Analysis
- max time kernel
51s - max time network
160s - platform
windows7_x64 - resource
win7-20230712-en - resource tags
- submitted
14/07/2023, 23:19
General
- Target file.exe
- Size 163KB
- Sample230714-3av6zagd39
- SHA256 b9306a1ff3a02986f4b71b996d129f7db35002d46a1d09b56faf23bc37d14577
Malware Config
Extracted
-
smokeloader
-
2022
-
http://potunulit.org/
-
http://hutnilior.net/
-
http://bulimu55t.net/
-
http://soryytlic4.net/
-
http://novanosa5org.org/
-
http://nuljjjnuli.org/
-
http://tolilolihul.net/
-
http://somatoka51hub.net/
-
http://hujukui3.net/
-
http://bukubuka1.net/
-
http://golilopaster.org/
-
http://newzelannd66.org/
-
http://otriluyttn.org/
Extracted
-
djvu
-
http://zexeq.com/lancer/get.php
-
extension
.gaqq
-
offline_id
idjLJVXs65t0hiY0Usr4A1G0xEEwvvs9JcZKN0t1
-
payload_url
http://colisumy.com/dl/build2.exe
http://zexeq.com/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-ZyZya4Vb8D Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0742JOsie
Extracted
-
amadey
-
3.83
-
5.42.65.80/8bmeVwqx/index.php
Extracted
-
gcleaner
-
45.12.253.56
-
45.12.253.72
-
45.12.253.98
-
45.12.253.75
Extracted
-
smokeloader
-
up3
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Detected Djvu ransomware 10 IoCs
- Djvu Ransomware
Ransomware which is a variant of the STOP family.
- GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Stops running service(s) 3 TTPs
- Deletes itself 1 IoCs
- Executes dropped EXE 11 IoCs
- Loads dropped DLL 6 IoCs
- Modifies file permissions 1 TTPs 1 IoCs
- Themida packer 7 IoCs
Detects Themida, an advanced Windows software protection system.
- Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 1 IoCs
- Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Kills process with taskkill 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 61 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\1D22.exeC:\Users\Admin\AppData\Local\Temp\1D22.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\aafg31.exe"C:\Users\Admin\AppData\Local\Temp\aafg31.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\oldplayer.exe"C:\Users\Admin\AppData\Local\Temp\oldplayer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe" /F4⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "oneetx.exe" /P "Admin:N"&&CACLS "oneetx.exe" /P "Admin:R" /E&&echo Y|CACLS "..\207aa4515d" /P "Admin:N"&&CACLS "..\207aa4515d" /P "Admin:R" /E&&Exit4⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:N"5⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "oneetx.exe" /P "Admin:R" /E5⤵
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\207aa4515d" /P "Admin:N"5⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"5⤵
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\207aa4515d" /P "Admin:R" /E5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000310001\setup.exe"C:\Users\Admin\AppData\Local\Temp\1000310001\setup.exe"4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "setup.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\1000310001\setup.exe" & exit5⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "setup.exe" /f6⤵
- Kills process with taskkill
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000186001\updEdge.exe"C:\Users\Admin\AppData\Local\Temp\1000186001\updEdge.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1000279001\notepad.exe"C:\Users\Admin\AppData\Local\Temp\1000279001\notepad.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1000186001\updEdge.exe"C:\Users\Admin\AppData\Local\Temp\1000186001\updEdge.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1000311001\toolspub2.exe"C:\Users\Admin\AppData\Local\Temp\1000311001\toolspub2.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\1000311001\toolspub2.exe"C:\Users\Admin\AppData\Local\Temp\1000311001\toolspub2.exe"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\1000279001\notepad.exe"C:\Users\Admin\AppData\Local\Temp\1000279001\notepad.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1000187001\updChrome.exe"C:\Users\Admin\AppData\Local\Temp\1000187001\updChrome.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1000187001\updChrome.exe"C:\Users\Admin\AppData\Local\Temp\1000187001\updChrome.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1000186001\updEdge.exe"C:\Users\Admin\AppData\Local\Temp\1000186001\updEdge.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1000279001\notepad.exe"C:\Users\Admin\AppData\Local\Temp\1000279001\notepad.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1000312001\3eef203fb515bda85f514e168abb5973.exe"C:\Users\Admin\AppData\Local\Temp\1000312001\3eef203fb515bda85f514e168abb5973.exe"4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\1000187001\updChrome.exe"C:\Users\Admin\AppData\Local\Temp\1000187001\updChrome.exe"4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\XandETC.exe"C:\Users\Admin\AppData\Local\Temp\XandETC.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\22ED.exeC:\Users\Admin\AppData\Local\Temp\22ED.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\22ED.exeC:\Users\Admin\AppData\Local\Temp\22ED.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\fc85fc89-8b2c-46bb-a371-60583cb1f7dd" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
-
-
C:\Users\Admin\AppData\Local\Temp\22ED.exe"C:\Users\Admin\AppData\Local\Temp\22ED.exe" --Admin IsNotAutoStart IsNotTask3⤵
-
C:\Users\Admin\AppData\Local\Temp\22ED.exe"C:\Users\Admin\AppData\Local\Temp\22ED.exe" --Admin IsNotAutoStart IsNotTask4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\2426.exeC:\Users\Admin\AppData\Local\Temp\2426.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2426.exeC:\Users\Admin\AppData\Local\Temp\2426.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\2426.exe"C:\Users\Admin\AppData\Local\Temp\2426.exe" --Admin IsNotAutoStart IsNotTask3⤵
-
C:\Users\Admin\AppData\Local\Temp\2426.exe"C:\Users\Admin\AppData\Local\Temp\2426.exe" --Admin IsNotAutoStart IsNotTask4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\256E.exeC:\Users\Admin\AppData\Local\Temp\256E.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\256E.exeC:\Users\Admin\AppData\Local\Temp\256E.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\256E.exe"C:\Users\Admin\AppData\Local\Temp\256E.exe" --Admin IsNotAutoStart IsNotTask3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\2CFE.exeC:\Users\Admin\AppData\Local\Temp\2CFE.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\2CFE.exeC:\Users\Admin\AppData\Local\Temp\2CFE.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\2CFE.exe"C:\Users\Admin\AppData\Local\Temp\2CFE.exe" --Admin IsNotAutoStart IsNotTask3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\347D.exeC:\Users\Admin\AppData\Local\Temp\347D.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\347D.exeC:\Users\Admin\AppData\Local\Temp\347D.exe2⤵
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {D8B5B7C8-90BF-4A2A-AA74-38E1C10329B8} S-1-5-21-1024678951-1535676557-2778719785-1000:KDGGTDCU\Admin:Interactive:[1]1⤵
-
C:\Users\Admin\AppData\Roaming\jwubejbC:\Users\Admin\AppData\Roaming\jwubejb2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exeC:\Users\Admin\AppData\Local\Temp\207aa4515d\oneetx.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\55D4.exeC:\Users\Admin\AppData\Local\Temp\55D4.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\aafg31.exe"C:\Users\Admin\AppData\Local\Temp\aafg31.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\oldplayer.exe"C:\Users\Admin\AppData\Local\Temp\oldplayer.exe"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2168 -s 9282⤵
- Program crash
-
-
C:\Users\Admin\AppData\Local\Temp\6159.exeC:\Users\Admin\AppData\Local\Temp\6159.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\6159.exeC:\Users\Admin\AppData\Local\Temp\6159.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\8DD6.exeC:\Users\Admin\AppData\Local\Temp\8DD6.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\aafg31.exe"C:\Users\Admin\AppData\Local\Temp\aafg31.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\oldplayer.exe"C:\Users\Admin\AppData\Local\Temp\oldplayer.exe"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 5002⤵
- Program crash
-
-
C:\Users\Admin\AppData\Local\Temp\E402.exeC:\Users\Admin\AppData\Local\Temp\E402.exe1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#wsyzqeupt#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'NoteUpdateTaskMachineQC' /tr '''C:\Program Files\Notepad\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Notepad\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'NoteUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "NoteUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Program Files\Notepad\Chrome\updater.exe' }1⤵
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /f /sc onlogon /rl highest /ru System /tn NoteUpdateTaskMachineQC /tr "'C:\Program Files\Notepad\Chrome\updater.exe'"2⤵
- Creates scheduled task(s)
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 01⤵
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-ac 02⤵
-
-
C:\Windows\System32\powercfg.exepowercfg /x -hibernate-timeout-dc 02⤵
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-ac 02⤵
-
-
C:\Windows\System32\powercfg.exepowercfg /x -standby-timeout-dc 02⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f & reg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f1⤵
-
C:\Windows\System32\sc.exesc stop UsoSvc2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop wuauserv2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop bits2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop dosvc2⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\UsoSvc" /f2⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /f2⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /f2⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\bits" /f2⤵
-
-
C:\Windows\System32\reg.exereg delete "HKLM\SYSTEM\CurrentControlSet\Services\dosvc" /f2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#iqegjinl#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "NoteUpdateTaskMachineQC" } Else { "C:\Program Files\Notepad\Chrome\updater.exe" }1⤵
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /run /tn NoteUpdateTaskMachineQC2⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc1⤵
-
C:\Windows\System32\sc.exesc stop UsoSvc2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop WaaSMedicSvc2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop wuauserv2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop bits2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc stop dosvc2⤵
- Launches sc.exe
-
-
C:\Users\Admin\AppData\Local\Temp\ADF5.exeC:\Users\Admin\AppData\Local\Temp\ADF5.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\oldplayer.exe"C:\Users\Admin\AppData\Local\Temp\oldplayer.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\aafg31.exe"C:\Users\Admin\AppData\Local\Temp\aafg31.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\XandETC.exe"C:\Users\Admin\AppData\Local\Temp\XandETC.exe"2⤵
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {B28F0EA6-BA41-4A5B-B0DF-DAF9904D146B} S-1-5-18:NT AUTHORITY\System:Service:1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#qbjrr#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }1⤵
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 01⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
updEdge.exe
updEdge.exe
updEdge.exe
updChrome.exe
notepad.exe
notepad.exe
setup.exe
setup.exe
setup.exe
toolspub2.exe
3eef203fb515bda85f514e168abb5973.exe
1D22.exe
1D22.exe
oneetx.exe
oneetx.exe
oneetx.exe
22ED.exe
22ED.exe
22ED.exe
22ED.exe
2426.exe
2426.exe
256E.exe
256E.exe
256E.exe
256E.exe
2CFE.exe
2CFE.exe
2CFE.exe
347D.exe
55D4.exe
55D4.exe
55D4.exe
6159.exe
8DD6.exe
8DD6.exe
Cab7E27.tmp
TarA21E.tmp
XandETC.exe
XandETC.exe
aafg31.exe
aafg31.exe
aafg31.exe
aafg31.exe
aafg31.exe
aafg31.exe
oldplayer.exe
oldplayer.exe
oldplayer.exe
oldplayer.exe
oldplayer.exe
3L78YH5RWXO0XEH4M1XL.temp
jwubejb
jwubejb
updEdge.exe
updEdge.exe
notepad.exe
setup.exe
setup.exe
setup.exe
setup.exe
toolspub2.exe
oneetx.exe
22ED.exe
2426.exe
256E.exe
2CFE.exe
55D4.exe
55D4.exe
55D4.exe
55D4.exe
55D4.exe
XandETC.exe
aafg31.exe
aafg31.exe
aafg31.exe
oldplayer.exe
oldplayer.exe
oldplayer.exe
memory/596-407-0x0000000000220000-0x0000000000229000-memory.dmp
memory/596-404-0x0000000001C04000-0x0000000001C17000-memory.dmp
memory/812-366-0x0000000003D30000-0x0000000004298000-memory.dmp
memory/812-371-0x0000000003C10000-0x000000000452D000-memory.dmp
memory/816-421-0x00000000009E0000-0x0000000000F48000-memory.dmp
memory/816-453-0x0000000075510000-0x0000000075557000-memory.dmp
memory/816-496-0x00000000004F0000-0x000000000050C000-memory.dmp
memory/816-395-0x00000000009E0000-0x0000000000F48000-memory.dmp
memory/1068-540-0x0000000002320000-0x0000000002328000-memory.dmp
memory/1172-128-0x0000000000220000-0x00000000002B1000-memory.dmp
memory/1172-433-0x0000000000220000-0x00000000002B1000-memory.dmp
memory/1340-66-0x000007FEF59E0000-0x000007FEF5B23000-memory.dmp
memory/1340-64-0x000007FEF59E0000-0x000007FEF5B23000-memory.dmp
memory/1340-65-0x000007FF2FAD0000-0x000007FF2FADA000-memory.dmp
memory/1340-59-0x0000000002620000-0x0000000002636000-memory.dmp
memory/1392-256-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/1392-274-0x0000000000400000-0x0000000000537000-memory.dmp
memory/1392-440-0x0000000000400000-0x0000000000537000-memory.dmp
memory/1624-382-0x0000000075800000-0x0000000075910000-memory.dmp
memory/1624-380-0x0000000075800000-0x0000000075910000-memory.dmp
memory/1624-394-0x0000000075800000-0x0000000075910000-memory.dmp
memory/1624-397-0x0000000075800000-0x0000000075910000-memory.dmp
memory/1624-392-0x0000000075800000-0x0000000075910000-memory.dmp
memory/1624-388-0x0000000075800000-0x0000000075910000-memory.dmp
memory/1624-307-0x00000000009E0000-0x0000000000F48000-memory.dmp
memory/1624-326-0x0000000075800000-0x0000000075910000-memory.dmp
memory/1624-359-0x0000000075510000-0x0000000075557000-memory.dmp
memory/1624-378-0x0000000075800000-0x0000000075910000-memory.dmp
memory/1624-376-0x0000000075800000-0x0000000075910000-memory.dmp
memory/1624-375-0x0000000075800000-0x0000000075910000-memory.dmp
memory/1636-152-0x0000000000220000-0x0000000000221000-memory.dmp
memory/1784-402-0x0000000000400000-0x0000000000409000-memory.dmp
memory/1840-183-0x0000000000220000-0x00000000002B1000-memory.dmp
memory/1852-410-0x0000000000C90000-0x00000000015AD000-memory.dmp
memory/1852-405-0x0000000000C90000-0x00000000015AD000-memory.dmp
memory/1852-430-0x0000000000C90000-0x00000000015AD000-memory.dmp
memory/1852-409-0x0000000000C90000-0x00000000015AD000-memory.dmp
memory/1852-413-0x0000000000C90000-0x00000000015AD000-memory.dmp
memory/1852-422-0x0000000000C90000-0x00000000015AD000-memory.dmp
memory/1852-401-0x0000000000C90000-0x00000000015AD000-memory.dmp
memory/1852-396-0x0000000000C90000-0x00000000015AD000-memory.dmp
memory/1852-412-0x0000000000C90000-0x00000000015AD000-memory.dmp
memory/1940-181-0x00000000FF870000-0x00000000FF9CF000-memory.dmp
memory/2096-95-0x0000000000220000-0x00000000002B1000-memory.dmp
memory/2096-309-0x0000000000220000-0x00000000002B1000-memory.dmp
memory/2152-406-0x0000000000400000-0x0000000000537000-memory.dmp
memory/2152-548-0x0000000000400000-0x0000000000537000-memory.dmp
memory/2168-166-0x0000000000020000-0x000000000056A000-memory.dmp
memory/2168-229-0x0000000072FF0000-0x00000000736DE000-memory.dmp
memory/2168-167-0x0000000072FF0000-0x00000000736DE000-memory.dmp
memory/2168-255-0x0000000005270000-0x00000000053CF000-memory.dmp
memory/2168-174-0x0000000005270000-0x00000000053CF000-memory.dmp
memory/2296-273-0x0000000001130000-0x000000000167A000-memory.dmp
memory/2296-272-0x0000000072FF0000-0x00000000736DE000-memory.dmp
memory/2296-360-0x0000000005260000-0x00000000053BF000-memory.dmp
memory/2304-257-0x0000000000220000-0x00000000002B1000-memory.dmp
memory/2304-119-0x0000000000220000-0x00000000002B1000-memory.dmp
memory/2368-541-0x0000000000400000-0x0000000001B5A000-memory.dmp
memory/2368-530-0x0000000000280000-0x0000000000380000-memory.dmp
memory/2368-277-0x0000000000280000-0x0000000000380000-memory.dmp
memory/2368-279-0x0000000001BA0000-0x0000000001BE0000-memory.dmp
memory/2368-349-0x0000000000400000-0x0000000001B5A000-memory.dmp
memory/2368-297-0x0000000000400000-0x0000000001B5A000-memory.dmp
memory/2572-58-0x0000000000400000-0x00000000004E3000-memory.dmp
memory/2572-56-0x0000000000220000-0x0000000000229000-memory.dmp
memory/2572-55-0x00000000006A0000-0x00000000007A0000-memory.dmp
memory/2572-57-0x0000000000400000-0x00000000004E3000-memory.dmp
memory/2572-63-0x0000000000220000-0x0000000000229000-memory.dmp
memory/2572-60-0x0000000000400000-0x00000000004E3000-memory.dmp
memory/2608-494-0x000000001B270000-0x000000001B552000-memory.dmp
memory/2704-194-0x000000013F6C0000-0x000000013FA7D000-memory.dmp
memory/2732-109-0x0000000000400000-0x0000000000537000-memory.dmp
memory/2732-121-0x0000000000400000-0x0000000000537000-memory.dmp
memory/2732-425-0x0000000000400000-0x0000000000537000-memory.dmp
memory/2732-517-0x0000000000400000-0x0000000000537000-memory.dmp
memory/2732-120-0x0000000000400000-0x0000000000537000-memory.dmp
memory/2764-344-0x00000000FF430000-0x00000000FF58F000-memory.dmp
memory/2832-101-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2836-102-0x0000000003450000-0x000000000356B000-memory.dmp
memory/2836-96-0x0000000001BD0000-0x0000000001C61000-memory.dmp
memory/2836-100-0x0000000001BD0000-0x0000000001C61000-memory.dmp
memory/2876-75-0x0000000000370000-0x00000000008BA000-memory.dmp
memory/2876-147-0x0000000073F00000-0x00000000745EE000-memory.dmp
memory/2876-135-0x0000000073F00000-0x00000000745EE000-memory.dmp
memory/2876-133-0x0000000005360000-0x00000000054BF000-memory.dmp
memory/2876-76-0x0000000073F00000-0x00000000745EE000-memory.dmp
memory/2904-97-0x0000000001C40000-0x0000000001CD1000-memory.dmp
memory/2904-159-0x0000000001C40000-0x0000000001CD1000-memory.dmp
memory/2904-111-0x0000000001C40000-0x0000000001CD1000-memory.dmp
memory/3016-381-0x0000000000C90000-0x00000000015AD000-memory.dmp
memory/3016-408-0x0000000000C90000-0x00000000015AD000-memory.dmp
memory/3016-379-0x0000000000C90000-0x00000000015AD000-memory.dmp
memory/3016-377-0x0000000000C90000-0x00000000015AD000-memory.dmp
memory/3016-372-0x0000000000C90000-0x00000000015AD000-memory.dmp
memory/3016-367-0x0000000000C90000-0x00000000015AD000-memory.dmp
memory/3016-383-0x0000000000C90000-0x00000000015AD000-memory.dmp
memory/3016-385-0x0000000000C90000-0x00000000015AD000-memory.dmp
memory/3016-393-0x0000000000C90000-0x00000000015AD000-memory.dmp
memory/3016-390-0x0000000000C90000-0x00000000015AD000-memory.dmp
memory/3016-411-0x0000000000C90000-0x00000000015AD000-memory.dmp
memory/3060-134-0x00000000FF160000-0x00000000FF2BF000-memory.dmp