Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    89s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/10/2023, 09:58

General

  • Target

    805e179bd7fadf38e18f51e2bb87a8d6e58ac854ca9830c970e3f83fecdd964e.exe

  • Size

    259KB

  • MD5

    9985a2b46e58e370fe89691817f70859

  • SHA1

    b2637db3f33fcdbd769f67e3a8a139d927637c39

  • SHA256

    805e179bd7fadf38e18f51e2bb87a8d6e58ac854ca9830c970e3f83fecdd964e

  • SHA512

    16e54e930980a8d71a2b30a9a85ad3864989495a0f8a446bd23057cc81a91cb84d79664c8bc3ecb0baa0f9e39d0a935f995c9f748b11c9a7df6726ae3f0e7850

  • SSDEEP

    3072:xyBNXIxAEzM5N3nm4nh6SN8O79dwAz+2zYa5Kj+mI:sdGAEY5NXtnUa7JzGa

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://onualituyrs.org/

http://sumagulituyo.org/

http://snukerukeutit.org/

http://lightseinsteniki.org/

http://liuliuoumumy.org/

http://stualialuyastrelia.net/

http://kumbuyartyty.net/

http://criogetikfenbut.org/

http://tonimiuyaytre.org/

http://tyiuiunuewqy.org/

http://wirtshauspost.at/tmp/

http://msktk.ru/tmp/

http://soetegem.com/tmp/

http://gromograd.ru/tmp/

http://talesofpirates.net/tmp/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

djvu

C2

http://zexeq.com/raud/get.php

Attributes
  • extension

    .ithh

  • offline_id

    9FgVtzPuDnE9NZWeLG9q9D2SjzVyIqJJ4jFNKXt1

  • payload_url

    http://colisumy.com/dl/build2.exe

    http://zexeq.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-cGZhpvUKxk Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0811JOsie

rsa_pubkey.plain

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Botnet

up3

Signatures

  • Detected Djvu ransomware 9 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 3 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 5 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Downloads MZ/PE file
  • Drops file in Drivers directory 1 IoCs
  • Modifies Windows Firewall 1 TTPs 2 IoCs
  • Stops running service(s) 3 TTPs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 24 IoCs
  • Loads dropped DLL 4 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Themida packer 4 IoCs

    Detects Themida, an advanced Windows software protection system.

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 3 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 9 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Program Files directory 13 IoCs
  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 11 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 64 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Deletes itself
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3436
    • C:\Users\Admin\AppData\Local\Temp\805e179bd7fadf38e18f51e2bb87a8d6e58ac854ca9830c970e3f83fecdd964e.exe
      "C:\Users\Admin\AppData\Local\Temp\805e179bd7fadf38e18f51e2bb87a8d6e58ac854ca9830c970e3f83fecdd964e.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:4848
    • C:\Users\Admin\AppData\Local\Temp\1BFF.exe
      C:\Users\Admin\AppData\Local\Temp\1BFF.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1832
      • C:\Users\Admin\AppData\Local\Temp\1BFF.exe
        C:\Users\Admin\AppData\Local\Temp\1BFF.exe
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1928
        • C:\Windows\SysWOW64\icacls.exe
          icacls "C:\Users\Admin\AppData\Local\c6072763-766a-4960-9c7f-615370dcc6c1" /deny *S-1-1-0:(OI)(CI)(DE,DC)
          4⤵
          • Modifies file permissions
          PID:2736
        • C:\Users\Admin\AppData\Local\Temp\1BFF.exe
          "C:\Users\Admin\AppData\Local\Temp\1BFF.exe" --Admin IsNotAutoStart IsNotTask
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:4760
          • C:\Users\Admin\AppData\Local\Temp\1BFF.exe
            "C:\Users\Admin\AppData\Local\Temp\1BFF.exe" --Admin IsNotAutoStart IsNotTask
            5⤵
            • Executes dropped EXE
            PID:2068
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2068 -s 568
              6⤵
              • Program crash
              PID:2728
    • C:\Users\Admin\AppData\Local\Temp\1EAF.exe
      C:\Users\Admin\AppData\Local\Temp\1EAF.exe
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      PID:4368
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1512
    • C:\Users\Admin\AppData\Local\Temp\3517.exe
      C:\Users\Admin\AppData\Local\Temp\3517.exe
      2⤵
      • Executes dropped EXE
      PID:3516
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe"
        3⤵
          PID:3540
      • C:\Windows\system32\regsvr32.exe
        regsvr32 /s C:\Users\Admin\AppData\Local\Temp\3A29.dll
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4508
        • C:\Windows\SysWOW64\regsvr32.exe
          /s C:\Users\Admin\AppData\Local\Temp\3A29.dll
          3⤵
          • Loads dropped DLL
          PID:2376
      • C:\Users\Admin\AppData\Local\Temp\510D.exe
        C:\Users\Admin\AppData\Local\Temp\510D.exe
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3132
        • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
          "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          PID:2964
          • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
            "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
            4⤵
            • Executes dropped EXE
            PID:2384
        • C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
          "C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:2352
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -nologo -noprofile
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2904
          • C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe
            "C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe"
            4⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Checks for VirtualBox DLLs, possible anti-VM trick
            • Drops file in Windows directory
            PID:4880
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -nologo -noprofile
              5⤵
              • Drops file in System32 directory
              • Modifies data under HKEY_USERS
              PID:5060
            • C:\Windows\system32\cmd.exe
              C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
              5⤵
                PID:2452
                • C:\Windows\system32\netsh.exe
                  netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                  6⤵
                  • Modifies Windows Firewall
                  PID:2132
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                5⤵
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                PID:2616
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -nologo -noprofile
                5⤵
                • Drops file in System32 directory
                • Modifies data under HKEY_USERS
                PID:1676
          • C:\Users\Admin\AppData\Local\Temp\kos2.exe
            "C:\Users\Admin\AppData\Local\Temp\kos2.exe"
            3⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4204
            • C:\Users\Admin\AppData\Local\Temp\set16.exe
              "C:\Users\Admin\AppData\Local\Temp\set16.exe"
              4⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:1136
              • C:\Users\Admin\AppData\Local\Temp\is-LDVTS.tmp\is-NPJHJ.tmp
                "C:\Users\Admin\AppData\Local\Temp\is-LDVTS.tmp\is-NPJHJ.tmp" /SL4 $D0056 "C:\Users\Admin\AppData\Local\Temp\set16.exe" 1281875 52224
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in Program Files directory
                PID:2604
                • C:\Program Files (x86)\MyBurn\MyBurn.exe
                  "C:\Program Files (x86)\MyBurn\MyBurn.exe" -i
                  6⤵
                  • Executes dropped EXE
                  PID:3324
                • C:\Program Files (x86)\MyBurn\MyBurn.exe
                  "C:\Program Files (x86)\MyBurn\MyBurn.exe" -s
                  6⤵
                  • Executes dropped EXE
                  PID:2628
                • C:\Windows\SysWOW64\schtasks.exe
                  "C:\Windows\system32\schtasks.exe" /Query
                  6⤵
                    PID:2300
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\system32\net.exe" helpmsg 20
                    6⤵
                      PID:2372
                • C:\Users\Admin\AppData\Local\Temp\K.exe
                  "C:\Users\Admin\AppData\Local\Temp\K.exe"
                  4⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5056
              • C:\Users\Admin\AppData\Local\Temp\latestX.exe
                "C:\Users\Admin\AppData\Local\Temp\latestX.exe"
                3⤵
                • Suspicious use of NtCreateUserProcessOtherParentProcess
                • Drops file in Drivers directory
                • Executes dropped EXE
                • Drops file in Program Files directory
                PID:372
            • C:\Windows\SysWOW64\explorer.exe
              C:\Windows\SysWOW64\explorer.exe
              2⤵
              • Accesses Microsoft Outlook profiles
              • outlook_office_path
              • outlook_win_path
              PID:4852
            • C:\Windows\explorer.exe
              C:\Windows\explorer.exe
              2⤵
                PID:4492
              • C:\Users\Admin\AppData\Local\Temp\6061.exe
                C:\Users\Admin\AppData\Local\Temp\6061.exe
                2⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:5064
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -nologo -noprofile
                  3⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4664
                • C:\Users\Admin\AppData\Local\Temp\6061.exe
                  "C:\Users\Admin\AppData\Local\Temp\6061.exe"
                  3⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Checks for VirtualBox DLLs, possible anti-VM trick
                  • Drops file in Windows directory
                  • Modifies data under HKEY_USERS
                  PID:1740
                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                    powershell -nologo -noprofile
                    4⤵
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    PID:5100
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
                    4⤵
                      PID:3384
                      • C:\Windows\system32\netsh.exe
                        netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
                        5⤵
                        • Modifies Windows Firewall
                        PID:888
                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                      powershell -nologo -noprofile
                      4⤵
                        PID:2188
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -nologo -noprofile
                        4⤵
                        • Drops file in System32 directory
                        • Modifies data under HKEY_USERS
                        PID:1264
                      • C:\Windows\rss\csrss.exe
                        C:\Windows\rss\csrss.exe
                        4⤵
                        • Executes dropped EXE
                        PID:4344
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell -nologo -noprofile
                          5⤵
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          PID:1116
                        • C:\Windows\SYSTEM32\schtasks.exe
                          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                          5⤵
                          • Creates scheduled task(s)
                          PID:4068
                        • C:\Windows\SYSTEM32\schtasks.exe
                          schtasks /delete /tn ScheduledUpdate /f
                          5⤵
                            PID:1132
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            powershell -nologo -noprofile
                            5⤵
                            • Drops file in System32 directory
                            • Modifies data under HKEY_USERS
                            PID:1572
                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                            powershell -nologo -noprofile
                            5⤵
                            • Modifies data under HKEY_USERS
                            PID:3560
                            • C:\Windows\System32\Conhost.exe
                              \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                              6⤵
                                PID:3384
                            • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
                              C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
                              5⤵
                                PID:3200
                              • C:\Windows\SYSTEM32\schtasks.exe
                                schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
                                5⤵
                                • Creates scheduled task(s)
                                PID:2216
                              • C:\Windows\windefender.exe
                                "C:\Windows\windefender.exe"
                                5⤵
                                  PID:684
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                    6⤵
                                      PID:1184
                                      • C:\Windows\SysWOW64\sc.exe
                                        sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                                        7⤵
                                        • Launches sc.exe
                                        PID:2468
                                  • C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe
                                    C:\Users\Admin\AppData\Local\Temp\csrss\f801950a962ddba14caaa44bf084b55c.exe
                                    5⤵
                                      PID:4276
                                      • C:\Windows\SYSTEM32\schtasks.exe
                                        schtasks /delete /tn "csrss" /f
                                        6⤵
                                          PID:4848
                                        • C:\Windows\SYSTEM32\schtasks.exe
                                          schtasks /delete /tn "ScheduledUpdate" /f
                                          6⤵
                                            PID:3984
                                    • C:\Windows\SysWOW64\WerFault.exe
                                      C:\Windows\SysWOW64\WerFault.exe -u -p 5064 -s 888
                                      3⤵
                                      • Program crash
                                      PID:4900
                                  • C:\Users\Admin\AppData\Local\Temp\562F.exe
                                    C:\Users\Admin\AppData\Local\Temp\562F.exe
                                    2⤵
                                    • Executes dropped EXE
                                    • Checks SCSI registry key(s)
                                    • Suspicious behavior: MapViewOfSection
                                    PID:452
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
                                    2⤵
                                      PID:1792
                                    • C:\Windows\System32\cmd.exe
                                      C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
                                      2⤵
                                        PID:1644
                                        • C:\Windows\System32\sc.exe
                                          sc stop UsoSvc
                                          3⤵
                                          • Launches sc.exe
                                          PID:1980
                                        • C:\Windows\System32\sc.exe
                                          sc stop WaaSMedicSvc
                                          3⤵
                                          • Launches sc.exe
                                          PID:2728
                                        • C:\Windows\System32\sc.exe
                                          sc stop wuauserv
                                          3⤵
                                          • Launches sc.exe
                                          PID:2408
                                        • C:\Windows\System32\sc.exe
                                          sc stop bits
                                          3⤵
                                          • Launches sc.exe
                                          PID:1420
                                        • C:\Windows\System32\sc.exe
                                          sc stop dosvc
                                          3⤵
                                          • Launches sc.exe
                                          PID:2040
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
                                        2⤵
                                        • Drops file in System32 directory
                                        • Modifies data under HKEY_USERS
                                        PID:2188
                                      • C:\Windows\System32\cmd.exe
                                        C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
                                        2⤵
                                          PID:4360
                                          • C:\Windows\System32\powercfg.exe
                                            powercfg /x -hibernate-timeout-ac 0
                                            3⤵
                                              PID:4868
                                            • C:\Windows\System32\powercfg.exe
                                              powercfg /x -hibernate-timeout-dc 0
                                              3⤵
                                                PID:1464
                                              • C:\Windows\System32\powercfg.exe
                                                powercfg /x -standby-timeout-ac 0
                                                3⤵
                                                  PID:3644
                                                • C:\Windows\System32\powercfg.exe
                                                  powercfg /x -standby-timeout-dc 0
                                                  3⤵
                                                    PID:1360
                                                • C:\Windows\System32\schtasks.exe
                                                  C:\Windows\System32\schtasks.exe /run /tn "GoogleUpdateTaskMachineQC"
                                                  2⤵
                                                    PID:412
                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramFiles) -Force
                                                    2⤵
                                                      PID:3196
                                                    • C:\Windows\System32\cmd.exe
                                                      C:\Windows\System32\cmd.exe /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop bits & sc stop dosvc
                                                      2⤵
                                                        PID:1752
                                                        • C:\Windows\System32\sc.exe
                                                          sc stop UsoSvc
                                                          3⤵
                                                          • Launches sc.exe
                                                          PID:2912
                                                        • C:\Windows\System32\sc.exe
                                                          sc stop WaaSMedicSvc
                                                          3⤵
                                                          • Launches sc.exe
                                                          PID:932
                                                        • C:\Windows\System32\sc.exe
                                                          sc stop wuauserv
                                                          3⤵
                                                          • Launches sc.exe
                                                          PID:3648
                                                        • C:\Windows\System32\sc.exe
                                                          sc stop bits
                                                          3⤵
                                                          • Launches sc.exe
                                                          PID:1428
                                                        • C:\Windows\System32\sc.exe
                                                          sc stop dosvc
                                                          3⤵
                                                          • Launches sc.exe
                                                          PID:1552
                                                      • C:\Windows\System32\cmd.exe
                                                        C:\Windows\System32\cmd.exe /c powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0
                                                        2⤵
                                                          PID:428
                                                          • C:\Windows\System32\powercfg.exe
                                                            powercfg /x -hibernate-timeout-ac 0
                                                            3⤵
                                                              PID:2708
                                                            • C:\Windows\System32\powercfg.exe
                                                              powercfg /x -hibernate-timeout-dc 0
                                                              3⤵
                                                                PID:1204
                                                              • C:\Windows\System32\powercfg.exe
                                                                powercfg /x -standby-timeout-ac 0
                                                                3⤵
                                                                  PID:1028
                                                                • C:\Windows\System32\powercfg.exe
                                                                  powercfg /x -standby-timeout-dc 0
                                                                  3⤵
                                                                    PID:1096
                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#nvjdnn#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /ru 'System' /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Program Files\Google\Chrome\updater.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Program Files\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtStartup) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -User 'System' -RunLevel 'Highest' -Force; }
                                                                  2⤵
                                                                    PID:1152
                                                                  • C:\Windows\System32\conhost.exe
                                                                    C:\Windows\System32\conhost.exe
                                                                    2⤵
                                                                      PID:2444
                                                                    • C:\Windows\explorer.exe
                                                                      C:\Windows\explorer.exe
                                                                      2⤵
                                                                        PID:1156
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2068 -ip 2068
                                                                      1⤵
                                                                        PID:1768
                                                                      • C:\Windows\SysWOW64\net1.exe
                                                                        C:\Windows\system32\net1 helpmsg 20
                                                                        1⤵
                                                                          PID:1556
                                                                        • C:\Users\Admin\AppData\Roaming\jtsgaec
                                                                          C:\Users\Admin\AppData\Roaming\jtsgaec
                                                                          1⤵
                                                                          • Executes dropped EXE
                                                                          PID:2028
                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 5064 -ip 5064
                                                                          1⤵
                                                                            PID:4876
                                                                          • C:\Program Files\Google\Chrome\updater.exe
                                                                            "C:\Program Files\Google\Chrome\updater.exe"
                                                                            1⤵
                                                                            • Executes dropped EXE
                                                                            PID:3684
                                                                          • C:\Windows\System32\RuntimeBroker.exe
                                                                            C:\Windows\System32\RuntimeBroker.exe -Embedding
                                                                            1⤵
                                                                              PID:1464
                                                                            • C:\Windows\windefender.exe
                                                                              C:\Windows\windefender.exe
                                                                              1⤵
                                                                                PID:2120

                                                                              Network

                                                                              MITRE ATT&CK Enterprise v15

                                                                              Replay Monitor

                                                                              Loading Replay Monitor...

                                                                              Downloads

                                                                              • C:\Program Files (x86)\MyBurn\MyBurn.exe

                                                                                Filesize

                                                                                2.1MB

                                                                                MD5

                                                                                f0fd986799e64ba888a8031782181dc7

                                                                                SHA1

                                                                                df5a8420ebdcb1d036867fbc9c3f9ca143cf587c

                                                                                SHA256

                                                                                a85af12749a97eeae8f64b767e63780978c859f389139cd153bedb432d1bfb4f

                                                                                SHA512

                                                                                09d8b0a6e39139c1853b5f05b1f87bbed5f38b51562cd3da8eb87be1125e8b28c2a3409d4977359cf8551a76c045de39c0419ddcef6459d9f87e10a945545233

                                                                              • C:\Program Files (x86)\MyBurn\MyBurn.exe

                                                                                Filesize

                                                                                2.1MB

                                                                                MD5

                                                                                f0fd986799e64ba888a8031782181dc7

                                                                                SHA1

                                                                                df5a8420ebdcb1d036867fbc9c3f9ca143cf587c

                                                                                SHA256

                                                                                a85af12749a97eeae8f64b767e63780978c859f389139cd153bedb432d1bfb4f

                                                                                SHA512

                                                                                09d8b0a6e39139c1853b5f05b1f87bbed5f38b51562cd3da8eb87be1125e8b28c2a3409d4977359cf8551a76c045de39c0419ddcef6459d9f87e10a945545233

                                                                              • C:\Program Files (x86)\MyBurn\MyBurn.exe

                                                                                Filesize

                                                                                2.1MB

                                                                                MD5

                                                                                f0fd986799e64ba888a8031782181dc7

                                                                                SHA1

                                                                                df5a8420ebdcb1d036867fbc9c3f9ca143cf587c

                                                                                SHA256

                                                                                a85af12749a97eeae8f64b767e63780978c859f389139cd153bedb432d1bfb4f

                                                                                SHA512

                                                                                09d8b0a6e39139c1853b5f05b1f87bbed5f38b51562cd3da8eb87be1125e8b28c2a3409d4977359cf8551a76c045de39c0419ddcef6459d9f87e10a945545233

                                                                              • C:\Program Files\Google\Chrome\updater.exe

                                                                                Filesize

                                                                                5.6MB

                                                                                MD5

                                                                                bae29e49e8190bfbbf0d77ffab8de59d

                                                                                SHA1

                                                                                4a6352bb47c7e1666a60c76f9b17ca4707872bd9

                                                                                SHA256

                                                                                f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

                                                                                SHA512

                                                                                9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

                                                                              • C:\ProgramData\ContentDVSvc\ContentDVSvc.exe

                                                                                Filesize

                                                                                2.1MB

                                                                                MD5

                                                                                f0fd986799e64ba888a8031782181dc7

                                                                                SHA1

                                                                                df5a8420ebdcb1d036867fbc9c3f9ca143cf587c

                                                                                SHA256

                                                                                a85af12749a97eeae8f64b767e63780978c859f389139cd153bedb432d1bfb4f

                                                                                SHA512

                                                                                09d8b0a6e39139c1853b5f05b1f87bbed5f38b51562cd3da8eb87be1125e8b28c2a3409d4977359cf8551a76c045de39c0419ddcef6459d9f87e10a945545233

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                Filesize

                                                                                2KB

                                                                                MD5

                                                                                d85ba6ff808d9e5444a4b369f5bc2730

                                                                                SHA1

                                                                                31aa9d96590fff6981b315e0b391b575e4c0804a

                                                                                SHA256

                                                                                84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

                                                                                SHA512

                                                                                8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

                                                                              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                Filesize

                                                                                944B

                                                                                MD5

                                                                                6d3e9c29fe44e90aae6ed30ccf799ca8

                                                                                SHA1

                                                                                c7974ef72264bbdf13a2793ccf1aed11bc565dce

                                                                                SHA256

                                                                                2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d

                                                                                SHA512

                                                                                60c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a

                                                                              • C:\Users\Admin\AppData\Local\Temp\1BFF.exe

                                                                                Filesize

                                                                                773KB

                                                                                MD5

                                                                                952688e5752abd15bb1b900b2db461a3

                                                                                SHA1

                                                                                71a83957ea93085c7894545c5e33c5fcb8c763d3

                                                                                SHA256

                                                                                256d2ef4432984e12e4dc361e89e1d35ce9b8d55c066f71489bae8827f98c91f

                                                                                SHA512

                                                                                3445765d8efd53b995291b033c57e35726ba0b2d23e8ed351324fae512f81c49583903307983de211c18f31ef4d17adf5fcb1f12d0104ffa21a3a408793c0c5a

                                                                              • C:\Users\Admin\AppData\Local\Temp\1BFF.exe

                                                                                Filesize

                                                                                773KB

                                                                                MD5

                                                                                952688e5752abd15bb1b900b2db461a3

                                                                                SHA1

                                                                                71a83957ea93085c7894545c5e33c5fcb8c763d3

                                                                                SHA256

                                                                                256d2ef4432984e12e4dc361e89e1d35ce9b8d55c066f71489bae8827f98c91f

                                                                                SHA512

                                                                                3445765d8efd53b995291b033c57e35726ba0b2d23e8ed351324fae512f81c49583903307983de211c18f31ef4d17adf5fcb1f12d0104ffa21a3a408793c0c5a

                                                                              • C:\Users\Admin\AppData\Local\Temp\1BFF.exe

                                                                                Filesize

                                                                                773KB

                                                                                MD5

                                                                                952688e5752abd15bb1b900b2db461a3

                                                                                SHA1

                                                                                71a83957ea93085c7894545c5e33c5fcb8c763d3

                                                                                SHA256

                                                                                256d2ef4432984e12e4dc361e89e1d35ce9b8d55c066f71489bae8827f98c91f

                                                                                SHA512

                                                                                3445765d8efd53b995291b033c57e35726ba0b2d23e8ed351324fae512f81c49583903307983de211c18f31ef4d17adf5fcb1f12d0104ffa21a3a408793c0c5a

                                                                              • C:\Users\Admin\AppData\Local\Temp\1BFF.exe

                                                                                Filesize

                                                                                773KB

                                                                                MD5

                                                                                952688e5752abd15bb1b900b2db461a3

                                                                                SHA1

                                                                                71a83957ea93085c7894545c5e33c5fcb8c763d3

                                                                                SHA256

                                                                                256d2ef4432984e12e4dc361e89e1d35ce9b8d55c066f71489bae8827f98c91f

                                                                                SHA512

                                                                                3445765d8efd53b995291b033c57e35726ba0b2d23e8ed351324fae512f81c49583903307983de211c18f31ef4d17adf5fcb1f12d0104ffa21a3a408793c0c5a

                                                                              • C:\Users\Admin\AppData\Local\Temp\1BFF.exe

                                                                                Filesize

                                                                                773KB

                                                                                MD5

                                                                                952688e5752abd15bb1b900b2db461a3

                                                                                SHA1

                                                                                71a83957ea93085c7894545c5e33c5fcb8c763d3

                                                                                SHA256

                                                                                256d2ef4432984e12e4dc361e89e1d35ce9b8d55c066f71489bae8827f98c91f

                                                                                SHA512

                                                                                3445765d8efd53b995291b033c57e35726ba0b2d23e8ed351324fae512f81c49583903307983de211c18f31ef4d17adf5fcb1f12d0104ffa21a3a408793c0c5a

                                                                              • C:\Users\Admin\AppData\Local\Temp\1EAF.exe

                                                                                Filesize

                                                                                2.6MB

                                                                                MD5

                                                                                3fa323c8a7ee8e017ed04764c35fc6d7

                                                                                SHA1

                                                                                628798e103654cb81d6b13b5cf3964c841658b39

                                                                                SHA256

                                                                                09803be467a424041ddccce80a356c38163cec45b2403ef55a99d82b97ad580d

                                                                                SHA512

                                                                                6844d5a0866d1a2c201b02722410dcf297a15a375c7e041e891d42008b8f6dad0a0a989d9a272536d83a8ff3479303a6bd133670bc60eeed9a13c3f0d45db617

                                                                              • C:\Users\Admin\AppData\Local\Temp\1EAF.exe

                                                                                Filesize

                                                                                2.6MB

                                                                                MD5

                                                                                3fa323c8a7ee8e017ed04764c35fc6d7

                                                                                SHA1

                                                                                628798e103654cb81d6b13b5cf3964c841658b39

                                                                                SHA256

                                                                                09803be467a424041ddccce80a356c38163cec45b2403ef55a99d82b97ad580d

                                                                                SHA512

                                                                                6844d5a0866d1a2c201b02722410dcf297a15a375c7e041e891d42008b8f6dad0a0a989d9a272536d83a8ff3479303a6bd133670bc60eeed9a13c3f0d45db617

                                                                              • C:\Users\Admin\AppData\Local\Temp\3517.exe

                                                                                Filesize

                                                                                6.9MB

                                                                                MD5

                                                                                9fdd904060a215d18a8625e0a43e0edd

                                                                                SHA1

                                                                                d245b1a8e0e071567551ae46dc85be76f79a58e9

                                                                                SHA256

                                                                                e77914415de29ddffcc5e6b9ac329db44c7e1fa42ca80e6201f0f0fb69e1c61d

                                                                                SHA512

                                                                                bbd54382a117a1b462707ecffdbe22d2a17c054c6eeaed243aaeeeebf42e20e136160a1e3dbf6ffbbbec3cea5d77b769d1683c23bf05c24e822f35816d93704a

                                                                              • C:\Users\Admin\AppData\Local\Temp\3A29.dll

                                                                                Filesize

                                                                                1.7MB

                                                                                MD5

                                                                                03be9ec49eb58c13661ae55d31a21952

                                                                                SHA1

                                                                                7337aa5287d120c1b4f41125745410b55600db54

                                                                                SHA256

                                                                                d2742315faa88146619c6212e8cce4c791c2c31b0bd0a59b3246a0a51c8e6827

                                                                                SHA512

                                                                                628c54145293ba5aa24cef64f3bb66b6d96d91463b6ddc7da0d2d5ca8aa54dc8a07d5fd6658ab2801dc19bb6ded573a9be6d4cadfd88652f4baa282a750f9fe8

                                                                              • C:\Users\Admin\AppData\Local\Temp\3A29.dll

                                                                                Filesize

                                                                                1.7MB

                                                                                MD5

                                                                                03be9ec49eb58c13661ae55d31a21952

                                                                                SHA1

                                                                                7337aa5287d120c1b4f41125745410b55600db54

                                                                                SHA256

                                                                                d2742315faa88146619c6212e8cce4c791c2c31b0bd0a59b3246a0a51c8e6827

                                                                                SHA512

                                                                                628c54145293ba5aa24cef64f3bb66b6d96d91463b6ddc7da0d2d5ca8aa54dc8a07d5fd6658ab2801dc19bb6ded573a9be6d4cadfd88652f4baa282a750f9fe8

                                                                              • C:\Users\Admin\AppData\Local\Temp\510D.exe

                                                                                Filesize

                                                                                11.5MB

                                                                                MD5

                                                                                6020dace849357f1667a1943c8db7291

                                                                                SHA1

                                                                                3cb1268ae732e93e9420e353200f0998d7b1920f

                                                                                SHA256

                                                                                ebf0fbb2d06f3a42839c341b052cfe7b8b4e0b7e93a5f37a3c426f27a762e63a

                                                                                SHA512

                                                                                81d8cea19b6bf63aaf7f9f5b94e5d388febc3cbac961d652fbab8c971748dd79760ad265fc6e456d32b4ef67e1257cc3b1f488f79e8a698df61092545bd8a283

                                                                              • C:\Users\Admin\AppData\Local\Temp\510D.exe

                                                                                Filesize

                                                                                11.5MB

                                                                                MD5

                                                                                6020dace849357f1667a1943c8db7291

                                                                                SHA1

                                                                                3cb1268ae732e93e9420e353200f0998d7b1920f

                                                                                SHA256

                                                                                ebf0fbb2d06f3a42839c341b052cfe7b8b4e0b7e93a5f37a3c426f27a762e63a

                                                                                SHA512

                                                                                81d8cea19b6bf63aaf7f9f5b94e5d388febc3cbac961d652fbab8c971748dd79760ad265fc6e456d32b4ef67e1257cc3b1f488f79e8a698df61092545bd8a283

                                                                              • C:\Users\Admin\AppData\Local\Temp\562F.exe

                                                                                Filesize

                                                                                254KB

                                                                                MD5

                                                                                7df659cf38d9479a573a912e20850e23

                                                                                SHA1

                                                                                dcb5b5b7d34e37e4987ebc6a4b7f4ad0ade7f73a

                                                                                SHA256

                                                                                8a979e640af2c3af89e2684aa394f4436f285f760f2583b49fac1afb2f0c1d81

                                                                                SHA512

                                                                                f61e6e0289342ae64d2b176f6b499f42d735a2d6f7db28396c0133109c5b802c9e1b35e911ecf14869613f6d47cfd4ca02b6d192efdcdaec9e350496a52fcb90

                                                                              • C:\Users\Admin\AppData\Local\Temp\562F.exe

                                                                                Filesize

                                                                                254KB

                                                                                MD5

                                                                                7df659cf38d9479a573a912e20850e23

                                                                                SHA1

                                                                                dcb5b5b7d34e37e4987ebc6a4b7f4ad0ade7f73a

                                                                                SHA256

                                                                                8a979e640af2c3af89e2684aa394f4436f285f760f2583b49fac1afb2f0c1d81

                                                                                SHA512

                                                                                f61e6e0289342ae64d2b176f6b499f42d735a2d6f7db28396c0133109c5b802c9e1b35e911ecf14869613f6d47cfd4ca02b6d192efdcdaec9e350496a52fcb90

                                                                              • C:\Users\Admin\AppData\Local\Temp\6061.exe

                                                                                Filesize

                                                                                4.1MB

                                                                                MD5

                                                                                6eb260aadea02616426a291790968d12

                                                                                SHA1

                                                                                91aa3fb6b6b8352e67f861ec8ff197e151b4e985

                                                                                SHA256

                                                                                b863fbf8b0f4cb5b07485ca342287acf710b6b94f044764627ce92b2a7708bc6

                                                                                SHA512

                                                                                1a5049fb75bed6089ab11b95d530a691947be96b968302c25e44907f80d6bd9a559cabb96628aa47044fe11a6b28fe4d6a9c9b33e1bd72cab5c9631acef99898

                                                                              • C:\Users\Admin\AppData\Local\Temp\6061.exe

                                                                                Filesize

                                                                                4.1MB

                                                                                MD5

                                                                                6eb260aadea02616426a291790968d12

                                                                                SHA1

                                                                                91aa3fb6b6b8352e67f861ec8ff197e151b4e985

                                                                                SHA256

                                                                                b863fbf8b0f4cb5b07485ca342287acf710b6b94f044764627ce92b2a7708bc6

                                                                                SHA512

                                                                                1a5049fb75bed6089ab11b95d530a691947be96b968302c25e44907f80d6bd9a559cabb96628aa47044fe11a6b28fe4d6a9c9b33e1bd72cab5c9631acef99898

                                                                              • C:\Users\Admin\AppData\Local\Temp\6061.exe

                                                                                Filesize

                                                                                4.1MB

                                                                                MD5

                                                                                6eb260aadea02616426a291790968d12

                                                                                SHA1

                                                                                91aa3fb6b6b8352e67f861ec8ff197e151b4e985

                                                                                SHA256

                                                                                b863fbf8b0f4cb5b07485ca342287acf710b6b94f044764627ce92b2a7708bc6

                                                                                SHA512

                                                                                1a5049fb75bed6089ab11b95d530a691947be96b968302c25e44907f80d6bd9a559cabb96628aa47044fe11a6b28fe4d6a9c9b33e1bd72cab5c9631acef99898

                                                                              • C:\Users\Admin\AppData\Local\Temp\K.exe

                                                                                Filesize

                                                                                8KB

                                                                                MD5

                                                                                ac65407254780025e8a71da7b925c4f3

                                                                                SHA1

                                                                                5c7ae625586c1c00ec9d35caa4f71b020425a6ba

                                                                                SHA256

                                                                                26cd9cc9a0dd688411a4f0e2fa099b694b88cab6e9ed10827a175f7b5486e42e

                                                                                SHA512

                                                                                27d87730230d9f594908f904bf298a28e255dced8d515eb0d97e1701078c4405f9f428513c2574d349a7517bd23a3558fb09599a01499ea54590945b981b17ab

                                                                              • C:\Users\Admin\AppData\Local\Temp\K.exe

                                                                                Filesize

                                                                                8KB

                                                                                MD5

                                                                                ac65407254780025e8a71da7b925c4f3

                                                                                SHA1

                                                                                5c7ae625586c1c00ec9d35caa4f71b020425a6ba

                                                                                SHA256

                                                                                26cd9cc9a0dd688411a4f0e2fa099b694b88cab6e9ed10827a175f7b5486e42e

                                                                                SHA512

                                                                                27d87730230d9f594908f904bf298a28e255dced8d515eb0d97e1701078c4405f9f428513c2574d349a7517bd23a3558fb09599a01499ea54590945b981b17ab

                                                                              • C:\Users\Admin\AppData\Local\Temp\K.exe

                                                                                Filesize

                                                                                8KB

                                                                                MD5

                                                                                ac65407254780025e8a71da7b925c4f3

                                                                                SHA1

                                                                                5c7ae625586c1c00ec9d35caa4f71b020425a6ba

                                                                                SHA256

                                                                                26cd9cc9a0dd688411a4f0e2fa099b694b88cab6e9ed10827a175f7b5486e42e

                                                                                SHA512

                                                                                27d87730230d9f594908f904bf298a28e255dced8d515eb0d97e1701078c4405f9f428513c2574d349a7517bd23a3558fb09599a01499ea54590945b981b17ab

                                                                              • C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe

                                                                                Filesize

                                                                                116B

                                                                                MD5

                                                                                ec6aae2bb7d8781226ea61adca8f0586

                                                                                SHA1

                                                                                d82b3bad240f263c1b887c7c0cc4c2ff0e86dfe3

                                                                                SHA256

                                                                                b02fffaba9e664ff7840c82b102d6851ec0bb148cec462cef40999545309e599

                                                                                SHA512

                                                                                aa62a8cd02a03e4f462f76ae6ff2e43849052ce77cca3a2ccf593f6669425830d0910afac3cf2c46dd385454a6fb3b4bd604ae13b9586087d6f22de644f9dfc7

                                                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_k2rgv0ww.fio.ps1

                                                                                Filesize

                                                                                60B

                                                                                MD5

                                                                                d17fe0a3f47be24a6453e9ef58c94641

                                                                                SHA1

                                                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                SHA256

                                                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                SHA512

                                                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                              • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

                                                                                Filesize

                                                                                281KB

                                                                                MD5

                                                                                d98e33b66343e7c96158444127a117f6

                                                                                SHA1

                                                                                bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                                                                                SHA256

                                                                                5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                                                                                SHA512

                                                                                705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                                                                              • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe

                                                                                Filesize

                                                                                281KB

                                                                                MD5

                                                                                d98e33b66343e7c96158444127a117f6

                                                                                SHA1

                                                                                bb716c5509a2bf345c6c1152f6e3e1452d39d50d

                                                                                SHA256

                                                                                5de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1

                                                                                SHA512

                                                                                705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5

                                                                              • C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe

                                                                                Filesize

                                                                                4.2MB

                                                                                MD5

                                                                                cfb47eefb1364872657b05199443bb25

                                                                                SHA1

                                                                                00227917c1dae8fc6f17fdff65741be4f5e57485

                                                                                SHA256

                                                                                7f4f53a9d3da9de64473196fa04ee1dd681f9ca3cdcccab4e1539fc03ab55102

                                                                                SHA512

                                                                                81ead4f60b3d0d5069e9443a5023004e1ee17c42a65cba3b4326ad1d17af5a11a81c4b598d8e1b14a086da60f45fd93e5199ca6b1ffb7a6cc7932ded5701c1a6

                                                                              • C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe

                                                                                Filesize

                                                                                4.2MB

                                                                                MD5

                                                                                cfb47eefb1364872657b05199443bb25

                                                                                SHA1

                                                                                00227917c1dae8fc6f17fdff65741be4f5e57485

                                                                                SHA256

                                                                                7f4f53a9d3da9de64473196fa04ee1dd681f9ca3cdcccab4e1539fc03ab55102

                                                                                SHA512

                                                                                81ead4f60b3d0d5069e9443a5023004e1ee17c42a65cba3b4326ad1d17af5a11a81c4b598d8e1b14a086da60f45fd93e5199ca6b1ffb7a6cc7932ded5701c1a6

                                                                              • C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe

                                                                                Filesize

                                                                                4.2MB

                                                                                MD5

                                                                                cfb47eefb1364872657b05199443bb25

                                                                                SHA1

                                                                                00227917c1dae8fc6f17fdff65741be4f5e57485

                                                                                SHA256

                                                                                7f4f53a9d3da9de64473196fa04ee1dd681f9ca3cdcccab4e1539fc03ab55102

                                                                                SHA512

                                                                                81ead4f60b3d0d5069e9443a5023004e1ee17c42a65cba3b4326ad1d17af5a11a81c4b598d8e1b14a086da60f45fd93e5199ca6b1ffb7a6cc7932ded5701c1a6

                                                                              • C:\Users\Admin\AppData\Local\Temp\d21cbe21e38b385a41a68c5e6dd32f4c.exe

                                                                                Filesize

                                                                                4.2MB

                                                                                MD5

                                                                                cfb47eefb1364872657b05199443bb25

                                                                                SHA1

                                                                                00227917c1dae8fc6f17fdff65741be4f5e57485

                                                                                SHA256

                                                                                7f4f53a9d3da9de64473196fa04ee1dd681f9ca3cdcccab4e1539fc03ab55102

                                                                                SHA512

                                                                                81ead4f60b3d0d5069e9443a5023004e1ee17c42a65cba3b4326ad1d17af5a11a81c4b598d8e1b14a086da60f45fd93e5199ca6b1ffb7a6cc7932ded5701c1a6

                                                                              • C:\Users\Admin\AppData\Local\Temp\is-IN7TE.tmp\_iscrypt.dll

                                                                                Filesize

                                                                                2KB

                                                                                MD5

                                                                                a69559718ab506675e907fe49deb71e9

                                                                                SHA1

                                                                                bc8f404ffdb1960b50c12ff9413c893b56f2e36f

                                                                                SHA256

                                                                                2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

                                                                                SHA512

                                                                                e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

                                                                              • C:\Users\Admin\AppData\Local\Temp\is-IN7TE.tmp\_isdecmp.dll

                                                                                Filesize

                                                                                12KB

                                                                                MD5

                                                                                7cee19d7e00e9a35fc5e7884fd9d1ad8

                                                                                SHA1

                                                                                2c5e8de13bdb6ddc290a9596113f77129ecd26bc

                                                                                SHA256

                                                                                58ee49d4b4f6def91c6561fc5a1b73bc86d8a01b23ce0c8ddbf0ed11f13d5ace

                                                                                SHA512

                                                                                a6955f5aff467f199236ed8a57f4d97af915a3ae81711ff8292e66e66c9f7ee307d7d7aafce09a1bd33c8f7983694cb207fc980d6c3323b475de6278d37bdde8

                                                                              • C:\Users\Admin\AppData\Local\Temp\is-IN7TE.tmp\_isdecmp.dll

                                                                                Filesize

                                                                                12KB

                                                                                MD5

                                                                                7cee19d7e00e9a35fc5e7884fd9d1ad8

                                                                                SHA1

                                                                                2c5e8de13bdb6ddc290a9596113f77129ecd26bc

                                                                                SHA256

                                                                                58ee49d4b4f6def91c6561fc5a1b73bc86d8a01b23ce0c8ddbf0ed11f13d5ace

                                                                                SHA512

                                                                                a6955f5aff467f199236ed8a57f4d97af915a3ae81711ff8292e66e66c9f7ee307d7d7aafce09a1bd33c8f7983694cb207fc980d6c3323b475de6278d37bdde8

                                                                              • C:\Users\Admin\AppData\Local\Temp\is-LDVTS.tmp\is-NPJHJ.tmp

                                                                                Filesize

                                                                                642KB

                                                                                MD5

                                                                                e57693101a63b1f934f462bc7a2ef093

                                                                                SHA1

                                                                                2748ea8c66b980f14c9ce36c1c3061e690cf3ce7

                                                                                SHA256

                                                                                71267ff94c9fc72cbffaeed3bc2f33cef1eeb1887c29c574d7f26595d1a6235f

                                                                                SHA512

                                                                                3dcda686a85b19a9c7b4c96d132e90ed43c7df13ce9456beb2b88c278d8068cc3abcbfe25b1607c7b8281d276efb24809730f352927b326254f3208cbdf54a3e

                                                                              • C:\Users\Admin\AppData\Local\Temp\is-LDVTS.tmp\is-NPJHJ.tmp

                                                                                Filesize

                                                                                642KB

                                                                                MD5

                                                                                e57693101a63b1f934f462bc7a2ef093

                                                                                SHA1

                                                                                2748ea8c66b980f14c9ce36c1c3061e690cf3ce7

                                                                                SHA256

                                                                                71267ff94c9fc72cbffaeed3bc2f33cef1eeb1887c29c574d7f26595d1a6235f

                                                                                SHA512

                                                                                3dcda686a85b19a9c7b4c96d132e90ed43c7df13ce9456beb2b88c278d8068cc3abcbfe25b1607c7b8281d276efb24809730f352927b326254f3208cbdf54a3e

                                                                              • C:\Users\Admin\AppData\Local\Temp\kos2.exe

                                                                                Filesize

                                                                                1.5MB

                                                                                MD5

                                                                                665db9794d6e6e7052e7c469f48de771

                                                                                SHA1

                                                                                ed9a3f9262f675a03a9f1f70856e3532b095c89f

                                                                                SHA256

                                                                                c1b31186d170a2a5755f15682860b3cdc60eac7f97a2db9462dee7ca6fcbc196

                                                                                SHA512

                                                                                69585560e8ac4a2472621dd4da4bf0e636688fc5d710521b0177461f773fcf2a4c7ddb86bc812ecb316985729013212ccfa4992cd1c98f166a4a510e17fcae74

                                                                              • C:\Users\Admin\AppData\Local\Temp\kos2.exe

                                                                                Filesize

                                                                                1.5MB

                                                                                MD5

                                                                                665db9794d6e6e7052e7c469f48de771

                                                                                SHA1

                                                                                ed9a3f9262f675a03a9f1f70856e3532b095c89f

                                                                                SHA256

                                                                                c1b31186d170a2a5755f15682860b3cdc60eac7f97a2db9462dee7ca6fcbc196

                                                                                SHA512

                                                                                69585560e8ac4a2472621dd4da4bf0e636688fc5d710521b0177461f773fcf2a4c7ddb86bc812ecb316985729013212ccfa4992cd1c98f166a4a510e17fcae74

                                                                              • C:\Users\Admin\AppData\Local\Temp\kos2.exe

                                                                                Filesize

                                                                                1.5MB

                                                                                MD5

                                                                                665db9794d6e6e7052e7c469f48de771

                                                                                SHA1

                                                                                ed9a3f9262f675a03a9f1f70856e3532b095c89f

                                                                                SHA256

                                                                                c1b31186d170a2a5755f15682860b3cdc60eac7f97a2db9462dee7ca6fcbc196

                                                                                SHA512

                                                                                69585560e8ac4a2472621dd4da4bf0e636688fc5d710521b0177461f773fcf2a4c7ddb86bc812ecb316985729013212ccfa4992cd1c98f166a4a510e17fcae74

                                                                              • C:\Users\Admin\AppData\Local\Temp\latestX.exe

                                                                                Filesize

                                                                                5.6MB

                                                                                MD5

                                                                                bae29e49e8190bfbbf0d77ffab8de59d

                                                                                SHA1

                                                                                4a6352bb47c7e1666a60c76f9b17ca4707872bd9

                                                                                SHA256

                                                                                f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

                                                                                SHA512

                                                                                9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

                                                                              • C:\Users\Admin\AppData\Local\Temp\latestX.exe

                                                                                Filesize

                                                                                5.6MB

                                                                                MD5

                                                                                bae29e49e8190bfbbf0d77ffab8de59d

                                                                                SHA1

                                                                                4a6352bb47c7e1666a60c76f9b17ca4707872bd9

                                                                                SHA256

                                                                                f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

                                                                                SHA512

                                                                                9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

                                                                              • C:\Users\Admin\AppData\Local\Temp\latestX.exe

                                                                                Filesize

                                                                                5.6MB

                                                                                MD5

                                                                                bae29e49e8190bfbbf0d77ffab8de59d

                                                                                SHA1

                                                                                4a6352bb47c7e1666a60c76f9b17ca4707872bd9

                                                                                SHA256

                                                                                f91e4ff7811a5848561463d970c51870c9299a80117a89fb86a698b9f727de87

                                                                                SHA512

                                                                                9e6cf6519e21143f9b570a878a5ca1bba376256217c34ab676e8d632611d468f277a0d6f946ab8705121002d96a89274f38458affe3df3a3a1c75e336d7d66e2

                                                                              • C:\Users\Admin\AppData\Local\Temp\set16.exe

                                                                                Filesize

                                                                                1.5MB

                                                                                MD5

                                                                                b224196c88f09b615527b2df0e860e49

                                                                                SHA1

                                                                                f9ae161836a34264458d8c0b2a083c98093f1dec

                                                                                SHA256

                                                                                2a11969fcc1df03533ad694a68d56f0e3a67ce359663c3cf228040ab5baa5ed8

                                                                                SHA512

                                                                                d74376c5bd3ba19b8454a17f2f38ab64ad1005b6372c7e162230c822c38f6f8c7d87aef47ef04cb6dceedc731046c30efa6720098cc39b15addd17c809b8296d

                                                                              • C:\Users\Admin\AppData\Local\Temp\set16.exe

                                                                                Filesize

                                                                                1.5MB

                                                                                MD5

                                                                                b224196c88f09b615527b2df0e860e49

                                                                                SHA1

                                                                                f9ae161836a34264458d8c0b2a083c98093f1dec

                                                                                SHA256

                                                                                2a11969fcc1df03533ad694a68d56f0e3a67ce359663c3cf228040ab5baa5ed8

                                                                                SHA512

                                                                                d74376c5bd3ba19b8454a17f2f38ab64ad1005b6372c7e162230c822c38f6f8c7d87aef47ef04cb6dceedc731046c30efa6720098cc39b15addd17c809b8296d

                                                                              • C:\Users\Admin\AppData\Local\Temp\set16.exe

                                                                                Filesize

                                                                                1.5MB

                                                                                MD5

                                                                                b224196c88f09b615527b2df0e860e49

                                                                                SHA1

                                                                                f9ae161836a34264458d8c0b2a083c98093f1dec

                                                                                SHA256

                                                                                2a11969fcc1df03533ad694a68d56f0e3a67ce359663c3cf228040ab5baa5ed8

                                                                                SHA512

                                                                                d74376c5bd3ba19b8454a17f2f38ab64ad1005b6372c7e162230c822c38f6f8c7d87aef47ef04cb6dceedc731046c30efa6720098cc39b15addd17c809b8296d

                                                                              • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

                                                                                Filesize

                                                                                260KB

                                                                                MD5

                                                                                f39a0110a564f4a1c6b96c03982906ec

                                                                                SHA1

                                                                                08e66c93b575c9ac0a18f06741dabcabc88a358b

                                                                                SHA256

                                                                                f794a557ad952ff155b4bfe5665b3f448453c3a50c766478d070368cab69f481

                                                                                SHA512

                                                                                c6659f926f95a8bed1ff779c8445470c3089823abe8c1199f591c313ecee0bd793478cdaab95905c0e8ae2a2b18737daabe887263b7cde1eaaa9ee6976ff7d00

                                                                              • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

                                                                                Filesize

                                                                                260KB

                                                                                MD5

                                                                                f39a0110a564f4a1c6b96c03982906ec

                                                                                SHA1

                                                                                08e66c93b575c9ac0a18f06741dabcabc88a358b

                                                                                SHA256

                                                                                f794a557ad952ff155b4bfe5665b3f448453c3a50c766478d070368cab69f481

                                                                                SHA512

                                                                                c6659f926f95a8bed1ff779c8445470c3089823abe8c1199f591c313ecee0bd793478cdaab95905c0e8ae2a2b18737daabe887263b7cde1eaaa9ee6976ff7d00

                                                                              • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

                                                                                Filesize

                                                                                260KB

                                                                                MD5

                                                                                f39a0110a564f4a1c6b96c03982906ec

                                                                                SHA1

                                                                                08e66c93b575c9ac0a18f06741dabcabc88a358b

                                                                                SHA256

                                                                                f794a557ad952ff155b4bfe5665b3f448453c3a50c766478d070368cab69f481

                                                                                SHA512

                                                                                c6659f926f95a8bed1ff779c8445470c3089823abe8c1199f591c313ecee0bd793478cdaab95905c0e8ae2a2b18737daabe887263b7cde1eaaa9ee6976ff7d00

                                                                              • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe

                                                                                Filesize

                                                                                260KB

                                                                                MD5

                                                                                f39a0110a564f4a1c6b96c03982906ec

                                                                                SHA1

                                                                                08e66c93b575c9ac0a18f06741dabcabc88a358b

                                                                                SHA256

                                                                                f794a557ad952ff155b4bfe5665b3f448453c3a50c766478d070368cab69f481

                                                                                SHA512

                                                                                c6659f926f95a8bed1ff779c8445470c3089823abe8c1199f591c313ecee0bd793478cdaab95905c0e8ae2a2b18737daabe887263b7cde1eaaa9ee6976ff7d00

                                                                              • C:\Users\Admin\AppData\Local\c6072763-766a-4960-9c7f-615370dcc6c1\1BFF.exe

                                                                                Filesize

                                                                                773KB

                                                                                MD5

                                                                                952688e5752abd15bb1b900b2db461a3

                                                                                SHA1

                                                                                71a83957ea93085c7894545c5e33c5fcb8c763d3

                                                                                SHA256

                                                                                256d2ef4432984e12e4dc361e89e1d35ce9b8d55c066f71489bae8827f98c91f

                                                                                SHA512

                                                                                3445765d8efd53b995291b033c57e35726ba0b2d23e8ed351324fae512f81c49583903307983de211c18f31ef4d17adf5fcb1f12d0104ffa21a3a408793c0c5a

                                                                              • C:\Users\Admin\AppData\Roaming\jtsgaec

                                                                                Filesize

                                                                                259KB

                                                                                MD5

                                                                                9985a2b46e58e370fe89691817f70859

                                                                                SHA1

                                                                                b2637db3f33fcdbd769f67e3a8a139d927637c39

                                                                                SHA256

                                                                                805e179bd7fadf38e18f51e2bb87a8d6e58ac854ca9830c970e3f83fecdd964e

                                                                                SHA512

                                                                                16e54e930980a8d71a2b30a9a85ad3864989495a0f8a446bd23057cc81a91cb84d79664c8bc3ecb0baa0f9e39d0a935f995c9f748b11c9a7df6726ae3f0e7850

                                                                              • C:\Users\Admin\AppData\Roaming\jtsgaec

                                                                                Filesize

                                                                                259KB

                                                                                MD5

                                                                                9985a2b46e58e370fe89691817f70859

                                                                                SHA1

                                                                                b2637db3f33fcdbd769f67e3a8a139d927637c39

                                                                                SHA256

                                                                                805e179bd7fadf38e18f51e2bb87a8d6e58ac854ca9830c970e3f83fecdd964e

                                                                                SHA512

                                                                                16e54e930980a8d71a2b30a9a85ad3864989495a0f8a446bd23057cc81a91cb84d79664c8bc3ecb0baa0f9e39d0a935f995c9f748b11c9a7df6726ae3f0e7850

                                                                              • C:\Users\Admin\AppData\Roaming\ussgaec

                                                                                Filesize

                                                                                254KB

                                                                                MD5

                                                                                7df659cf38d9479a573a912e20850e23

                                                                                SHA1

                                                                                dcb5b5b7d34e37e4987ebc6a4b7f4ad0ade7f73a

                                                                                SHA256

                                                                                8a979e640af2c3af89e2684aa394f4436f285f760f2583b49fac1afb2f0c1d81

                                                                                SHA512

                                                                                f61e6e0289342ae64d2b176f6b499f42d735a2d6f7db28396c0133109c5b802c9e1b35e911ecf14869613f6d47cfd4ca02b6d192efdcdaec9e350496a52fcb90

                                                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                Filesize

                                                                                2KB

                                                                                MD5

                                                                                3d086a433708053f9bf9523e1d87a4e8

                                                                                SHA1

                                                                                b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

                                                                                SHA256

                                                                                6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

                                                                                SHA512

                                                                                931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

                                                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                                                Filesize

                                                                                19KB

                                                                                MD5

                                                                                0be2f456931340a6bdc140f5eb9cd277

                                                                                SHA1

                                                                                910ddfc3ff6bfcf96792611b4da620894f648fb4

                                                                                SHA256

                                                                                96970d38a8329e26aa5d14c9e7da0478962643239a33a95d5fb0c1800ca7fe83

                                                                                SHA512

                                                                                7f01ba7b15a83578fdcf3966b59b4ccf43cc4a7d0a241b4641678718b6d428432472e03e8d0146abb9dcaedc38c9c34130b1c8a0809670e349744fad0bddab3a

                                                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                                                Filesize

                                                                                19KB

                                                                                MD5

                                                                                0be2f456931340a6bdc140f5eb9cd277

                                                                                SHA1

                                                                                910ddfc3ff6bfcf96792611b4da620894f648fb4

                                                                                SHA256

                                                                                96970d38a8329e26aa5d14c9e7da0478962643239a33a95d5fb0c1800ca7fe83

                                                                                SHA512

                                                                                7f01ba7b15a83578fdcf3966b59b4ccf43cc4a7d0a241b4641678718b6d428432472e03e8d0146abb9dcaedc38c9c34130b1c8a0809670e349744fad0bddab3a

                                                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                                                Filesize

                                                                                19KB

                                                                                MD5

                                                                                31d51e362a74cac2f2b8806adfe4a789

                                                                                SHA1

                                                                                aa3f97d07eb8e4a674241941fa97f8892ab45a46

                                                                                SHA256

                                                                                02edbe9972badc06cf34b1619f2b9d687065fa46a6305c8c53b5b7f9ee6f9ca8

                                                                                SHA512

                                                                                93586a5b7bac6fa14537600ed3c2b3f89f3a786d68a7280957845efc2925acff4b282d6b058f3b0c38c59b78f18d04866bcf52be83c6642817683c29de1846c2

                                                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                                                Filesize

                                                                                19KB

                                                                                MD5

                                                                                9ece43a15c76df302488fd311a01d2f8

                                                                                SHA1

                                                                                559b1b01ef854f6bd4d37a4be0ac6c8450bfba95

                                                                                SHA256

                                                                                70caf9d2fcbd968d164730407339036b85b819f65435bb8ec0df7c4f03b74b28

                                                                                SHA512

                                                                                ef3256f6706a5324c2e8f85792665c582e2ba796e1a86aedb15d9f5081f9c1fd4f28444fca740d89e253f54b259006047ca9291eef1b900ec94401777a50ca2e

                                                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                                                Filesize

                                                                                19KB

                                                                                MD5

                                                                                2deafc15e3f6985ece6c26e6d124fe63

                                                                                SHA1

                                                                                2a241a1b22be6c2d84235b733751d10211c9c915

                                                                                SHA256

                                                                                0211e7be9bcef6e5e124075bba6013cefe1c7fd1a1d5c99f30c143abd3c2a681

                                                                                SHA512

                                                                                fb1a24e81a6b45e01640ee1d2cc72c196652f2a1982adfc213382b9112fb5280c85f4b8550775d6d2895412ac94d018a5efadb8c4979f31c444de1d85fa5df8b

                                                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                                                Filesize

                                                                                19KB

                                                                                MD5

                                                                                2deafc15e3f6985ece6c26e6d124fe63

                                                                                SHA1

                                                                                2a241a1b22be6c2d84235b733751d10211c9c915

                                                                                SHA256

                                                                                0211e7be9bcef6e5e124075bba6013cefe1c7fd1a1d5c99f30c143abd3c2a681

                                                                                SHA512

                                                                                fb1a24e81a6b45e01640ee1d2cc72c196652f2a1982adfc213382b9112fb5280c85f4b8550775d6d2895412ac94d018a5efadb8c4979f31c444de1d85fa5df8b

                                                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                                                Filesize

                                                                                19KB

                                                                                MD5

                                                                                656406d445719c6c8c9460304ebbdeaf

                                                                                SHA1

                                                                                e6daefbda82e1ede24d160f873569871b7754807

                                                                                SHA256

                                                                                2fb93d83d9a02b8f73177b92e8b694a8716f0b5088eb768607716cac5ed3b341

                                                                                SHA512

                                                                                b8174c3ac704a38e34d8c5cd435b0de0665c97a908fe4623b842ea13818750eb1b2e950208f0c81f018e711097dcc2acd919413690eef9118df5afe61c9c9745

                                                                              • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                                                                                Filesize

                                                                                19KB

                                                                                MD5

                                                                                d51430b4d0a827fa147c1019aee1487d

                                                                                SHA1

                                                                                67cee86a3c546742e855fdb232cd0958738fc6e9

                                                                                SHA256

                                                                                3b66bf6c326939a24073bafce9a863f91d239cd0d90d05889edf6106ddd0bccd

                                                                                SHA512

                                                                                5f647c4e05defb3b66f225a0cabccc65cb284b55151d86086634cadd376895f4cc2be0a52bca27b60d5ee71c924a2930c4d565d12e8f11b4d61af7c1d9aaaa91

                                                                              • C:\Windows\rss\csrss.exe

                                                                                Filesize

                                                                                4.1MB

                                                                                MD5

                                                                                6eb260aadea02616426a291790968d12

                                                                                SHA1

                                                                                91aa3fb6b6b8352e67f861ec8ff197e151b4e985

                                                                                SHA256

                                                                                b863fbf8b0f4cb5b07485ca342287acf710b6b94f044764627ce92b2a7708bc6

                                                                                SHA512

                                                                                1a5049fb75bed6089ab11b95d530a691947be96b968302c25e44907f80d6bd9a559cabb96628aa47044fe11a6b28fe4d6a9c9b33e1bd72cab5c9631acef99898

                                                                              • C:\Windows\rss\csrss.exe

                                                                                Filesize

                                                                                4.1MB

                                                                                MD5

                                                                                6eb260aadea02616426a291790968d12

                                                                                SHA1

                                                                                91aa3fb6b6b8352e67f861ec8ff197e151b4e985

                                                                                SHA256

                                                                                b863fbf8b0f4cb5b07485ca342287acf710b6b94f044764627ce92b2a7708bc6

                                                                                SHA512

                                                                                1a5049fb75bed6089ab11b95d530a691947be96b968302c25e44907f80d6bd9a559cabb96628aa47044fe11a6b28fe4d6a9c9b33e1bd72cab5c9631acef99898

                                                                              • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                                                                Filesize

                                                                                4KB

                                                                                MD5

                                                                                bdb25c22d14ec917e30faf353826c5de

                                                                                SHA1

                                                                                6c2feb9cea9237bc28842ebf2fea68b3bd7ad190

                                                                                SHA256

                                                                                e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495

                                                                                SHA512

                                                                                b5eddbfd4748298a302e2963cfd12d849130b6dcb8f0f85a2a623caed0ff9bd88f4ec726f646dbebfca4964adc35f882ec205113920cb546cc08193739d6728c

                                                                              • C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                b42c70c1dbf0d1d477ec86902db9e986

                                                                                SHA1

                                                                                1d1c0a670748b3d10bee8272e5d67a4fabefd31f

                                                                                SHA256

                                                                                8ed3b348989cdc967d1fc0e887b2a2f5a656680d8d14ebd3cb71a10c2f55867a

                                                                                SHA512

                                                                                57fb278a8b2e83d01fac2a031c90e0e2bd5e4c1a360cfa4308490eb07e1b9d265b1f28399d0f10b141a6438ba92dd5f9ce4f18530ec277fece0eb7678041cbc5

                                                                              • C:\Windows\windefender.exe

                                                                                Filesize

                                                                                2.0MB

                                                                                MD5

                                                                                8e67f58837092385dcf01e8a2b4f5783

                                                                                SHA1

                                                                                012c49cfd8c5d06795a6f67ea2baf2a082cf8625

                                                                                SHA256

                                                                                166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

                                                                                SHA512

                                                                                40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

                                                                              • C:\Windows\windefender.exe

                                                                                Filesize

                                                                                2.0MB

                                                                                MD5

                                                                                8e67f58837092385dcf01e8a2b4f5783

                                                                                SHA1

                                                                                012c49cfd8c5d06795a6f67ea2baf2a082cf8625

                                                                                SHA256

                                                                                166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

                                                                                SHA512

                                                                                40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

                                                                              • C:\Windows\windefender.exe

                                                                                Filesize

                                                                                2.0MB

                                                                                MD5

                                                                                8e67f58837092385dcf01e8a2b4f5783

                                                                                SHA1

                                                                                012c49cfd8c5d06795a6f67ea2baf2a082cf8625

                                                                                SHA256

                                                                                166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa

                                                                                SHA512

                                                                                40d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec

                                                                              • memory/452-149-0x0000000000580000-0x000000000058B000-memory.dmp

                                                                                Filesize

                                                                                44KB

                                                                              • memory/452-148-0x00000000006C0000-0x00000000007C0000-memory.dmp

                                                                                Filesize

                                                                                1024KB

                                                                              • memory/452-307-0x0000000000400000-0x00000000004F4000-memory.dmp

                                                                                Filesize

                                                                                976KB

                                                                              • memory/452-150-0x0000000000400000-0x00000000004F4000-memory.dmp

                                                                                Filesize

                                                                                976KB

                                                                              • memory/1136-165-0x0000000000400000-0x0000000000413000-memory.dmp

                                                                                Filesize

                                                                                76KB

                                                                              • memory/1136-186-0x0000000000400000-0x0000000000413000-memory.dmp

                                                                                Filesize

                                                                                76KB

                                                                              • memory/1512-293-0x0000000000400000-0x000000000045A000-memory.dmp

                                                                                Filesize

                                                                                360KB

                                                                              • memory/1512-300-0x00000000753B0000-0x0000000075B60000-memory.dmp

                                                                                Filesize

                                                                                7.7MB

                                                                              • memory/1832-35-0x0000000000960000-0x00000000009F5000-memory.dmp

                                                                                Filesize

                                                                                596KB

                                                                              • memory/1832-36-0x00000000025B0000-0x00000000026CB000-memory.dmp

                                                                                Filesize

                                                                                1.1MB

                                                                              • memory/1928-41-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                Filesize

                                                                                1.2MB

                                                                              • memory/1928-37-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                Filesize

                                                                                1.2MB

                                                                              • memory/1928-43-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                Filesize

                                                                                1.2MB

                                                                              • memory/1928-57-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                Filesize

                                                                                1.2MB

                                                                              • memory/1928-39-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                Filesize

                                                                                1.2MB

                                                                              • memory/2068-82-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                Filesize

                                                                                1.2MB

                                                                              • memory/2068-81-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                Filesize

                                                                                1.2MB

                                                                              • memory/2068-84-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                Filesize

                                                                                1.2MB

                                                                              • memory/2352-262-0x0000000002E40000-0x000000000372B000-memory.dmp

                                                                                Filesize

                                                                                8.9MB

                                                                              • memory/2352-276-0x0000000000400000-0x0000000000D1B000-memory.dmp

                                                                                Filesize

                                                                                9.1MB

                                                                              • memory/2352-235-0x0000000002930000-0x0000000002D32000-memory.dmp

                                                                                Filesize

                                                                                4.0MB

                                                                              • memory/2376-97-0x00000000028C0000-0x00000000029B9000-memory.dmp

                                                                                Filesize

                                                                                996KB

                                                                              • memory/2376-92-0x00000000028C0000-0x00000000029B9000-memory.dmp

                                                                                Filesize

                                                                                996KB

                                                                              • memory/2376-69-0x0000000010000000-0x00000000101B1000-memory.dmp

                                                                                Filesize

                                                                                1.7MB

                                                                              • memory/2376-75-0x0000000000B80000-0x0000000000B86000-memory.dmp

                                                                                Filesize

                                                                                24KB

                                                                              • memory/2376-89-0x00000000027A0000-0x00000000028B2000-memory.dmp

                                                                                Filesize

                                                                                1.1MB

                                                                              • memory/2376-95-0x00000000028C0000-0x00000000029B9000-memory.dmp

                                                                                Filesize

                                                                                996KB

                                                                              • memory/2384-228-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                Filesize

                                                                                36KB

                                                                              • memory/2384-223-0x0000000000400000-0x0000000000409000-memory.dmp

                                                                                Filesize

                                                                                36KB

                                                                              • memory/2604-233-0x00000000020D0000-0x00000000020D1000-memory.dmp

                                                                                Filesize

                                                                                4KB

                                                                              • memory/2628-308-0x0000000000400000-0x0000000000627000-memory.dmp

                                                                                Filesize

                                                                                2.2MB

                                                                              • memory/2628-305-0x0000000000400000-0x0000000000627000-memory.dmp

                                                                                Filesize

                                                                                2.2MB

                                                                              • memory/2964-227-0x0000000000B10000-0x0000000000C10000-memory.dmp

                                                                                Filesize

                                                                                1024KB

                                                                              • memory/2964-203-0x00000000008E0000-0x00000000008E9000-memory.dmp

                                                                                Filesize

                                                                                36KB

                                                                              • memory/3132-101-0x0000000000930000-0x00000000014B4000-memory.dmp

                                                                                Filesize

                                                                                11.5MB

                                                                              • memory/3132-146-0x00000000753B0000-0x0000000075B60000-memory.dmp

                                                                                Filesize

                                                                                7.7MB

                                                                              • memory/3132-103-0x00000000753B0000-0x0000000075B60000-memory.dmp

                                                                                Filesize

                                                                                7.7MB

                                                                              • memory/3324-292-0x0000000000400000-0x0000000000627000-memory.dmp

                                                                                Filesize

                                                                                2.2MB

                                                                              • memory/3324-266-0x0000000000400000-0x0000000000627000-memory.dmp

                                                                                Filesize

                                                                                2.2MB

                                                                              • memory/3436-4-0x00000000022C0000-0x00000000022D6000-memory.dmp

                                                                                Filesize

                                                                                88KB

                                                                              • memory/3436-301-0x0000000002BA0000-0x0000000002BB6000-memory.dmp

                                                                                Filesize

                                                                                88KB

                                                                              • memory/3516-168-0x00007FF6D3790000-0x00007FF6D3EE3000-memory.dmp

                                                                                Filesize

                                                                                7.3MB

                                                                              • memory/3516-326-0x00007FF6D3790000-0x00007FF6D3EE3000-memory.dmp

                                                                                Filesize

                                                                                7.3MB

                                                                              • memory/4204-130-0x00000000007C0000-0x000000000093E000-memory.dmp

                                                                                Filesize

                                                                                1.5MB

                                                                              • memory/4204-191-0x00000000753B0000-0x0000000075B60000-memory.dmp

                                                                                Filesize

                                                                                7.7MB

                                                                              • memory/4204-135-0x00000000753B0000-0x0000000075B60000-memory.dmp

                                                                                Filesize

                                                                                7.7MB

                                                                              • memory/4368-73-0x0000000076610000-0x0000000076700000-memory.dmp

                                                                                Filesize

                                                                                960KB

                                                                              • memory/4368-85-0x0000000076610000-0x0000000076700000-memory.dmp

                                                                                Filesize

                                                                                960KB

                                                                              • memory/4368-297-0x0000000005710000-0x0000000005720000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/4368-22-0x0000000000910000-0x00000000010C6000-memory.dmp

                                                                                Filesize

                                                                                7.7MB

                                                                              • memory/4368-303-0x0000000076610000-0x0000000076700000-memory.dmp

                                                                                Filesize

                                                                                960KB

                                                                              • memory/4368-234-0x0000000005550000-0x0000000005565000-memory.dmp

                                                                                Filesize

                                                                                84KB

                                                                              • memory/4368-23-0x0000000076610000-0x0000000076700000-memory.dmp

                                                                                Filesize

                                                                                960KB

                                                                              • memory/4368-310-0x0000000000910000-0x00000000010C6000-memory.dmp

                                                                                Filesize

                                                                                7.7MB

                                                                              • memory/4368-24-0x0000000076610000-0x0000000076700000-memory.dmp

                                                                                Filesize

                                                                                960KB

                                                                              • memory/4368-25-0x0000000076610000-0x0000000076700000-memory.dmp

                                                                                Filesize

                                                                                960KB

                                                                              • memory/4368-26-0x0000000076610000-0x0000000076700000-memory.dmp

                                                                                Filesize

                                                                                960KB

                                                                              • memory/4368-278-0x0000000005550000-0x0000000005565000-memory.dmp

                                                                                Filesize

                                                                                84KB

                                                                              • memory/4368-267-0x0000000005550000-0x0000000005565000-memory.dmp

                                                                                Filesize

                                                                                84KB

                                                                              • memory/4368-255-0x0000000005550000-0x0000000005565000-memory.dmp

                                                                                Filesize

                                                                                84KB

                                                                              • memory/4368-231-0x0000000005550000-0x0000000005565000-memory.dmp

                                                                                Filesize

                                                                                84KB

                                                                              • memory/4368-225-0x0000000005550000-0x0000000005565000-memory.dmp

                                                                                Filesize

                                                                                84KB

                                                                              • memory/4368-185-0x0000000005550000-0x0000000005565000-memory.dmp

                                                                                Filesize

                                                                                84KB

                                                                              • memory/4368-193-0x0000000005550000-0x0000000005565000-memory.dmp

                                                                                Filesize

                                                                                84KB

                                                                              • memory/4368-27-0x0000000076610000-0x0000000076700000-memory.dmp

                                                                                Filesize

                                                                                960KB

                                                                              • memory/4368-170-0x0000000005550000-0x0000000005565000-memory.dmp

                                                                                Filesize

                                                                                84KB

                                                                              • memory/4368-204-0x0000000005550000-0x0000000005565000-memory.dmp

                                                                                Filesize

                                                                                84KB

                                                                              • memory/4368-162-0x0000000005550000-0x0000000005565000-memory.dmp

                                                                                Filesize

                                                                                84KB

                                                                              • memory/4368-152-0x0000000005550000-0x0000000005565000-memory.dmp

                                                                                Filesize

                                                                                84KB

                                                                              • memory/4368-151-0x0000000005550000-0x0000000005565000-memory.dmp

                                                                                Filesize

                                                                                84KB

                                                                              • memory/4368-28-0x0000000076610000-0x0000000076700000-memory.dmp

                                                                                Filesize

                                                                                960KB

                                                                              • memory/4368-29-0x0000000076610000-0x0000000076700000-memory.dmp

                                                                                Filesize

                                                                                960KB

                                                                              • memory/4368-30-0x0000000076610000-0x0000000076700000-memory.dmp

                                                                                Filesize

                                                                                960KB

                                                                              • memory/4368-147-0x0000000005550000-0x000000000556C000-memory.dmp

                                                                                Filesize

                                                                                112KB

                                                                              • memory/4368-31-0x0000000077EC4000-0x0000000077EC6000-memory.dmp

                                                                                Filesize

                                                                                8KB

                                                                              • memory/4368-40-0x0000000000910000-0x00000000010C6000-memory.dmp

                                                                                Filesize

                                                                                7.7MB

                                                                              • memory/4368-77-0x0000000076610000-0x0000000076700000-memory.dmp

                                                                                Filesize

                                                                                960KB

                                                                              • memory/4368-76-0x0000000076610000-0x0000000076700000-memory.dmp

                                                                                Filesize

                                                                                960KB

                                                                              • memory/4368-42-0x0000000005830000-0x0000000005DD4000-memory.dmp

                                                                                Filesize

                                                                                5.6MB

                                                                              • memory/4368-72-0x0000000076610000-0x0000000076700000-memory.dmp

                                                                                Filesize

                                                                                960KB

                                                                              • memory/4368-70-0x0000000076610000-0x0000000076700000-memory.dmp

                                                                                Filesize

                                                                                960KB

                                                                              • memory/4368-65-0x0000000076610000-0x0000000076700000-memory.dmp

                                                                                Filesize

                                                                                960KB

                                                                              • memory/4368-66-0x0000000076610000-0x0000000076700000-memory.dmp

                                                                                Filesize

                                                                                960KB

                                                                              • memory/4368-55-0x0000000000910000-0x00000000010C6000-memory.dmp

                                                                                Filesize

                                                                                7.7MB

                                                                              • memory/4368-46-0x0000000005510000-0x000000000551A000-memory.dmp

                                                                                Filesize

                                                                                40KB

                                                                              • memory/4368-45-0x00000000055A0000-0x000000000563C000-memory.dmp

                                                                                Filesize

                                                                                624KB

                                                                              • memory/4368-44-0x0000000005360000-0x00000000053F2000-memory.dmp

                                                                                Filesize

                                                                                584KB

                                                                              • memory/4492-271-0x00000000005E0000-0x00000000005EC000-memory.dmp

                                                                                Filesize

                                                                                48KB

                                                                              • memory/4492-252-0x00000000005E0000-0x00000000005EC000-memory.dmp

                                                                                Filesize

                                                                                48KB

                                                                              • memory/4760-78-0x0000000002360000-0x00000000023F7000-memory.dmp

                                                                                Filesize

                                                                                604KB

                                                                              • memory/4848-3-0x0000000000970000-0x000000000097B000-memory.dmp

                                                                                Filesize

                                                                                44KB

                                                                              • memory/4848-1-0x00000000009F0000-0x0000000000AF0000-memory.dmp

                                                                                Filesize

                                                                                1024KB

                                                                              • memory/4848-2-0x0000000000400000-0x00000000007CA000-memory.dmp

                                                                                Filesize

                                                                                3.8MB

                                                                              • memory/4848-5-0x0000000000400000-0x00000000007CA000-memory.dmp

                                                                                Filesize

                                                                                3.8MB

                                                                              • memory/4852-230-0x0000000001070000-0x00000000010F0000-memory.dmp

                                                                                Filesize

                                                                                512KB

                                                                              • memory/4852-207-0x0000000001000000-0x000000000106B000-memory.dmp

                                                                                Filesize

                                                                                428KB

                                                                              • memory/4852-205-0x0000000001000000-0x000000000106B000-memory.dmp

                                                                                Filesize

                                                                                428KB

                                                                              • memory/5056-199-0x00007FFD3EA40000-0x00007FFD3F501000-memory.dmp

                                                                                Filesize

                                                                                10.8MB

                                                                              • memory/5056-224-0x000000001AFD0000-0x000000001AFE0000-memory.dmp

                                                                                Filesize

                                                                                64KB

                                                                              • memory/5056-184-0x0000000000340000-0x0000000000348000-memory.dmp

                                                                                Filesize

                                                                                32KB

                                                                              • memory/5064-294-0x0000000000400000-0x0000000000D1B000-memory.dmp

                                                                                Filesize

                                                                                9.1MB

                                                                              • memory/5064-288-0x00000000029E0000-0x0000000002DDE000-memory.dmp

                                                                                Filesize

                                                                                4.0MB