Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/10/2023, 01:39

General

  • Target

    949f0a4a78376e8a613ec8a16c2a9b14_JC.exe

  • Size

    119KB

  • MD5

    949f0a4a78376e8a613ec8a16c2a9b14

  • SHA1

    117bbb77a8e5b7f8765232e916af980082cd9145

  • SHA256

    109c52807b059ae772910d15af6c9ec1235a3f409fe5d6807c4510c6cb26497b

  • SHA512

    786eede7cd18dde9d697c19cdf2d10f2e0b1cbb54a91ada08d11829083372538fe3780f41f1b62ca9b58478f222d41180dd759907743f4ff24817e65c1548e6e

  • SSDEEP

    1536:ZGaq93mQy5PV4MSu4M3vfAlA89mWMMF4pzYU2qIUZ6kd+lW:Z5MaVVnLA0WLM0Uvh6kd+lW

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 12 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 12 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\949f0a4a78376e8a613ec8a16c2a9b14_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\949f0a4a78376e8a613ec8a16c2a9b14_JC.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3956
    • C:\Users\Admin\AppData\Local\Temp\Sysqemsokbl.exe
      "C:\Users\Admin\AppData\Local\Temp\Sysqemsokbl.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:5060
      • C:\Users\Admin\AppData\Local\Temp\Sysqemplitn.exe
        "C:\Users\Admin\AppData\Local\Temp\Sysqemplitn.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:4948
        • C:\Users\Admin\AppData\Local\Temp\Sysqemzlxcx.exe
          "C:\Users\Admin\AppData\Local\Temp\Sysqemzlxcx.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:1596
          • C:\Users\Admin\AppData\Local\Temp\Sysqemwbpfp.exe
            "C:\Users\Admin\AppData\Local\Temp\Sysqemwbpfp.exe"
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:4584
            • C:\Users\Admin\AppData\Local\Temp\Sysqemrstgs.exe
              "C:\Users\Admin\AppData\Local\Temp\Sysqemrstgs.exe"
              6⤵
              • Checks computer location settings
              • Executes dropped EXE
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:2084
              • C:\Users\Admin\AppData\Local\Temp\Sysqemojzll.exe
                "C:\Users\Admin\AppData\Local\Temp\Sysqemojzll.exe"
                7⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:4164
                • C:\Users\Admin\AppData\Local\Temp\Sysqemmvgka.exe
                  "C:\Users\Admin\AppData\Local\Temp\Sysqemmvgka.exe"
                  8⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Modifies registry class
                  • Suspicious use of WriteProcessMemory
                  PID:4192
                  • C:\Users\Admin\AppData\Local\Temp\Sysqemrumki.exe
                    "C:\Users\Admin\AppData\Local\Temp\Sysqemrumki.exe"
                    9⤵
                    • Checks computer location settings
                    • Executes dropped EXE
                    • Modifies registry class
                    • Suspicious use of WriteProcessMemory
                    PID:1652
                    • C:\Users\Admin\AppData\Local\Temp\Sysqemwgidy.exe
                      "C:\Users\Admin\AppData\Local\Temp\Sysqemwgidy.exe"
                      10⤵
                      • Checks computer location settings
                      • Executes dropped EXE
                      • Modifies registry class
                      • Suspicious use of WriteProcessMemory
                      PID:5060
                      • C:\Users\Admin\AppData\Local\Temp\Sysqembengd.exe
                        "C:\Users\Admin\AppData\Local\Temp\Sysqembengd.exe"
                        11⤵
                        • Checks computer location settings
                        • Executes dropped EXE
                        • Modifies registry class
                        • Suspicious use of WriteProcessMemory
                        PID:748
                        • C:\Users\Admin\AppData\Local\Temp\Sysqemosqhi.exe
                          "C:\Users\Admin\AppData\Local\Temp\Sysqemosqhi.exe"
                          12⤵
                          • Checks computer location settings
                          • Executes dropped EXE
                          • Modifies registry class
                          PID:5116
                          • C:\Users\Admin\AppData\Local\Temp\Sysqemwwdxr.exe
                            "C:\Users\Admin\AppData\Local\Temp\Sysqemwwdxr.exe"
                            13⤵
                              PID:4296
                              • C:\Users\Admin\AppData\Local\Temp\Sysqemwqmnl.exe
                                "C:\Users\Admin\AppData\Local\Temp\Sysqemwqmnl.exe"
                                14⤵
                                  PID:3080
                                  • C:\Users\Admin\AppData\Local\Temp\Sysqemjwphk.exe
                                    "C:\Users\Admin\AppData\Local\Temp\Sysqemjwphk.exe"
                                    15⤵
                                      PID:1096
                                      • C:\Users\Admin\AppData\Local\Temp\Sysqemlgszt.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Sysqemlgszt.exe"
                                        16⤵
                                          PID:2748
                                          • C:\Users\Admin\AppData\Local\Temp\Sysqemgqvvk.exe
                                            "C:\Users\Admin\AppData\Local\Temp\Sysqemgqvvk.exe"
                                            17⤵
                                              PID:4220
                                              • C:\Users\Admin\AppData\Local\Temp\Sysqemlrevm.exe
                                                "C:\Users\Admin\AppData\Local\Temp\Sysqemlrevm.exe"
                                                18⤵
                                                  PID:2224
                                                  • C:\Users\Admin\AppData\Local\Temp\Sysqemjhoda.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\Sysqemjhoda.exe"
                                                    19⤵
                                                      PID:776
                                                      • C:\Users\Admin\AppData\Local\Temp\Sysqemgxvdb.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\Sysqemgxvdb.exe"
                                                        20⤵
                                                          PID:4568
                                                          • C:\Users\Admin\AppData\Local\Temp\Sysqemlgfed.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\Sysqemlgfed.exe"
                                                            21⤵
                                                              PID:860
                                                              • C:\Users\Admin\AppData\Local\Temp\Sysqemtdzps.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\Sysqemtdzps.exe"
                                                                22⤵
                                                                  PID:5108
                                                                  • C:\Users\Admin\AppData\Local\Temp\Sysqemorpem.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\Sysqemorpem.exe"
                                                                    23⤵
                                                                      PID:3872
                                                                      • C:\Users\Admin\AppData\Local\Temp\Sysqembtxaj.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\Sysqembtxaj.exe"
                                                                        24⤵
                                                                          PID:3644
                                                                          • C:\Users\Admin\AppData\Local\Temp\Sysqemvoaiq.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\Sysqemvoaiq.exe"
                                                                            25⤵
                                                                              PID:5088
                                                                              • C:\Users\Admin\AppData\Local\Temp\Sysqemtixia.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\Sysqemtixia.exe"
                                                                                26⤵
                                                                                  PID:1032
                                                                                  • C:\Users\Admin\AppData\Local\Temp\Sysqemfrbdc.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\Sysqemfrbdc.exe"
                                                                                    27⤵
                                                                                      PID:3208
                                                                                      • C:\Users\Admin\AppData\Local\Temp\Sysqemlexwt.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\Sysqemlexwt.exe"
                                                                                        28⤵
                                                                                          PID:1200
                                                                                          • C:\Users\Admin\AppData\Local\Temp\Sysqemdpvzs.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\Sysqemdpvzs.exe"
                                                                                            29⤵
                                                                                              PID:2760
                                                                                              • C:\Users\Admin\AppData\Local\Temp\Sysqemnpjuq.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\Sysqemnpjuq.exe"
                                                                                                30⤵
                                                                                                  PID:776
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Sysqemlbfio.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Sysqemlbfio.exe"
                                                                                                    31⤵
                                                                                                      PID:4816
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Sysqemaudij.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Sysqemaudij.exe"
                                                                                                        32⤵
                                                                                                          PID:3648
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Sysqemagpay.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Sysqemagpay.exe"
                                                                                                            33⤵
                                                                                                              PID:1924
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Sysqemtuplu.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Sysqemtuplu.exe"
                                                                                                                34⤵
                                                                                                                  PID:556
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Sysqemnafop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Sysqemnafop.exe"
                                                                                                                    35⤵
                                                                                                                      PID:4404
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Sysqemnxvgy.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Sysqemnxvgy.exe"
                                                                                                                        36⤵
                                                                                                                          PID:420
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Sysqemdueuw.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Sysqemdueuw.exe"
                                                                                                                            37⤵
                                                                                                                              PID:8
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Sysqemsolet.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Sysqemsolet.exe"
                                                                                                                                38⤵
                                                                                                                                  PID:3608
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Sysqemxfrst.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Sysqemxfrst.exe"
                                                                                                                                    39⤵
                                                                                                                                      PID:4344
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Sysqemvrwdw.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Sysqemvrwdw.exe"
                                                                                                                                        40⤵
                                                                                                                                          PID:2268

                                                          Network

                                                          MITRE ATT&CK Enterprise v15

                                                          Replay Monitor

                                                          Loading Replay Monitor...

                                                          Downloads

                                                          • C:\Users\Admin\AppData\Local\Temp\Sysqamqqvaqqd.exe

                                                            Filesize

                                                            119KB

                                                            MD5

                                                            daebc2c17afa3f606dcb6f5f73cef5b5

                                                            SHA1

                                                            c32767d01871d9ae8452befca76b5997ae856202

                                                            SHA256

                                                            838fdc24f221b99a4c77b6a46111a3f3d7ef89712510cad9d0b9478dc5d53ca7

                                                            SHA512

                                                            eaaa05dc6ac74dee99553b339d803f686006e10f98b3ef1f9b0dc8bc362445bb546b04e276722cbb422e783bd46b42c1cef371cdb0f7bb07a413eb61c655103c

                                                          • C:\Users\Admin\AppData\Local\Temp\Sysqembengd.exe

                                                            Filesize

                                                            119KB

                                                            MD5

                                                            4ee8b796bedaf4175b6100b3568c550e

                                                            SHA1

                                                            cbe99ef4d230ad337afc7f8a18ff744f4cdff2c6

                                                            SHA256

                                                            7011b5470a1158704f3cb599361eea4b39efaa541a59773bb16962b843e001f4

                                                            SHA512

                                                            5f7da8ecddd34954092cf9983b25b724cbb54f3f234203a8297bfe72d8237ada5d4e994cbe1fa192ef1a8bfc38b5f7174c9fa86471448b0f93d6ce27811ebe2a

                                                          • C:\Users\Admin\AppData\Local\Temp\Sysqembengd.exe

                                                            Filesize

                                                            119KB

                                                            MD5

                                                            4ee8b796bedaf4175b6100b3568c550e

                                                            SHA1

                                                            cbe99ef4d230ad337afc7f8a18ff744f4cdff2c6

                                                            SHA256

                                                            7011b5470a1158704f3cb599361eea4b39efaa541a59773bb16962b843e001f4

                                                            SHA512

                                                            5f7da8ecddd34954092cf9983b25b724cbb54f3f234203a8297bfe72d8237ada5d4e994cbe1fa192ef1a8bfc38b5f7174c9fa86471448b0f93d6ce27811ebe2a

                                                          • C:\Users\Admin\AppData\Local\Temp\Sysqemgqvvk.exe

                                                            Filesize

                                                            119KB

                                                            MD5

                                                            34f3c588753e5fc5ce69c2cce10e0c3d

                                                            SHA1

                                                            a2841552d9bd6dfec3f5fae636c0582cc6f16d51

                                                            SHA256

                                                            a7a30d063464819a8c216451bb294d7119be87912d13efe68ed13baa57bfd7e6

                                                            SHA512

                                                            ab7d7a9df7b809b4726ba2f5c3221f4c8d2ccb76753c02161f99bc2fc91cd7431aee27ad8ab76fb230cae62a5323a7a5ea863cb3f749c182bd5c2ce662bfa153

                                                          • C:\Users\Admin\AppData\Local\Temp\Sysqemgqvvk.exe

                                                            Filesize

                                                            119KB

                                                            MD5

                                                            34f3c588753e5fc5ce69c2cce10e0c3d

                                                            SHA1

                                                            a2841552d9bd6dfec3f5fae636c0582cc6f16d51

                                                            SHA256

                                                            a7a30d063464819a8c216451bb294d7119be87912d13efe68ed13baa57bfd7e6

                                                            SHA512

                                                            ab7d7a9df7b809b4726ba2f5c3221f4c8d2ccb76753c02161f99bc2fc91cd7431aee27ad8ab76fb230cae62a5323a7a5ea863cb3f749c182bd5c2ce662bfa153

                                                          • C:\Users\Admin\AppData\Local\Temp\Sysqemjwphk.exe

                                                            Filesize

                                                            119KB

                                                            MD5

                                                            f9d40e94e08a506894696f1815341c03

                                                            SHA1

                                                            16fa8575dd7a405492dae074b4039c4489cd8d65

                                                            SHA256

                                                            3efb64f65897b7b8e171611bacab27fc3f71173574ac565709113676d9ccb416

                                                            SHA512

                                                            4981d56f1816028fdac9da1ee592fa7ad5d9c288217f5d6b6efaae645e1c2626ab28ec5156cc1280864b997d3ee7d40ea434c58e58bf10bdd840d37f160ea20d

                                                          • C:\Users\Admin\AppData\Local\Temp\Sysqemjwphk.exe

                                                            Filesize

                                                            119KB

                                                            MD5

                                                            f9d40e94e08a506894696f1815341c03

                                                            SHA1

                                                            16fa8575dd7a405492dae074b4039c4489cd8d65

                                                            SHA256

                                                            3efb64f65897b7b8e171611bacab27fc3f71173574ac565709113676d9ccb416

                                                            SHA512

                                                            4981d56f1816028fdac9da1ee592fa7ad5d9c288217f5d6b6efaae645e1c2626ab28ec5156cc1280864b997d3ee7d40ea434c58e58bf10bdd840d37f160ea20d

                                                          • C:\Users\Admin\AppData\Local\Temp\Sysqemlgszt.exe

                                                            Filesize

                                                            119KB

                                                            MD5

                                                            b58e98367b126f91231576eb357bab17

                                                            SHA1

                                                            fac7c364c750737d893c6d0e5599212e1f9a354e

                                                            SHA256

                                                            a32b9d61d35ef4efc7fee2d09fcd679562d1e9fc6fd9fd6a46fad17d201b689d

                                                            SHA512

                                                            cefc86de9c2f72d9f4aa52f800063c15a0ef7fe4f0cb225a7b0ef3d8b4d94130c360609551ad81df113e118df042fa6c73260d74f62f2392ff98cdd785b884a8

                                                          • C:\Users\Admin\AppData\Local\Temp\Sysqemlgszt.exe

                                                            Filesize

                                                            119KB

                                                            MD5

                                                            b58e98367b126f91231576eb357bab17

                                                            SHA1

                                                            fac7c364c750737d893c6d0e5599212e1f9a354e

                                                            SHA256

                                                            a32b9d61d35ef4efc7fee2d09fcd679562d1e9fc6fd9fd6a46fad17d201b689d

                                                            SHA512

                                                            cefc86de9c2f72d9f4aa52f800063c15a0ef7fe4f0cb225a7b0ef3d8b4d94130c360609551ad81df113e118df042fa6c73260d74f62f2392ff98cdd785b884a8

                                                          • C:\Users\Admin\AppData\Local\Temp\Sysqemlrevm.exe

                                                            Filesize

                                                            119KB

                                                            MD5

                                                            7311870c1d27699e95f118aa89a58555

                                                            SHA1

                                                            8e188d455c611ecc0e34e8d24a5973efd3f57747

                                                            SHA256

                                                            0bb061ece79a2ddff52953529f638d50919ec9ad0607c8e881d8729d1da89f5e

                                                            SHA512

                                                            da121263f0c493dd0213eeb4aaf3f6bf6950a597e2ab5d54e8cbbbf770087d46a85975974816a6190064879f95bc21e561e4011d9cb7e7c834e12196249f0801

                                                          • C:\Users\Admin\AppData\Local\Temp\Sysqemlrevm.exe

                                                            Filesize

                                                            119KB

                                                            MD5

                                                            7311870c1d27699e95f118aa89a58555

                                                            SHA1

                                                            8e188d455c611ecc0e34e8d24a5973efd3f57747

                                                            SHA256

                                                            0bb061ece79a2ddff52953529f638d50919ec9ad0607c8e881d8729d1da89f5e

                                                            SHA512

                                                            da121263f0c493dd0213eeb4aaf3f6bf6950a597e2ab5d54e8cbbbf770087d46a85975974816a6190064879f95bc21e561e4011d9cb7e7c834e12196249f0801

                                                          • C:\Users\Admin\AppData\Local\Temp\Sysqemmvgka.exe

                                                            Filesize

                                                            119KB

                                                            MD5

                                                            21a60feca4d71f76ed92474bf1509c5e

                                                            SHA1

                                                            5d1c9ab6bfbc86b454883a3a9b16101b75abfccb

                                                            SHA256

                                                            85b20123f7c14764236d6728d7f51b72bacaf79750838b916491a81cf4e65e67

                                                            SHA512

                                                            c6984d380cbbd41fb7ac668d259086fde2fd2f56ec4c129b56a1badd45dc787e7a4e43bf0ca10e0e0659f6439357835d2390b79971be4672f7f16e7bb00f99ed

                                                          • C:\Users\Admin\AppData\Local\Temp\Sysqemmvgka.exe

                                                            Filesize

                                                            119KB

                                                            MD5

                                                            21a60feca4d71f76ed92474bf1509c5e

                                                            SHA1

                                                            5d1c9ab6bfbc86b454883a3a9b16101b75abfccb

                                                            SHA256

                                                            85b20123f7c14764236d6728d7f51b72bacaf79750838b916491a81cf4e65e67

                                                            SHA512

                                                            c6984d380cbbd41fb7ac668d259086fde2fd2f56ec4c129b56a1badd45dc787e7a4e43bf0ca10e0e0659f6439357835d2390b79971be4672f7f16e7bb00f99ed

                                                          • C:\Users\Admin\AppData\Local\Temp\Sysqemojzll.exe

                                                            Filesize

                                                            119KB

                                                            MD5

                                                            467ab547df6c497d78c4535b0b820966

                                                            SHA1

                                                            5fef5f87b79b2505f709270c558de7143be75dbe

                                                            SHA256

                                                            2e60920dc2e5a169bd20c128c775dd0a091c5081040f712bcb0155d69b772b63

                                                            SHA512

                                                            73083d11952128d9c5ca72f497058e44fdb820d68dd22fa9c8437f68ce93bb5a3315385f1ad2f3c03e283606b21a0ddb94374f258acc64e7dee70c5a3c1cef73

                                                          • C:\Users\Admin\AppData\Local\Temp\Sysqemojzll.exe

                                                            Filesize

                                                            119KB

                                                            MD5

                                                            467ab547df6c497d78c4535b0b820966

                                                            SHA1

                                                            5fef5f87b79b2505f709270c558de7143be75dbe

                                                            SHA256

                                                            2e60920dc2e5a169bd20c128c775dd0a091c5081040f712bcb0155d69b772b63

                                                            SHA512

                                                            73083d11952128d9c5ca72f497058e44fdb820d68dd22fa9c8437f68ce93bb5a3315385f1ad2f3c03e283606b21a0ddb94374f258acc64e7dee70c5a3c1cef73

                                                          • C:\Users\Admin\AppData\Local\Temp\Sysqemosqhi.exe

                                                            Filesize

                                                            119KB

                                                            MD5

                                                            8e1f86dacd7be0bfbe313455150bf5ab

                                                            SHA1

                                                            0664a3d52898b4f2f84db79fce2c8df66a18faab

                                                            SHA256

                                                            ba7f1c319ced816e02b40c6dd0a2da93901f1802bad6ad43fee50c47588be5f8

                                                            SHA512

                                                            b0d13600f17c610e25fb08f0fb8a11919c3e26e6b9ea5356eee7d93007d79e2a383fd6fa3ce46ecde0de44d51ad613e22ec888c5f5d722bd41523b429c37f15c

                                                          • C:\Users\Admin\AppData\Local\Temp\Sysqemosqhi.exe

                                                            Filesize

                                                            119KB

                                                            MD5

                                                            8e1f86dacd7be0bfbe313455150bf5ab

                                                            SHA1

                                                            0664a3d52898b4f2f84db79fce2c8df66a18faab

                                                            SHA256

                                                            ba7f1c319ced816e02b40c6dd0a2da93901f1802bad6ad43fee50c47588be5f8

                                                            SHA512

                                                            b0d13600f17c610e25fb08f0fb8a11919c3e26e6b9ea5356eee7d93007d79e2a383fd6fa3ce46ecde0de44d51ad613e22ec888c5f5d722bd41523b429c37f15c

                                                          • C:\Users\Admin\AppData\Local\Temp\Sysqemplitn.exe

                                                            Filesize

                                                            119KB

                                                            MD5

                                                            ba584a57205d4eb333f2bd20b986cedd

                                                            SHA1

                                                            8cdff41cf5e703e40bc451e964ba8113311c1cdd

                                                            SHA256

                                                            eab51ad7b80e940319dcedc6107b3080fa84bbfa8fa4f6682ff1d43da741637f

                                                            SHA512

                                                            2c5967dc1a8bd9e9d5f37bbb731f80a861b7814da4edcce30d5239295a7ec97cb14213aa64d2b61396149fa085f8e3025bd3462c34d6d080d6189b23a0260719

                                                          • C:\Users\Admin\AppData\Local\Temp\Sysqemplitn.exe

                                                            Filesize

                                                            119KB

                                                            MD5

                                                            ba584a57205d4eb333f2bd20b986cedd

                                                            SHA1

                                                            8cdff41cf5e703e40bc451e964ba8113311c1cdd

                                                            SHA256

                                                            eab51ad7b80e940319dcedc6107b3080fa84bbfa8fa4f6682ff1d43da741637f

                                                            SHA512

                                                            2c5967dc1a8bd9e9d5f37bbb731f80a861b7814da4edcce30d5239295a7ec97cb14213aa64d2b61396149fa085f8e3025bd3462c34d6d080d6189b23a0260719

                                                          • C:\Users\Admin\AppData\Local\Temp\Sysqemrstgs.exe

                                                            Filesize

                                                            119KB

                                                            MD5

                                                            7be3472e9c48ea87c55d28451c2b6c63

                                                            SHA1

                                                            112cd4cb081442b57965355207c82240b40a32ff

                                                            SHA256

                                                            56162cf1c27ab931444234c80420b918f1c0c42d678764e2ac128789b41118ad

                                                            SHA512

                                                            d89d0a9fa67dd2bbb14d2036d1201d06761a77ce69ef3b71f8a755caeedb2e9ecd85e4d7eaf5433892627940b6d320ea1ec4489b47078a16bffd5a8792798ae3

                                                          • C:\Users\Admin\AppData\Local\Temp\Sysqemrstgs.exe

                                                            Filesize

                                                            119KB

                                                            MD5

                                                            7be3472e9c48ea87c55d28451c2b6c63

                                                            SHA1

                                                            112cd4cb081442b57965355207c82240b40a32ff

                                                            SHA256

                                                            56162cf1c27ab931444234c80420b918f1c0c42d678764e2ac128789b41118ad

                                                            SHA512

                                                            d89d0a9fa67dd2bbb14d2036d1201d06761a77ce69ef3b71f8a755caeedb2e9ecd85e4d7eaf5433892627940b6d320ea1ec4489b47078a16bffd5a8792798ae3

                                                          • C:\Users\Admin\AppData\Local\Temp\Sysqemrumki.exe

                                                            Filesize

                                                            119KB

                                                            MD5

                                                            ec6698314302a91746c05cf6c5c91a0e

                                                            SHA1

                                                            42aea7f93e976c4b035ada055c74f7e338befdd4

                                                            SHA256

                                                            e721cfd7612e186623268e61ae01f42c23670d45e368be2b3101894cdcd5e88c

                                                            SHA512

                                                            4f737e5b70a65b8589abca44dd6fbe6b19118b1aaaaf75dedbba307aa1880789bdee1f840d9039068557a1aeef75632c5506fa22db89411205acb715f553b9fb

                                                          • C:\Users\Admin\AppData\Local\Temp\Sysqemrumki.exe

                                                            Filesize

                                                            119KB

                                                            MD5

                                                            ec6698314302a91746c05cf6c5c91a0e

                                                            SHA1

                                                            42aea7f93e976c4b035ada055c74f7e338befdd4

                                                            SHA256

                                                            e721cfd7612e186623268e61ae01f42c23670d45e368be2b3101894cdcd5e88c

                                                            SHA512

                                                            4f737e5b70a65b8589abca44dd6fbe6b19118b1aaaaf75dedbba307aa1880789bdee1f840d9039068557a1aeef75632c5506fa22db89411205acb715f553b9fb

                                                          • C:\Users\Admin\AppData\Local\Temp\Sysqemsokbl.exe

                                                            Filesize

                                                            119KB

                                                            MD5

                                                            78fdcee9e45cdab6fbb5158c2e55b8f2

                                                            SHA1

                                                            15fcf92646f4a2705f4d0aa111785878cac9d389

                                                            SHA256

                                                            6d576366a55e0177beeab5bed3963921342c5e74d0a1303498dd2ea74651b2f3

                                                            SHA512

                                                            cbe0272f8036a79ad0409ae517d5338f9cd3f1df54310664a0a07794e24d12ffbafcc29c041216b40d53afc47521693fb7cddf065ca39d155bd72b753437ecc4

                                                          • C:\Users\Admin\AppData\Local\Temp\Sysqemsokbl.exe

                                                            Filesize

                                                            119KB

                                                            MD5

                                                            78fdcee9e45cdab6fbb5158c2e55b8f2

                                                            SHA1

                                                            15fcf92646f4a2705f4d0aa111785878cac9d389

                                                            SHA256

                                                            6d576366a55e0177beeab5bed3963921342c5e74d0a1303498dd2ea74651b2f3

                                                            SHA512

                                                            cbe0272f8036a79ad0409ae517d5338f9cd3f1df54310664a0a07794e24d12ffbafcc29c041216b40d53afc47521693fb7cddf065ca39d155bd72b753437ecc4

                                                          • C:\Users\Admin\AppData\Local\Temp\Sysqemsokbl.exe

                                                            Filesize

                                                            119KB

                                                            MD5

                                                            78fdcee9e45cdab6fbb5158c2e55b8f2

                                                            SHA1

                                                            15fcf92646f4a2705f4d0aa111785878cac9d389

                                                            SHA256

                                                            6d576366a55e0177beeab5bed3963921342c5e74d0a1303498dd2ea74651b2f3

                                                            SHA512

                                                            cbe0272f8036a79ad0409ae517d5338f9cd3f1df54310664a0a07794e24d12ffbafcc29c041216b40d53afc47521693fb7cddf065ca39d155bd72b753437ecc4

                                                          • C:\Users\Admin\AppData\Local\Temp\Sysqemwbpfp.exe

                                                            Filesize

                                                            119KB

                                                            MD5

                                                            ca440ab0dfb50d6aa2065b8a1130294e

                                                            SHA1

                                                            aace4106e6a9ad754e231c4b6ceefa6f973436e3

                                                            SHA256

                                                            a646c68b8fc2308321f8da741e90627307cdfabe18bffd2998a93ab338b9eeea

                                                            SHA512

                                                            b2fa400b2596e7ccd5bf36d9a46ed6d2c487f1dde547438b5a943bd6684a39d68124ec52a8f2cdfe0cd9c06409a342c41de27bcbfb2335f34ff40649f081a1f1

                                                          • C:\Users\Admin\AppData\Local\Temp\Sysqemwbpfp.exe

                                                            Filesize

                                                            119KB

                                                            MD5

                                                            ca440ab0dfb50d6aa2065b8a1130294e

                                                            SHA1

                                                            aace4106e6a9ad754e231c4b6ceefa6f973436e3

                                                            SHA256

                                                            a646c68b8fc2308321f8da741e90627307cdfabe18bffd2998a93ab338b9eeea

                                                            SHA512

                                                            b2fa400b2596e7ccd5bf36d9a46ed6d2c487f1dde547438b5a943bd6684a39d68124ec52a8f2cdfe0cd9c06409a342c41de27bcbfb2335f34ff40649f081a1f1

                                                          • C:\Users\Admin\AppData\Local\Temp\Sysqemwgidy.exe

                                                            Filesize

                                                            119KB

                                                            MD5

                                                            37d8c1982716a69124345c538136f7af

                                                            SHA1

                                                            0374dffbc6a2cef03fbbeca96164844b3df90fc1

                                                            SHA256

                                                            9d588d757715338b78549eff94030dcbf4af9c1580d875c6613fe3c0c1fb5324

                                                            SHA512

                                                            8227b97f51a62ea719cd2b7c2fb93d2adc6447f522f55a9f20e66453b0035fcdd582a9d2e74eeb5b23be2e5b7d43fe2500a4ca9d72516e11c9adde6e417b888f

                                                          • C:\Users\Admin\AppData\Local\Temp\Sysqemwgidy.exe

                                                            Filesize

                                                            119KB

                                                            MD5

                                                            37d8c1982716a69124345c538136f7af

                                                            SHA1

                                                            0374dffbc6a2cef03fbbeca96164844b3df90fc1

                                                            SHA256

                                                            9d588d757715338b78549eff94030dcbf4af9c1580d875c6613fe3c0c1fb5324

                                                            SHA512

                                                            8227b97f51a62ea719cd2b7c2fb93d2adc6447f522f55a9f20e66453b0035fcdd582a9d2e74eeb5b23be2e5b7d43fe2500a4ca9d72516e11c9adde6e417b888f

                                                          • C:\Users\Admin\AppData\Local\Temp\Sysqemwqmnl.exe

                                                            Filesize

                                                            119KB

                                                            MD5

                                                            0cd7bb3977f5ec860a3385a8ee7b4ff6

                                                            SHA1

                                                            0469dc8aa95337dd928b72ef5a9469c61167eb65

                                                            SHA256

                                                            d4efd00587701ffcbe7a88ac42b0c147fe724de975c741e2f9d759ae8c13e75f

                                                            SHA512

                                                            cadc1e0ec2528f9487d4958ab3ac1199145040d4d5fc5644e298fc6cb214eb25a1f37c06ae3ed447ae4910788105a8cac95c303e7fac444c5ab07feee8753362

                                                          • C:\Users\Admin\AppData\Local\Temp\Sysqemwqmnl.exe

                                                            Filesize

                                                            119KB

                                                            MD5

                                                            0cd7bb3977f5ec860a3385a8ee7b4ff6

                                                            SHA1

                                                            0469dc8aa95337dd928b72ef5a9469c61167eb65

                                                            SHA256

                                                            d4efd00587701ffcbe7a88ac42b0c147fe724de975c741e2f9d759ae8c13e75f

                                                            SHA512

                                                            cadc1e0ec2528f9487d4958ab3ac1199145040d4d5fc5644e298fc6cb214eb25a1f37c06ae3ed447ae4910788105a8cac95c303e7fac444c5ab07feee8753362

                                                          • C:\Users\Admin\AppData\Local\Temp\Sysqemwwdxr.exe

                                                            Filesize

                                                            119KB

                                                            MD5

                                                            f88bea2cc7ca5a0c85ca72a5057f9ea3

                                                            SHA1

                                                            8f9a527a14eaf77ae6b572f0dcbe13754b830027

                                                            SHA256

                                                            6885cbe7d56883ddd77e86bc0612c959c76677662a3150b36693a01eafd477bc

                                                            SHA512

                                                            447336ec275eb33bf6086decbbeb990d1f4b3918dfd35fb87abffc4439282be816477c7cb9b049be0ca6a77bf70feea35ffb4d38f33149d46b3d9471ce30283a

                                                          • C:\Users\Admin\AppData\Local\Temp\Sysqemwwdxr.exe

                                                            Filesize

                                                            119KB

                                                            MD5

                                                            f88bea2cc7ca5a0c85ca72a5057f9ea3

                                                            SHA1

                                                            8f9a527a14eaf77ae6b572f0dcbe13754b830027

                                                            SHA256

                                                            6885cbe7d56883ddd77e86bc0612c959c76677662a3150b36693a01eafd477bc

                                                            SHA512

                                                            447336ec275eb33bf6086decbbeb990d1f4b3918dfd35fb87abffc4439282be816477c7cb9b049be0ca6a77bf70feea35ffb4d38f33149d46b3d9471ce30283a

                                                          • C:\Users\Admin\AppData\Local\Temp\Sysqemzlxcx.exe

                                                            Filesize

                                                            119KB

                                                            MD5

                                                            94f33ce45fd6071c46ea135eece87961

                                                            SHA1

                                                            9bb2b393178f8ee0c5e651862f99ad1c530aa03b

                                                            SHA256

                                                            530aea11eaa942f60f2e12d8cef9e4de6336889868a9011faa7639c18d47bc22

                                                            SHA512

                                                            5874802874bd38137415a5852648727ad2471fcb2088522b89a4c9335236fdb2a780dd0e5267bbe8702321e595d5da8978722df82e7d878b2aeb8630c52a80cb

                                                          • C:\Users\Admin\AppData\Local\Temp\Sysqemzlxcx.exe

                                                            Filesize

                                                            119KB

                                                            MD5

                                                            94f33ce45fd6071c46ea135eece87961

                                                            SHA1

                                                            9bb2b393178f8ee0c5e651862f99ad1c530aa03b

                                                            SHA256

                                                            530aea11eaa942f60f2e12d8cef9e4de6336889868a9011faa7639c18d47bc22

                                                            SHA512

                                                            5874802874bd38137415a5852648727ad2471fcb2088522b89a4c9335236fdb2a780dd0e5267bbe8702321e595d5da8978722df82e7d878b2aeb8630c52a80cb

                                                          • C:\Users\Admin\AppData\Local\Temp\qpath.ini

                                                            Filesize

                                                            49B

                                                            MD5

                                                            c7cc2400d532eb03f2eefbd7001c9377

                                                            SHA1

                                                            2cea7cd5ff4f8a3d8e1708af5471c4181ebdf218

                                                            SHA256

                                                            76ba3218087c4399f0f20f1cc4dd1f5afae2ad8ef3f38b90d9b50dfc67b09712

                                                            SHA512

                                                            e1946729919b143c2d58b1c0e9afe0d6a5b7b445858aed4cf208f877cf09f4e50544d72221d09d75a1a3ea2d71c280ab7b130bcf69c27fefbb2cdc03086b715e

                                                          • C:\Users\Admin\AppData\Local\Temp\qpath.ini

                                                            Filesize

                                                            49B

                                                            MD5

                                                            9aaeb145455ae4fa0098efae884f8c54

                                                            SHA1

                                                            35d34ef4c7fe601167b569b5ce60335ba3d51a5b

                                                            SHA256

                                                            7e69f414cd9208271659acee7c71588eb55c42d2a878ca92915b68aa6280b709

                                                            SHA512

                                                            312e2ef591ffd8d798acc629149dbc6afb61f8ec843cfe7178b59ef8dc0178e6267b6609e7fcb40b364485203d84e32b4e67116be16e599259b3703f882d869e

                                                          • C:\Users\Admin\AppData\Local\Temp\qpath.ini

                                                            Filesize

                                                            49B

                                                            MD5

                                                            4b183f9621eab54c51879503b796212d

                                                            SHA1

                                                            ba52b6d0e20307e5c2d249d933b2f625655d2dd5

                                                            SHA256

                                                            168599fd97321032f9c6f45392e27b02598b170c5992da30347d487f391f6935

                                                            SHA512

                                                            2239a95092f69175d2db20c48b8624659465517af45b70a7ba3433cfa4a47ae71e11e1aef05b01be6d02b0d17f442d61d422d5d7a389acfb902c654e9b0725dc

                                                          • C:\Users\Admin\AppData\Local\Temp\qpath.ini

                                                            Filesize

                                                            49B

                                                            MD5

                                                            9a99f3ca1d30bb4bcf2de46230e5b971

                                                            SHA1

                                                            abc946c47a3ccb73da864168bf371e3a1af0348c

                                                            SHA256

                                                            67078ce3765bf11d84aa8dc6d42055c49058a9e5198229f0fda28ae16179c165

                                                            SHA512

                                                            4cd7fb0fa4afce0292a34933a857cfeab3a98a266ef04ca5ce1394a2ff4c75378815c5e178afeaa25de40483be53bb7bce107677a443b74b5b0d80dab541d75e

                                                          • C:\Users\Admin\AppData\Local\Temp\qpath.ini

                                                            Filesize

                                                            49B

                                                            MD5

                                                            1f7265eb22bc955cecb485b305329b31

                                                            SHA1

                                                            0c444996cf30ef5509221f8e1f211b2e100c70de

                                                            SHA256

                                                            b1ec27574bf75dba364bac9e1250c92bd1a532423e500a4df2f0f66c796d1183

                                                            SHA512

                                                            a354711f5167661e8e41c9e72553701c9c9782fcf664a685dcb6748d04869e30e7bf8a899e49900bc1d26171ebda0fb271cb26fdeecd46d96e66a810ad262355

                                                          • C:\Users\Admin\AppData\Local\Temp\qpath.ini

                                                            Filesize

                                                            49B

                                                            MD5

                                                            022a4b7255c4dd690e84c992ea5e9e58

                                                            SHA1

                                                            34afb8ca35a68eaf0c08b8675ecf5cd12a986ed4

                                                            SHA256

                                                            f3327a45846264ff53ba90bf1479b3fe04908c5df21096959b542d989c1248e5

                                                            SHA512

                                                            12eb65fd2177f933aa06f58300e9f9e5bef59cb5dfa30ca53f5a65ee27639fa90d4b45504f8cc9b512d67b0ea0b277fe8ecf68751cf365ef03de3e5310857e34

                                                          • C:\Users\Admin\AppData\Local\Temp\qpath.ini

                                                            Filesize

                                                            49B

                                                            MD5

                                                            0f9bf4044047bc041a0f60546b2625cf

                                                            SHA1

                                                            75f7762431c4e53bc3a861fc89c7100b70f12ffe

                                                            SHA256

                                                            7e7af034f8aaa916b4e06c04b9f7bee5bb6cd181c2d5a2f166af3d92cffcedbf

                                                            SHA512

                                                            74dbc2207e684263e9e370cd4508c4c171578b6bf77933cd65382f352e3eb310443f93e239c7b2b66d8a5560f49a6b5cf0c2b938dfc79bd56ae25e650551d21e

                                                          • C:\Users\Admin\AppData\Local\Temp\qpath.ini

                                                            Filesize

                                                            49B

                                                            MD5

                                                            c057077506290f7da6bfdb03e5225eaa

                                                            SHA1

                                                            fbf35317a484a87acd5ca022aeffe7ff9a9a9b97

                                                            SHA256

                                                            9d94df9344d6d9d3a2bc1b87c9aae641cd919f5db585a48bc90322c28e19fc53

                                                            SHA512

                                                            64905a2af60b8bbb04519efb0f0d6617bdf8a166a35473038bcb70e26fbc523a150e09d96a29c41b71ad59fe1e3ebe950a49a549a0d09efa10624340411325e8

                                                          • C:\Users\Admin\AppData\Local\Temp\qpath.ini

                                                            Filesize

                                                            49B

                                                            MD5

                                                            c570a9ccbb2c72669c3b2b2061741e98

                                                            SHA1

                                                            862b6b2fde6f70a1d0f7f211c1f49d8a19c62da6

                                                            SHA256

                                                            732248226a9c0d51702b187daea8e82c4f43a73779c50acedd661887b8e79f76

                                                            SHA512

                                                            876565cee73c69bba88a70c93d57a40e40af2cfd988799535477eefec82dc2736c42aec061ec85e5f77009fb70b76091f5f6c9281d07b92467c05f8a3188f5a2

                                                          • C:\Users\Admin\AppData\Local\Temp\qpath.ini

                                                            Filesize

                                                            49B

                                                            MD5

                                                            c88a1ac2dc7f7659bfbf36de3e879416

                                                            SHA1

                                                            e1e9ffc0e57b1fba173443600ff6e8fd34ef82cd

                                                            SHA256

                                                            b9c749ec271cc976e3b545bc39b83a0d65a55013ae08186c6fab5e181f1b0bc2

                                                            SHA512

                                                            9e2d248a8348f7975fa3138f1365520c58889af330c381b23c8c0dbf38ad094ed4eb71098933836aa887dcd41bb6cd98b7eac7f1ffd338eafa99702333015096

                                                          • C:\Users\Admin\AppData\Local\Temp\qpath.ini

                                                            Filesize

                                                            49B

                                                            MD5

                                                            d7b3c27c9f78e07971491152f09b8856

                                                            SHA1

                                                            9614ba2e138b0140c4b19d7c5ba72bfd55c75d88

                                                            SHA256

                                                            9b4988ee4649dd95c3d7d103f2116a33189d9f914d813cd3ce5ba6cee5fac5a5

                                                            SHA512

                                                            71a7c701a64797eab84fa82c070fe181770ea6399b127c7d559a41b38c62cc642d92613ab30b4a7b48f25de3eabd6e8f837ce56790aca98cc5c18140659a804b

                                                          • C:\Users\Admin\AppData\Local\Temp\qpath.ini

                                                            Filesize

                                                            49B

                                                            MD5

                                                            d1ca309f20fc7e5848921ea7057541fc

                                                            SHA1

                                                            0ea586134e980798b5829b891c5107e0c431106b

                                                            SHA256

                                                            00d36eb411096372abc1b141b6bfd70fed20b9ecbab8939654d4f73113d905db

                                                            SHA512

                                                            b914c1bfe0e154e27443e21a1fbe5c800ea62c2421660472ffed44fd0b40e654c9d37004322a7481ce542903aef2f0a2e3ceb20a2fca887ba49a7713b0f63237

                                                          • C:\Users\Admin\AppData\Local\Temp\qpath.ini

                                                            Filesize

                                                            49B

                                                            MD5

                                                            d7ccdfda702eeaf6fadd4359f97f8ebf

                                                            SHA1

                                                            1a6af752bad2d605e8aa76994ee97fcbe613f50a

                                                            SHA256

                                                            4263e39e22aa4bcfc5fbd93abdc02917da971ca6cb866ec0b6e4a0681140364e

                                                            SHA512

                                                            95defb958cd913eebee9cc9d99b1cf8a75d99ffc667f625fdbc336ebbf52f42958d8863411ddd8fc54b3aba7f7e032bbb097e429ab0279daa23e3eee0839935f

                                                          • C:\Users\Admin\AppData\Local\Temp\qpath.ini

                                                            Filesize

                                                            49B

                                                            MD5

                                                            d9f4a73d33fea9df621db98e8ab4689a

                                                            SHA1

                                                            0b454eb516082d83f953c73d1b14d1a2e757cf28

                                                            SHA256

                                                            e1c2bea6144efca26d2b4d43c22725369e003bcfe324245861258a12e419e066

                                                            SHA512

                                                            46c2fe592323b9c0464a5b4edc9bf698381f12ea6274fc948ed3ca77375b93d5a5f3f5f6bdea254060efea15210e6011a34a98567b52bb42cf8463a9c817268e

                                                          • C:\Users\Admin\AppData\Local\Temp\qpath.ini

                                                            Filesize

                                                            49B

                                                            MD5

                                                            9a680dd752f1c0977669a759527a9f72

                                                            SHA1

                                                            f21057a62c3f44408c0d936ca7f1a5090d4a4c09

                                                            SHA256

                                                            6d75e2ad561e6cb00b015ea9e81f3fb8a748ee72b7ca8a2ff953cc8e1dc0e748

                                                            SHA512

                                                            b90ff778b2b09b2acaf4b1ff3a57cb7822314f153c24bc3407290801de455d12407efad393015cf05197f3ff443477d0a276940263f456b2d206a59e5a9ae90e

                                                          • C:\Users\Admin\AppData\Local\Temp\qpath.ini

                                                            Filesize

                                                            49B

                                                            MD5

                                                            c7d76bb1f5ca67ccc593f142ffd0ce0c

                                                            SHA1

                                                            939dfca01fd37c8fa78b1c6a5490157aa13ace30

                                                            SHA256

                                                            0867d22d3e51556ffc7720d3b12975788a8afc2c222b97bb43e874eb1203f3c3

                                                            SHA512

                                                            9db649b83f8a7245d7c5d859ea372c1c9aa807c97aad45769de4b72d4bc0aa21cadc83a26e1cb435341f9dc38538f0b11cab88852085d69b129a2fda2856d1ab

                                                          • C:\Users\Admin\AppData\Local\Temp\qpath.ini

                                                            Filesize

                                                            49B

                                                            MD5

                                                            69580d1e805dc6b7b67b706133df3ebc

                                                            SHA1

                                                            b3d76b5d36b97c272959b55d94f040613d4a12df

                                                            SHA256

                                                            26bd29a55681118c262ac6c4ca858270943dce423d9c7f85e774b8ca7ffbaa13

                                                            SHA512

                                                            bae1da7af28282f27fb0c1a46d05d2daafe08929f414f475538de26cc7b2b2b7d0f7d5d38e787e9c87036803360eb31f326c6e54cc64cdc127417fbf61187597

                                                          • memory/3956-0-0x00000000021D0000-0x00000000021DD000-memory.dmp

                                                            Filesize

                                                            52KB

                                                          • memory/3956-8-0x00000000021D0000-0x00000000021DD000-memory.dmp

                                                            Filesize

                                                            52KB

                                                          • memory/3956-1-0x0000000000400000-0x000000000048F000-memory.dmp

                                                            Filesize

                                                            572KB

                                                          • memory/5060-41-0x00000000005F0000-0x00000000005FD000-memory.dmp

                                                            Filesize

                                                            52KB