadsDriver
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1636
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im GamePlaza.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:1476
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\jjhgame.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1276
      • C:\Users\Admin\AppData\Local\Temp\jjhgame.exe
        C:\Users\Admin\AppData\Local\Temp\jjhgame.exe
        3⤵
        • Executes dropped EXE
        PID:572

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\jjh.exe

    Filesize

    47KB

    MD5

    20670912d56284bdde833cd36c9a71af

    SHA1

    11ffc1a47605f08452cb8ceb99e4fcbbbd6e0b84

    SHA256

    68f58394bc9617a62931fc7ff2a00515272a3e8c7a255468a1d9cb45c3c64199

    SHA512

    66719f7a6456473acfb3a7fd70301b1566f1719184b8569a825bbad7ec04b127f8474d175d0d6f9255ea86b2c31041b32c13299e83b3d24a72ee0e4b04b73144

  • C:\Users\Admin\AppData\Local\Temp\jjh.exe

    Filesize

    47KB

    MD5

    20670912d56284bdde833cd36c9a71af

    SHA1

    11ffc1a47605f08452cb8ceb99e4fcbbbd6e0b84

    SHA256

    68f58394bc9617a62931fc7ff2a00515272a3e8c7a255468a1d9cb45c3c64199

    SHA512

    66719f7a6456473acfb3a7fd70301b1566f1719184b8569a825bbad7ec04b127f8474d175d0d6f9255ea86b2c31041b32c13299e83b3d24a72ee0e4b04b73144

  • C:\Users\Admin\AppData\Local\Temp\jjhgame.exe

    Filesize

    16.7MB

    MD5

    a906f2e94557af760b72ab9582ccfaa2

    SHA1

    186718a01fc48c5c58472a36c0fe63df22f248a4

    SHA256

    083c5d755f9e18d126291109090fa050fe7bc5a9a32d0668f520c7643ee302fc

    SHA512

    29679f9ed28106177bdc71901059dbf0683a739fe0566c29b630c358663beff1c502e296ff5e2bba1eddd89f44f7c1e27e5e9c81028ebc6e84d07929b7a10257

  • C:\Users\Admin\AppData\Local\Temp\jjhgame.exe

    Filesize

    16.7MB

    MD5

    a906f2e94557af760b72ab9582ccfaa2

    SHA1

    186718a01fc48c5c58472a36c0fe63df22f248a4

    SHA256

    083c5d755f9e18d126291109090fa050fe7bc5a9a32d0668f520c7643ee302fc

    SHA512

    29679f9ed28106177bdc71901059dbf0683a739fe0566c29b630c358663beff1c502e296ff5e2bba1eddd89f44f7c1e27e5e9c81028ebc6e84d07929b7a10257

  • \Users\Admin\AppData\Local\Temp\jjh.exe

    Filesize

    47KB

    MD5

    20670912d56284bdde833cd36c9a71af

    SHA1

    11ffc1a47605f08452cb8ceb99e4fcbbbd6e0b84

    SHA256

    68f58394bc9617a62931fc7ff2a00515272a3e8c7a255468a1d9cb45c3c64199

    SHA512

    66719f7a6456473acfb3a7fd70301b1566f1719184b8569a825bbad7ec04b127f8474d175d0d6f9255ea86b2c31041b32c13299e83b3d24a72ee0e4b04b73144

  • \Users\Admin\AppData\Local\Temp\jjh.exe

    Filesize

    47KB

    MD5

    20670912d56284bdde833cd36c9a71af

    SHA1

    11ffc1a47605f08452cb8ceb99e4fcbbbd6e0b84

    SHA256

    68f58394bc9617a62931fc7ff2a00515272a3e8c7a255468a1d9cb45c3c64199

    SHA512

    66719f7a6456473acfb3a7fd70301b1566f1719184b8569a825bbad7ec04b127f8474d175d0d6f9255ea86b2c31041b32c13299e83b3d24a72ee0e4b04b73144

  • \Users\Admin\AppData\Local\Temp\jjhgame.exe

    Filesize

    16.7MB

    MD5

    a906f2e94557af760b72ab9582ccfaa2

    SHA1

    186718a01fc48c5c58472a36c0fe63df22f248a4

    SHA256

    083c5d755f9e18d126291109090fa050fe7bc5a9a32d0668f520c7643ee302fc

    SHA512

    29679f9ed28106177bdc71901059dbf0683a739fe0566c29b630c358663beff1c502e296ff5e2bba1eddd89f44f7c1e27e5e9c81028ebc6e84d07929b7a10257

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • \Windows\SysWOW64\zzxxcck.dll

    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • memory/572-68-0x0000000075991000-0x0000000075993000-memory.dmp

    Filesize

    8KB

  • memory/572-64-0x0000000000000000-mapping.dmp

  • memory/572-70-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/820-73-0x00000000000B0000-0x00000000000C5000-memory.dmp

    Filesize

    84KB

  • memory/820-67-0x00000000000B0000-0x00000000000C5000-memory.dmp

    Filesize

    84KB

  • memory/820-66-0x00000000000B0000-0x00000000000C5000-memory.dmp

    Filesize

    84KB

  • memory/820-54-0x0000000000000000-mapping.dmp

  • memory/1276-60-0x0000000000000000-mapping.dmp

  • memory/1476-61-0x0000000000000000-mapping.dmp

  • memory/1636-69-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/1636-58-0x0000000000000000-mapping.dmp