Analysis

  • max time kernel
    153s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-11-2022 07:59

General

  • Target

    0a1fdee1f4689277a8a1c28a5d1480318165cee9214fc9cc1e713c40d1dc8e37.exe

  • Size

    16.8MB

  • MD5

    3bb0f3e6002f2cb6e31ffb5d37b8597f

  • SHA1

    1ffb6bfade784a8ab31b08a16b74d8e9cc539d5c

  • SHA256

    0a1fdee1f4689277a8a1c28a5d1480318165cee9214fc9cc1e713c40d1dc8e37

  • SHA512

    19c392ddb6f8359f441bf207f89e4b8ec3fca559f6b520abbdf6a5eb978bf689345d91a82202c4fbea18cb4bc8d31ad10a3bceddef5889dc837c20c757b8404a

  • SSDEEP

    393216:osY3LfRJUA5K2ypy0BKDLmtRmzQU/ztTYggQVvhTLgV6vCV:os85KA5K290knemzQ+YggAvVLRv0

Score
8/10
upx

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 64 IoCs
  • Drops file in System32 directory 2 IoCs
  • Kills process with taskkill 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: LoadsDriver 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0a1fdee1f4689277a8a1c28a5d1480318165cee9214fc9cc1e713c40d1dc8e37.exe
    "C:\Users\Admin\AppData\Local\Temp\0a1fdee1f4689277a8a1c28a5d1480318165cee9214fc9cc1e713c40d1dc8e37.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3020
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\jjh.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2748
      • C:\Users\Admin\AppData\Local\Temp\jjh.exe
        C:\Users\Admin\AppData\Local\Temp\jjh.exe
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in System32 directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: LoadsDriver
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4460
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /im GamePlaza.exe
          4⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:2888
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c "C:\Users\Admin\AppData\Local\Temp\jjhgame.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:928
      • C:\Users\Admin\AppData\Local\Temp\jjhgame.exe
        C:\Users\Admin\AppData\Local\Temp\jjhgame.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4800
        • C:\Users\Admin\AppData\Local\Temp\is-5Q8S7.tmp\jjhgame.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-5Q8S7.tmp\jjhgame.tmp" /SL5="$80054,17180831,52736,C:\Users\Admin\AppData\Local\Temp\jjhgame.exe"
          4⤵
          • Executes dropped EXE
          PID:4412

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\jjh.exe
    Filesize

    47KB

    MD5

    20670912d56284bdde833cd36c9a71af

    SHA1

    11ffc1a47605f08452cb8ceb99e4fcbbbd6e0b84

    SHA256

    68f58394bc9617a62931fc7ff2a00515272a3e8c7a255468a1d9cb45c3c64199

    SHA512

    66719f7a6456473acfb3a7fd70301b1566f1719184b8569a825bbad7ec04b127f8474d175d0d6f9255ea86b2c31041b32c13299e83b3d24a72ee0e4b04b73144

  • C:\Users\Admin\AppData\Local\Temp\jjh.exe
    Filesize

    47KB

    MD5

    20670912d56284bdde833cd36c9a71af

    SHA1

    11ffc1a47605f08452cb8ceb99e4fcbbbd6e0b84

    SHA256

    68f58394bc9617a62931fc7ff2a00515272a3e8c7a255468a1d9cb45c3c64199

    SHA512

    66719f7a6456473acfb3a7fd70301b1566f1719184b8569a825bbad7ec04b127f8474d175d0d6f9255ea86b2c31041b32c13299e83b3d24a72ee0e4b04b73144

  • C:\Users\Admin\AppData\Local\Temp\jjhgame.exe
    Filesize

    16.7MB

    MD5

    a906f2e94557af760b72ab9582ccfaa2

    SHA1

    186718a01fc48c5c58472a36c0fe63df22f248a4

    SHA256

    083c5d755f9e18d126291109090fa050fe7bc5a9a32d0668f520c7643ee302fc

    SHA512

    29679f9ed28106177bdc71901059dbf0683a739fe0566c29b630c358663beff1c502e296ff5e2bba1eddd89f44f7c1e27e5e9c81028ebc6e84d07929b7a10257

  • C:\Users\Admin\AppData\Local\Temp\jjhgame.exe
    Filesize

    16.7MB

    MD5

    a906f2e94557af760b72ab9582ccfaa2

    SHA1

    186718a01fc48c5c58472a36c0fe63df22f248a4

    SHA256

    083c5d755f9e18d126291109090fa050fe7bc5a9a32d0668f520c7643ee302fc

    SHA512

    29679f9ed28106177bdc71901059dbf0683a739fe0566c29b630c358663beff1c502e296ff5e2bba1eddd89f44f7c1e27e5e9c81028ebc6e84d07929b7a10257

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • C:\Windows\SysWOW64\zzxxcck.dll
    Filesize

    49KB

    MD5

    3d7d9d68292c30a129a3f77720cc7060

    SHA1

    712a681d0ba209daa3dbbffe0a98cdb03ad9b86e

    SHA256

    544b597fa64b7c1b3fdf1f265bdbd6c83c1c7d015fed0a7e8594edc25d5df169

    SHA512

    8e7d5ff12d1a5f8c23ad3f71c799082367a9f99e93f8bad62e72f29681124e8be9849b610413c7973a73786e3e370bb87b5eec0b7b08503d187bfa93e80a3647

  • memory/928-137-0x0000000000000000-mapping.dmp
  • memory/2748-132-0x0000000000000000-mapping.dmp
  • memory/2888-136-0x0000000000000000-mapping.dmp
  • memory/4412-205-0x0000000000000000-mapping.dmp
  • memory/4412-206-0x0000000003211000-0x0000000003213000-memory.dmp
    Filesize

    8KB

  • memory/4460-173-0x0000000000400000-0x0000000000415000-memory.dmp
    Filesize

    84KB

  • memory/4460-133-0x0000000000000000-mapping.dmp
  • memory/4800-204-0x0000000000400000-0x0000000000414000-memory.dmp
    Filesize

    80KB

  • memory/4800-170-0x0000000000400000-0x0000000000414000-memory.dmp
    Filesize

    80KB

  • memory/4800-146-0x0000000000000000-mapping.dmp
  • memory/4800-207-0x0000000000400000-0x0000000000414000-memory.dmp
    Filesize

    80KB