Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    162s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/11/2023, 20:34

General

  • Target

    updater.exe

  • Size

    150.1MB

  • MD5

    50d4debceee779bdc030f5997a8d3ffc

  • SHA1

    9154fb52404b2f673d5a2f07dd70dc39239ff229

  • SHA256

    6cbedd2be007d13ba423469aacafcaab33e6669eead026be6acb82adac83f195

  • SHA512

    2250e3da04c927964ea6613348f6ca9ad083b21d58dce80e5b149a3f920ee5da6cbd9b3fba20e93481e797f209783aac6b8d9749d0d3c26c9ef8bdc072209901

  • SSDEEP

    786432:QTKLbMT/OBq3F/Fje9VO5mUWc1F3UINm4C1gluE4DmSvI/iuT9FaSc:QTKLbMThfCamUWUBUIE4CQubWK

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 64 IoCs
  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\updater.exe
    "C:\Users\Admin\AppData\Local\Temp\updater.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2844
    • C:\ProgramData\temp\temp.exe
      "C:\ProgramData\temp\temp.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of AdjustPrivilegeToken
      PID:912
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:1744

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\D3DCompiler_47_cor3.dll

      Filesize

      4.3MB

      MD5

      9b1148a147fc307a501e8c540048991c

      SHA1

      7bbdf247051937141121ae6132b0d4f2458ae7b1

      SHA256

      21df5696011156fe64f2dff47c8ed5e90817021f91f70b6d9707fd58cd1b0b81

      SHA512

      e06185401efcf84d2be23c0afefd241eef89414f68133c99cbc67d55d865ca9aec24f94b735afcbb5975fa2f2e56118a8a980f1473ebd248b265dee477111ee5

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\DirectWriteForwarder.dll

      Filesize

      489KB

      MD5

      af2d0e8aff33802d15a8625bac6096e4

      SHA1

      f4f268bb893ba8d5b9d643adf4af0f5c1b8d4376

      SHA256

      cf27219514016c25089feab1d5f215a01f5a4fa344db989e7f0ccb806dc2998a

      SHA512

      f7e8a9e87dcea6c2faf306eaed0ea631154d1afedebe0b63097c637155f91d9dde579e7ba3bfd42be94e6317dacef5f8e8fe2bd8d6e5882820feeb0e4180d1d5

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\Microsoft.Win32.Primitives.dll

      Filesize

      20KB

      MD5

      260e8f4212344bc2a980cc1d30f2985a

      SHA1

      34814f2afdbcfbc43742b3478723aee7fa597126

      SHA256

      9e6ec49a9fc8f7b26a8c875a251e821fb3ad7532a2b58d849652cea18f9358d1

      SHA512

      4553de8ce1936ba18389a43152ab8c66019fa3507ea6f1d2eeada5494f7fa14075d4d9724f09543a7c61ce837afd068dc8cb3cb5132dfb2b831e018423ffe6e3

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\Microsoft.Win32.Registry.dll

      Filesize

      80KB

      MD5

      9e421d33f9237373e5863d55b6eefe0e

      SHA1

      2553db205053b08af74cada0e172d03cd6c93c74

      SHA256

      bae15698982b00c0a95ba861298beba94e800689b4c2f6206eb52c4b6862e4a1

      SHA512

      9b0b8f6b3c18d3e9034ffeeda9b34668814325f91324615ddc1ee199792a71e919cc02fd642cdb05d3a3aae94d0b7906c3ab3f97404f08cffe7a23e7dc88be22

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\PresentationCore.dll

      Filesize

      8.3MB

      MD5

      b636b37e533b90a74990be69a93565e0

      SHA1

      88e55a81ff5362881e4ba5aed3241f9697dd31b0

      SHA256

      e381f473912a72f5aab95e9725891d72975f56ae30033b951122e61b088dd018

      SHA512

      dd1a1d021c38eab2dfeeb7d934b436a0581658c30b446b6730913d53c8712228c8d3212150d2346be7594a4c61ba52a97d270c2455a21a66367372db21d99766

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\PresentationFramework.Aero2.dll

      Filesize

      452KB

      MD5

      74a158a2af0c471b44698770022daba6

      SHA1

      2628d883a11438771d2598aeab33e92b8c640a7c

      SHA256

      58225a6ae0033caf9ff6ceed93c45f1500d4d8a8853b3833166a3f4510a734cb

      SHA512

      28ad24bd74828475752517a49863a781a77107ffd38f2f025acf81ddafd7106f22168966a29d6f4ed2d9b181abd2dd08ca1f876b2891df51d0cc536c60fb5e1d

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\PresentationFramework.dll

      Filesize

      15.0MB

      MD5

      09c133ce1e0e536ab1a008039b15fd63

      SHA1

      c4d0fef5b4d2253f2d9fcfecb6a60b375d0da785

      SHA256

      8c4bbf6909e2a243a024ec023c2d2d78fbb1ece9b12c2378cdd47117d65960fe

      SHA512

      e49f34e15f3513c1ced2730986ebbf56a07d112f8603e4fffc73cb9f13f7854ff414b8ecfde67ae1c396343b2135577f3f49609d0ab6b2ad9a5914e7ef2729fb

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\PresentationNative_cor3.dll

      Filesize

      1.2MB

      MD5

      b86593724d5f1a2f3c984ad4a96614ed

      SHA1

      e7b36c6a9a9658de6dff21c5cb33ec6c2ea6a375

      SHA256

      5b3d8bf8dc82a760c4d32ead69a48cfba7204501128febfac7f278ecbae6cc63

      SHA512

      dc253f948851c405f8c0eb6406ad30b406a5fd5d382f624d724679716297eee47a3d36747b9b055c00094829356cb919cc0f25b20c8f1b12a1000035b64e419b

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\System.Buffers.dll

      Filesize

      13KB

      MD5

      9e29766fd81973ea4a888d9d8570547c

      SHA1

      f70ca0549e50c5bdc3c063ddcc6b27022e91951e

      SHA256

      e54022876ca51e78c5bc6e2c38cbdf78b8eb42b5281c757360e5b39e6b2198dd

      SHA512

      447e01a36f7738a7e6b0a07c2f17c6731585b64d00929bec0f4229ebd841da53a4707187084d6973c5fbc0233366f13a07521a4396f81422ab0a8618de6a94a9

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\System.Collections.Concurrent.dll

      Filesize

      184KB

      MD5

      1e8ef1086eaac01529df7018c29b4cda

      SHA1

      e73a1722fb3e6c5dc47efcf49fba7569c1d3d200

      SHA256

      0a3578d6243ed34f03575ecd87a14254b777fcafba9d8a121be04593761711a0

      SHA512

      27cd5ad8db4c5173bd2dce52ee16fe86045643da708e485bd79c53b82bbc465d89603ffcbd4a7511414df3d65a6fa58cfe0c6bab27a3f2d87805621b243aa084

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\System.Collections.NonGeneric.dll

      Filesize

      94KB

      MD5

      f88a97c4ecea136de1f96ddf91ff65ea

      SHA1

      9a223d80f2ba6fec1bc273ef30ab2cec2d3dd09b

      SHA256

      a1dc9c89ee2274c03d1edb5022a9d8c6165012043d830f68b7aca2db025c65c4

      SHA512

      a7ad9532105d1b52104214b7b05f1b6f09d7a749c781a10ffd890c6290282070e7690524ece65c991bfd5cc88bde6a40dddbb94a7787f5c335a8b91a58d563ee

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\System.Collections.Specialized.dll

      Filesize

      87KB

      MD5

      17ff98e36024c1403c65ec03fda1b02d

      SHA1

      76d65081c99eabe5ca862f06ca8703cf6f3fc3e3

      SHA256

      605dc92eb8c05e24667888c3ac3aeaf0fc275ac143472ae8262548a8fd9d7ebe

      SHA512

      37452792ae5289fb5bf8bc40d854792c1d7569d5f78b8a46f34e2e5f0af9e3c2795074d6e9d955f29ba581a4eec7455ced3df5691e37203d37c010f679715ff4

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\System.Collections.dll

      Filesize

      323KB

      MD5

      dfb58dc59adbba918a865db760e37656

      SHA1

      8d3e6c40582bf566ad7f3e0737f18e31c283f5fb

      SHA256

      65297cee4597fff78e0af6f1c4a74d1ba265a0782fc287c3fef19a8fc0060666

      SHA512

      0c247c3a0c618818de3685cc4c2efc45cbf2790272a6ea0e07a3ef3e4cce9c13778f6dd0ab859a036df4fa157d4cce17761de66514ac00426e9256a7151c524f

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\System.ComponentModel.EventBasedAsync.dll

      Filesize

      33KB

      MD5

      45a4f33ca533d93e14dd5290286835ea

      SHA1

      8a3d0abb63aff06337400bb3236ff71ade721c65

      SHA256

      f858338023522f63d6ce9783093ea1b74d9f23a6a644d1652c8ca2ab62869113

      SHA512

      9696db0e9e0fa9cf4ca2ecefd56eadc03a763b191312a63080316d702edb06d560a0181f6802b8d3b96ec6cd4792b2f2ae94c549ef0d890c5f5720154e9c367e

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\System.ComponentModel.Primitives.dll

      Filesize

      51KB

      MD5

      ef279fea488cbf34e39cf20401d3c1a7

      SHA1

      2db78001a56d020ad8a7f8162016e2129d2393f7

      SHA256

      4082df3f095ad40b6c0b275dff4849efe7a9ca976cb414bf592bc62aba9e5ef2

      SHA512

      9c09e4880ea6041d0d9e92d5f7175905728ca0fa520401e291f1b45cffd1bc24e0cb1a5b5d4c0ce318dee6cf17117ff67352cfc9b2970951bc9f7c36d16f8e53

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\System.ComponentModel.TypeConverter.dll

      Filesize

      690KB

      MD5

      23caec7d94a92361228588a0695f971c

      SHA1

      35e24c62f99a616e026ffe81206830b7eb68c8a4

      SHA256

      e1b7f10d16f568a7d1511e1b441b49fc66b6d13ae2d5646f788c11d55460a16d

      SHA512

      66c3d73eea8ab7e2a45306c54110e600fb57d739c15dbe5dd7229f5910ceb22b5e4ce728fb2561545414209a9637879c86f846f8fb29511a9e78851d3dd419a8

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\System.ComponentModel.dll

      Filesize

      15KB

      MD5

      4f09e766f50057a2d2b3c01f4bf7c0f3

      SHA1

      b2ab68c44411f648cf44af4e26f166cb010b60c7

      SHA256

      687ee90d73a5f1bc080d7a94206bfb06fad00538d2607ba7738827862907e602

      SHA512

      7f6fd9fe80987c7515d73a89097aaa7fde417d3065d3a8aabc0710b93731549b59bd639157677f45fcdb3f184a0cb16c7218dbabebd1748d4ba6e7f1c41c72e8

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\System.Configuration.ConfigurationManager.dll

      Filesize

      958KB

      MD5

      4bcb32f0294b7db91b5f1f5ddfee39e0

      SHA1

      68b04300a2a3f4a0b9247064619a91a7027b0942

      SHA256

      1a8d3aff4276cbe18636de612925c9abb7580a6e009671f7c5e4eea8eb93db3e

      SHA512

      009dd9a90a8729b1b34f237e40a4c5c670f2bd849fce2a6b1bc0b18323896c09bbe804c6826d4e3f3b14cb40043ae8621fcbe3a595701d1a9f4befb2bcf20e7e

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\System.Diagnostics.Debug.dll

      Filesize

      13KB

      MD5

      bdc70e8964b10c2459b047b9512841b1

      SHA1

      66c43b48a25519a34004e778f09db3bb25ddbd97

      SHA256

      bcea890b674102783d0e91a58fca4448d72482170443e289312789a2b5116e0e

      SHA512

      c11d4578f915ceabb0613a5de3aa47924ff93e1969f236de2e2f4cd4607cfb8832e3109ee47b47f228fa5b5b91f66decb230b19f843a7fa3afeaa3e8210f0193

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\System.Diagnostics.Process.dll

      Filesize

      250KB

      MD5

      8aabed9743eed6e32834f7602979aef8

      SHA1

      7fd29f301dbfd59f3be195699fda79277501532c

      SHA256

      b11533f158280ad825263f8802ea2a613e1e88918ea0a3f95f4fe0926af1e014

      SHA512

      a58ac6e118cda007f25052e499bc17a519864417c365dd612faff0ed76199451c1a68cbd28a97c5da858ee4fec9c1fa61481923d0aae84c52bba5505f0142700

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\System.Diagnostics.TraceSource.dll

      Filesize

      122KB

      MD5

      64dfd6a3f7cc631d054ec1f7a33d1a99

      SHA1

      410b5046cb4cdd026f88307363fd764985ff4d59

      SHA256

      ff15aba476b46493f9feeef74418bb4e2602bd79ce42c4ad5dcaf7361fe1423a

      SHA512

      7dca65dc72ae3d2d71c201dc511c3a57b09da57640249ec1ce58136a4b2df483c8f7eca4a92340a0de8d7ffedd77520856bda28f99a71f25cd3b4fc8a7356668

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\System.Diagnostics.Tracing.dll

      Filesize

      14KB

      MD5

      be9bd27edfe9d7f0de2d4435922f5cf2

      SHA1

      f14b5128ca02ee7ca3fe24411a0b41e6ceee4fb6

      SHA256

      1d711e5c27260e1a71672adcfc2501b1cac0798c9afde903fee3a8ed7b023e81

      SHA512

      9916ca08702b41162d0858a10cecceb94f918c905ae7cb5a3eebc4bc1a4bc3d667eb07ae58162d7a30cd6df48086cae1099c33bd5f5493a4c358d8ce9a11ace5

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\System.Drawing.Primitives.dll

      Filesize

      120KB

      MD5

      c198922a00839041a13e51a0c19a5e2e

      SHA1

      82e3f548c107770100494afaec6986cacf30c735

      SHA256

      847887ae9c394c8c4ea4d3704b1d4cdb6abb40a06572c64bd0a97209f32b8fe2

      SHA512

      04ea8b93366c4de6f3b07302ad0c397a96e5e56215d48259270d0c8012f46d250c0b4548f25399ae5b27313df4b6f0b7fc81a4d363fae3630ca195281ec3ef7d

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\System.IO.FileSystem.dll

      Filesize

      212KB

      MD5

      2ac2c05f1edc54ddb553106491dc6640

      SHA1

      030bd62469a3350538227925ae4ca080232ad2c0

      SHA256

      28d394c2ca738e1ac63b40edc842645538158c4da7774de35d6ae8e8b5f3b0b0

      SHA512

      b7f824dc2731eb44dc1f9d511002f7a8b406ac3f24457e84043985bd97cfd5e40cd6a36ea2c4539698452bce43ee66283cfa04aac9a83935e5e5309612e7aafb

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\System.IO.Packaging.dll

      Filesize

      265KB

      MD5

      cc0eae8258801fe28701cce27be29ed1

      SHA1

      181188ccc3bc27153f5384d23423a5223859d7aa

      SHA256

      5f8baf1b0da3cce5ee3549040c1bc02441144fb6f5f18cf68cb9126e53181c00

      SHA512

      a7c5b6cadc5730a3d411b14e4f265ef8dc47cd09ba3375f9bd6461cf669f8c566cafb1a902cb3cec10c2fcdfd907eab1930455df97a408a4105092f33dca5424

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\System.Linq.dll

      Filesize

      410KB

      MD5

      d8bcdd5f9d02a2712cc1aa16d4d8fe68

      SHA1

      7d36bed3427c58c827eb6f7366d1d432486a42bc

      SHA256

      a0cc788ba708ac78a89418dc7582b034669525c347fb451f099073431b18fe9a

      SHA512

      0f16511f39eb75c3f6944b07fe4a84d84772cf2220ec822b44f3534eb4dce218fcf0d72a18bfdb29ba5f92dc71bb3dc8ee28ea7fa443bf90746f3d46028dde5a

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\System.Memory.dll

      Filesize

      175KB

      MD5

      519624c0128037c92d1cbb6340155a90

      SHA1

      a145b8d827a00c120e06e1f4cc6613932c53334b

      SHA256

      68c3cff0568ec4054233a353fc25166e8bbfd45d8c3a0ff1bb57a5f04a5d905d

      SHA512

      20a0a243f81ef7d8265d9fef225f440778164ab6a08bb14e1625ce495eff23b4b62cd066da624141781baf59088571f5709fb1e9289645b53217f9d22b408c75

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\System.Net.Http.dll

      Filesize

      1.4MB

      MD5

      101e6b1b23bd7e0ca09d1d6b2059a3a6

      SHA1

      c7e30d844cc281d9e0da618aa5383591efc3d740

      SHA256

      b1bc6d4804d61f69f65aae1fd2ce8488ea7ebf4e19c293bf57e66038939b93fb

      SHA512

      7300f3b2a081db9f991ce5c850aa443ccd32027b5b2822e9fa255a7e3c033d5cccee5fc9faa960c5b0255b910257b97151394e7f2e94f243586bb70d660ce33e

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\System.Net.Primitives.dll

      Filesize

      207KB

      MD5

      ddced8e28656c27719a5c3330326eaac

      SHA1

      dc47dc312621533cde2bf1db93c58c2260d32309

      SHA256

      a1dc30a6105ea9f92b2bf265692a8c08232ca162e426246d716a5d328d3f8ea4

      SHA512

      1f2fab6aef16b31d45306f9d210332616b30a7a96a3110b2d6d16246c1a794e010f93a8a59508e511bcbb1730984f8f50ab24052ec73d98da80e4503a22aa105

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\System.Net.Requests.dll

      Filesize

      338KB

      MD5

      ad28ee282ed5afe5d3b0b7190e2bac6b

      SHA1

      39f69ba5bbaa38a9d169f920235fadaf3f9a8957

      SHA256

      b47be22b22588b0d9c5ee5bbdc47c54b963be9d9c542e8415a1c96bbd7b4f6f1

      SHA512

      c19e6ee21ac710a9b2629a161bed3502b8278f99701fcb54195f82060e409f437d5e2f51fdbed94a3b7216daa0942fd9243a47da94b5044b5fa73d4fb42437c0

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\System.Net.WebClient.dll

      Filesize

      154KB

      MD5

      6931eef609357b7be803e245fb73b763

      SHA1

      08d094a2d633e92f56a25d431e510eef47dfd0eb

      SHA256

      6f7d0bc63b154720f4c4ec7f41d3b307f18bb8dcae6e0a2f020e754ab6bf530d

      SHA512

      e54e4de0716170a0216748ab1d85b8ddd12c55570420739c479b5268f246673b56c68e0f2acf8a4e3e5630f73d3a0247022e5c9993f807d62b51e4b8dc6bdc77

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\System.Net.WebHeaderCollection.dll

      Filesize

      64KB

      MD5

      838fc9a15b31019f1b9880f2b0ca33cb

      SHA1

      5a5c4fcf2dc8aa5b7fdff334ef0df685a3062ae8

      SHA256

      5c8a0e7d4246816100e79764253028a7f575741574e12a2448353d44cb621d93

      SHA512

      9a0b7ebcdeea2727b98557ef26e60b5826232e6a20e2846d31844db801f01aa7619c807cfca348d88989b92b2315897a1d5c3dde0e9733c4437b4d5d61caa6c7

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\System.ObjectModel.dll

      Filesize

      85KB

      MD5

      7a6ae43c41b0b718b5f4fa0a58a4c31c

      SHA1

      c80eebc77a37d8aefbe3357b182c1de350721396

      SHA256

      e0950a0f0d407a6bf362ac028a559fcd78f4856d1455cc7129e0962281b30e4e

      SHA512

      601b2c99ceb31056bc67d4c278eb90cc39bc0822152c778b2d04aa074064d9ab9f4834689d51f650c338f2066d01805ece2dd7a025f344890a57a70dbd3c738f

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\System.Private.CoreLib.dll

      Filesize

      9.1MB

      MD5

      09343c8e23f937e24c89ad5c5576cfbc

      SHA1

      d9b6ac07e3a567e4fef825704a98f02ad78e1dc8

      SHA256

      e711a28257871c6c068d43df074ef86d21743e19a68e2fff7be76f113dd0522f

      SHA512

      ede3576d6b8661b143077dea61709b5df2ed8934edf6f36bf2372a3ecdbb3512186aeeb60b5645342e38e0bcc644ee569c16301ab8e9ac982a1bb5cbe596449b

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\System.Private.Uri.dll

      Filesize

      236KB

      MD5

      d0498199e9c656d0506e41f074a2c124

      SHA1

      094fa4cc2e50eb2fbd697ba10e097d72e90f8f29

      SHA256

      336bf0dd1110f035e6073d41394ced18b269be83ebb4dbf7045bc49b0f3e7f3f

      SHA512

      427b90bf14ccc9746e875362ce0d82d43ee98fa910d9508634fd28589ad5594285c695b1db4a9863275ad774e6b7cdd856e4401e495f513cce87560303e020fb

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\System.Private.Xml.dll

      Filesize

      8.0MB

      MD5

      bb0c4bc37f26ed780b082abf1e8a8936

      SHA1

      2faef103994d02458cd5df7cc36901739bbdd394

      SHA256

      aa63a925c477b812adf379b6db400dae8196da2218b871947f301bac51f5652b

      SHA512

      6c052784fc82c59a257e632c569cae4d84684374db8a90a43455b2fe6ef1fc50c013a6995bbf2a8868bb21007c876b41faa8b8e49e370876b552876ea30f89a0

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\System.Resources.ResourceManager.dll

      Filesize

      14KB

      MD5

      89e4b283ae36e9a9f27d6319ffce1e88

      SHA1

      647576baca49feca9c4c4480ad4268ffb47fde75

      SHA256

      fae1f57caa5111492694548dd7b65281162637d413c03928fe121e96d7fce3bc

      SHA512

      49ed8071607da0fcd6909bac12333b11420462129fe71b9829b5f3ce55efb77554ef9e82ca623bc63c7a93d42d53237efefe456dc25878c936be4270101bd7da

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\System.Runtime.CompilerServices.VisualC.dll

      Filesize

      16KB

      MD5

      941882dda5d21e876123cb59cec07e2a

      SHA1

      8e87609b750f2d3b3f61f582daa7b3c646a18ea6

      SHA256

      229dfab9f356593d6e2d573738b871fc8b03e683c0b89418156f5552336cb922

      SHA512

      d57251900fdd82d194b5054e53c69c0d4faad4b20b9b399e6c55a81c675abd5a36208d30ceb84c1002fada0ebe72e1af5432ccb0301cd4b5ec57e5712e95ba43

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\System.Runtime.Extensions.dll

      Filesize

      201KB

      MD5

      83f436b58a0a677a72a0753c42cbd52e

      SHA1

      fd2a9ab8c2b0b2f1c35ec1c5a7ff406f9e9c81e8

      SHA256

      252db5499cd16176f88105edda27caad069586c884f3e88133a441aed5c03945

      SHA512

      c5f7936cb5b71a5eeaafde1c73887d176f126d00f0fb060cb8e558f9616bbd27403de401d283ce26edf8a9b41bbe5d05f5c1f0f6ce73514fa8712eadf75db5ca

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\System.Runtime.InteropServices.dll

      Filesize

      51KB

      MD5

      5a94491e34e74e240c2dc0b37532bd56

      SHA1

      ca267ac054e5ca6d52073f823156dbb8e1ec0228

      SHA256

      c38889854fd4e2acd37eb93e695915ba27e1f12e6b78cafcc62adceae003c73a

      SHA512

      ba6a88dc01e2eaacc41c8076e1306eaa65ff0053645cf6bbae5d9507f1edcd7a072afd8567dda178a6ca076a2807cd99eecb7d87f1545e3365f4877d24e93323

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\System.Runtime.dll

      Filesize

      51KB

      MD5

      0841dbdfe37698f8fc70b3386bd934b9

      SHA1

      cdc33462fab19f9682584d97f000a476daddff0f

      SHA256

      e6d9849662accd86fdb5ee3ec97394d85be75d7242f86c63f0357c9f34dc3233

      SHA512

      8cc174f61a9d5dbbd7fb0d0a5b7062b3a250bd418ddb0f4b5d83d5aa7679c23339f92d1dd884c63bd4f3eb0e5c3b107c5e221d23ac5325ffbce44eb1959b4959

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\System.Security.Cryptography.Algorithms.dll

      Filesize

      674KB

      MD5

      fef3c547f983ce31d005ca75f4f5bad0

      SHA1

      4b2755e4f21833e14b783f8f8bc48234feb5e23c

      SHA256

      758e5629c0b83867a9ce988caaf730f4a72be9c42371ddf9d31669171f60271e

      SHA512

      5c33111b1c02ef74bb8b396f4ca36e7d4fa1b09191cda9e27da1bd0a007c48eb02a1cce919be2610c6f5c29481cce94d807ee9f07dc0b45780f1d39bed88f78a

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\System.Security.Cryptography.Primitives.dll

      Filesize

      99KB

      MD5

      2f611133e3dc57ca21b3437536c2c14d

      SHA1

      529679cb645b07ef46f56a4d4ba0bc7c7b0b7a2b

      SHA256

      5e9e197752155837a9eead07bb5aac32bd2ca57f61b5ee7481c25ce7b5d5b9c9

      SHA512

      b2ea73bcd1061a7581876783af197000ce3786eeef9b9d6519426a82411083f319d4921735173d009098600109bd5447d36d06689282c45ab87d857132ad8329

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\System.Security.Principal.dll

      Filesize

      13KB

      MD5

      3aa7a2344cebcf6b73831a2a716e0415

      SHA1

      730fd796770504a05ac9be0047bd9f2dc195d124

      SHA256

      a7bb01ec91a28e408fafe48f5ab77f1736374b69117829b72602ea2d16283b27

      SHA512

      88cbf58141d889c4d009c5e2ae8ae1b99c240f474c20ec68a0b539bd180de89fc957e5c3d5beffaed7360d06a91c778f79fd208bcfa2b1a419fbaf2e374c3929

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\System.Text.Encoding.Extensions.dll

      Filesize

      13KB

      MD5

      10d2225268572985a274cf07172ae93c

      SHA1

      fe65e0a3802ff8f15372a9f9d7d1ddb099324255

      SHA256

      5902d6d32ff07b8ad27e63f5e7fc23fbcc7202ab4ad7969ac3437c16f66aa009

      SHA512

      bcf7d9e90a1cdad2fd7b92a1bc191303dcb87ac39081cbf4e07b8a68fc90717767f09a719667a906e7625a72d0d87b0a1af45ae60ec56bdd2052e72ebd19a0b2

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\System.Text.RegularExpressions.dll

      Filesize

      384KB

      MD5

      9b5556027ce54e72c513e82369c4bb92

      SHA1

      ec57b1b51fa70f8122603e586ae3d8a3a2c3c5f1

      SHA256

      ba85c3d705dc9abaa0205cf537ca3c651506812a335609cf38241d75113e35c7

      SHA512

      948943fdfcca31b531671ebbfefed3e6edd0467ecdc853d5cf311d58e23aa29900f2e131b7282cadff1fe56973162c16296221bb49205958d00b1a5261b894a2

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\System.Threading.Tasks.dll

      Filesize

      15KB

      MD5

      20a91362560ba1270ee5f8b0ed1809b7

      SHA1

      6f08eccfd36ae2665a17fc8d211c9c4351d14a7e

      SHA256

      2a48a7955a1da09d0cb3be3be7ef626f0b011e73d3deb38045e6afc76e6f4d51

      SHA512

      b1fcb7d465f05dfa02c80674837e4c30b255b940ceb0f79d6c3a2a093e888626d28b8c1532cdc92d53aa1bc23060e286033f3541bc562cec6abda8f6194f63c7

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\System.Threading.Thread.dll

      Filesize

      16KB

      MD5

      62d7be5ffeb9c78dbd597cecfc6e82e8

      SHA1

      d7cbcd14e44232a7a3259b4fa638884c4e7d6ac8

      SHA256

      810bf5b81ce53297fbfe4c00e7e655e95ba60c99f501ce78b54d24706306a2fb

      SHA512

      1147a8f7bf8ebe1b476f6b15904daeaf4a27779081b2800a49356c90b829c6b2d6c8507bc6bac313bd8b50f1fbdd1153db3605b3242c6236d5e9bf1e475ea273

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\System.Threading.ThreadPool.dll

      Filesize

      13KB

      MD5

      faa87eff1973ea2a927cdf9dfe4ebe99

      SHA1

      cc995dce8e51b97cfffc4b5faaedaee08bd3ce8b

      SHA256

      1cedf645233312078ad953fb80d77f0f2026804ee18f29bfd194d91df7e270aa

      SHA512

      99c197c712cfc6fd8058ce5a6e7a0f8a01289b92431cd99edd9701c900cafbba9f75d1c0cbb886ba77cfd4557ed8f02890f58725632372b8cdf019d58c8ba336

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\System.Threading.dll

      Filesize

      74KB

      MD5

      5921134580258015551d494a6cd2354f

      SHA1

      ddd477631a3bb3919b4179c6d110c97b62a49e94

      SHA256

      526e202077f89bd7848bf062eab98eff857ff73d9706b98f61753677ff4d5b73

      SHA512

      14a4220a53b915afd8874d307283d4e070fb71e1be3dbfc3d29160555c0f3321c21e8fbde85681001ffbfc9366b3c0efb4f1ad45f9e2276cfabeb96783e1ad88

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\System.Windows.Extensions.dll

      Filesize

      115KB

      MD5

      2ee752adf92dc52395eae713d4cd7d9b

      SHA1

      705a7e29224c2a23ee62388f68cbf1e9f29f0d13

      SHA256

      917f1d96045aa886a95e4a71de8d21fee266278ecc9d7fb6b1a5d6f77509495f

      SHA512

      98db8ea310ce2ab245812ae1d3de19ef878028ed17c9d72c27b90ff8f2220e4a3b7c9207878c3e6e031c75fb16d86ef11a321686db3200370a26ee7f9fc31ff8

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\System.Xaml.dll

      Filesize

      1.4MB

      MD5

      dd08d9164940adae5178d8e6f8d66dfc

      SHA1

      015329b7fe76f192b5f76fd193657e0c313d4f14

      SHA256

      09c72f97589c865cf6fc3f89a94927150d23c8e9d60e5e6b22ed50b4e3e909f4

      SHA512

      06a2a2f50de814b495b31bfe8797fe6a5023edcdac8ade497aca77e702b5152b006af91da88818333533fc58d7868018639614ec67df0b4daa58b8c157675295

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\System.Xml.ReaderWriter.dll

      Filesize

      20KB

      MD5

      61d505eed92d117005e52aaf922e1bc4

      SHA1

      6401767fe252abdf5ccbc790a01ef1cee070e5f4

      SHA256

      a2523957271a46c98dc3003f1735d813f36fbd555283ab4ad3447d8bbe35704e

      SHA512

      f5eeadb49e68532ead019de2be12ee3bde3c1ebf8b08c44fe0d130eb11b13dc8e3d472be752954325494bd9f17a54704c369691062137b4ea95bedda732edf0d

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\UIAutomationProvider.dll

      Filesize

      47KB

      MD5

      a9d04fa47eb45e2a040a9864096017d3

      SHA1

      b3a045ec7d3d96b2a4080e03d99fcbf4fdd53f32

      SHA256

      a39b9d6e6d501ea9ad87ecd010fba7cfdd43a750373a7e3382b11db96b5c49ae

      SHA512

      1705e3bc2e070ffffec24e55181c95c9f393524f749a9b4a67cc5116ceafec6c595dd6386863220f3c9da764194e747235de84f74173457d99106233198baeb6

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\UIAutomationTypes.dll

      Filesize

      271KB

      MD5

      87d584d16e51825b2a8341dfb57d0d9c

      SHA1

      86fdf94c85401aec3e6c148381696f03cbea5306

      SHA256

      ed25d6af70b9a2586187989e9bd2b210daead06f26f933e8cfba195c4b3b55c5

      SHA512

      c515ede303b73ae6d52732f2ffc1bb3c97a3cc3b7065061472c49ee97368bb6501e2e969c54ed3c8cb635c0ec30970ea44dae12ddcc773b03baab773256f09ff

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\WindowsBase.dll

      Filesize

      2.1MB

      MD5

      bea1d749938d813ae01f250e538a3a26

      SHA1

      c6d7f922973d9a6225ae89f20e8972915f157436

      SHA256

      aedbdad4be106f451354b7015c228e6547711e84469c6fe1798471bd2f856724

      SHA512

      7b0f9840d37e932e9a703220d04b09de95c5d72dea06d367a295513e79f7b9a9e5a29db43d16ede9302a0d57b10fd3dd2f7ed1286abf9ec3524e29aeaf305eb9

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\clrjit.dll

      Filesize

      1.2MB

      MD5

      1a4f980d499424d3b723af341095a2dc

      SHA1

      a3cce33dbeebd81f39db625331ccd92d20473478

      SHA256

      632bd21c22d61904bbac74a27f3132895a077a85a756e502e66ed3f013864fef

      SHA512

      f9235aae336fa0b8e5f9fdd1d9b0cb7d3bec865f40679506b76d849c868656612c1360c19d6eb2de185ce3c8fe43d61ac40231a435fd118f5e25e822630a6066

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\coreclr.dll

      Filesize

      5.3MB

      MD5

      1c62eb07f445236b1c078394007ce03e

      SHA1

      9a04d3ad570c911eec0f4a778edf8fa9cbcb1750

      SHA256

      17bea398a2fdc120f12078020bff4cbac6c845c0bab91f181eca7ea503b36033

      SHA512

      f9507f1aa04f953a8cebcc79ff0a1a0ea46fd991757ce2af650c5fc64eb61a9a43baaa640cf549e267ece56df04b578d7cbe8bb50e74f91b4e3e3d0271707429

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\hostfxr.dll

      Filesize

      585KB

      MD5

      d42b7092073fc28fe40b51f63c037f11

      SHA1

      7e1c0a1a6b04447cfea1706dbf85725907b4a254

      SHA256

      1d7dacb241ffb95e58664d8c8398090916d637a51f24993bdb9631068b1cacf2

      SHA512

      05afa344b0a205f30a757611a9942fe67d1f2dd5e8709b22a39bf3adc6e02579857a8958f116aff9a4d6cc27b1bcf538d95e5d31e038a30dd6f12c69a5074667

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\hostpolicy.dll

      Filesize

      576KB

      MD5

      c6894470fa8b8eed997560b116cef261

      SHA1

      3f7f9e45790785db60ac927fb57e03582d6bf0a8

      SHA256

      526028c8d57182caadeb569ab6c3b8a8d190635ebd9f6322124c4d9df59e3459

      SHA512

      d078d5aecbd904c9f868adce0c0325a750a1212da9d5a64ea1cc1d4f7b778a13aaacdfb32521aea34e2930ddda064e301e3a939e821fa745df90bbc3ade1e281

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\netstandard.dll

      Filesize

      111KB

      MD5

      d02ea5bad562d2ce716ff5b4b0ef913e

      SHA1

      6dc4e9280c430fbfd238c2bbc3b60f968568e34f

      SHA256

      e6d7b06016a1542c58ebf8d5e36862a5b76909eca29983b660eda03fb3449e9b

      SHA512

      4cfa526e7e474b3af04fdf2f57fb6478f76d760e8d532a49152e028705a0e83540a7379d207247aeb777a06046c4dc7d907d8826bedc43a59606dd6bb6187981

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\updater.dll

      Filesize

      1.2MB

      MD5

      0cca88382b75312cd0fab201945082f7

      SHA1

      8d80090d7736408bbc486fb2c1e376569af5250b

      SHA256

      5f9336a5f902184137e3bec7f43a457b5a03b42111bfff2d3fbc91d123bd77a7

      SHA512

      e02bd1f714c17b40152a30b9ad30671bf5c426add7e4c30cd948c6f4d823f2c84efbdbb86682a8198aa4895b4604d35338556cff546a39cf3b2f65917e3dcc62

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\updater.dll

      Filesize

      1.2MB

      MD5

      0cca88382b75312cd0fab201945082f7

      SHA1

      8d80090d7736408bbc486fb2c1e376569af5250b

      SHA256

      5f9336a5f902184137e3bec7f43a457b5a03b42111bfff2d3fbc91d123bd77a7

      SHA512

      e02bd1f714c17b40152a30b9ad30671bf5c426add7e4c30cd948c6f4d823f2c84efbdbb86682a8198aa4895b4604d35338556cff546a39cf3b2f65917e3dcc62

    • C:\Users\Admin\AppData\Local\Temp\.net\updater\mjz23ojz.emg\wpfgfx_cor3.dll

      Filesize

      1.9MB

      MD5

      29848589a645492fd96b13fb07d0e62d

      SHA1

      9b33d9af75f9eabc2325f86ac9769aecf88e00e0

      SHA256

      f34e038295b727e6150cef6d66eddbcd1c7852ea37075a4578e93a3d78ef494c

      SHA512

      f0439b9fe3c03de42f173229df74da687f6cb216a6230e5eea06757119bbef7e5bb3dd16fed0804cac04bbfcd0254fb54014547d9b2cb2fe9d66167b47081646

    • memory/912-660-0x0000000007010000-0x00000000075B4000-memory.dmp

      Filesize

      5.6MB

    • memory/912-673-0x0000000077660000-0x0000000077750000-memory.dmp

      Filesize

      960KB

    • memory/912-676-0x0000000006A50000-0x0000000006A60000-memory.dmp

      Filesize

      64KB

    • memory/912-645-0x00000000001C0000-0x00000000020C0000-memory.dmp

      Filesize

      31.0MB

    • memory/912-646-0x0000000077660000-0x0000000077750000-memory.dmp

      Filesize

      960KB

    • memory/912-647-0x0000000077660000-0x0000000077750000-memory.dmp

      Filesize

      960KB

    • memory/912-648-0x0000000077660000-0x0000000077750000-memory.dmp

      Filesize

      960KB

    • memory/912-649-0x0000000077660000-0x0000000077750000-memory.dmp

      Filesize

      960KB

    • memory/912-650-0x0000000077660000-0x0000000077750000-memory.dmp

      Filesize

      960KB

    • memory/912-651-0x0000000077660000-0x0000000077750000-memory.dmp

      Filesize

      960KB

    • memory/912-652-0x0000000077D94000-0x0000000077D96000-memory.dmp

      Filesize

      8KB

    • memory/912-661-0x0000000006B40000-0x0000000006BD2000-memory.dmp

      Filesize

      584KB

    • memory/912-674-0x0000000077660000-0x0000000077750000-memory.dmp

      Filesize

      960KB

    • memory/912-659-0x00000000001C0000-0x00000000020C0000-memory.dmp

      Filesize

      31.0MB

    • memory/912-658-0x00000000001C0000-0x00000000020C0000-memory.dmp

      Filesize

      31.0MB

    • memory/912-662-0x00000000075C0000-0x0000000007996000-memory.dmp

      Filesize

      3.8MB

    • memory/912-663-0x0000000006E90000-0x0000000006E9A000-memory.dmp

      Filesize

      40KB

    • memory/912-665-0x0000000006A50000-0x0000000006A60000-memory.dmp

      Filesize

      64KB

    • memory/912-666-0x00000000001C0000-0x00000000020C0000-memory.dmp

      Filesize

      31.0MB

    • memory/912-667-0x0000000019BC0000-0x0000000019C5C000-memory.dmp

      Filesize

      624KB

    • memory/912-668-0x0000000077660000-0x0000000077750000-memory.dmp

      Filesize

      960KB

    • memory/912-670-0x0000000077660000-0x0000000077750000-memory.dmp

      Filesize

      960KB

    • memory/912-671-0x0000000077660000-0x0000000077750000-memory.dmp

      Filesize

      960KB

    • memory/912-672-0x0000000077660000-0x0000000077750000-memory.dmp

      Filesize

      960KB

    • memory/2844-606-0x000002A457100000-0x000002A457110000-memory.dmp

      Filesize

      64KB

    • memory/2844-499-0x00007FFA02B10000-0x00007FFA0307F000-memory.dmp

      Filesize

      5.4MB

    • memory/2844-644-0x00007FFA02B10000-0x00007FFA0307F000-memory.dmp

      Filesize

      5.4MB