Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    31s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/02/2024, 08:25

General

  • Target

    3447abb6f79dd3586dc2061d74f6349e.exe

  • Size

    216KB

  • MD5

    3447abb6f79dd3586dc2061d74f6349e

  • SHA1

    ec4044da2d08062cd7106652f0775081027d1328

  • SHA256

    fe7d9554cc3d372a10d8b402d1860101c23b02d056117c72dbdd63af3b6963d1

  • SHA512

    b5644239474430dcc97432ce110904f45e831af5aad02e9ba452e1c3cce9eb72f6019d3821d6651364fbb04bed0624cb4af75cedefd1461f404e067711a93191

  • SSDEEP

    3072:SLAVkKKz6bqDSyfpTzTBfK2baJ8D2tFXjWlt6nEZDvMCkgMXEfpF:SL12QfxxK2WaDGWlt60vagMXI

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://selebration17io.io/index.php

http://vacantion18ffeu.cc/index.php

http://valarioulinity1.net/index.php

http://buriatiarutuhuob.net/index.php

http://cassiosssionunu.me/index.php

http://sulugilioiu19.net/index.php

http://goodfooggooftool.net/index.php

http://sjyey.com/tmp/index.php

http://babonwo.ru/tmp/index.php

http://mth.com.ua/tmp/index.php

http://piratia.pw/tmp/index.php

http://go-piratia.ru/tmp/index.php

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

stealc

C2

http://185.172.128.79

Attributes
  • url_path

    /3886d2276f6914c4.php

rc4.plain

Extracted

Family

smokeloader

Botnet

pub1

Signatures

  • Detect Socks5Systemz Payload 1 IoCs
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 3 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

  • Stealc

    Stealc is an infostealer written in C++.

  • Downloads MZ/PE file
  • Deletes itself 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 5 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\3447abb6f79dd3586dc2061d74f6349e.exe
    "C:\Users\Admin\AppData\Local\Temp\3447abb6f79dd3586dc2061d74f6349e.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:872
  • C:\Users\Admin\AppData\Local\Temp\97CB.exe
    C:\Users\Admin\AppData\Local\Temp\97CB.exe
    1⤵
    • Executes dropped EXE
    PID:3408
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 1104
      2⤵
      • Program crash
      PID:4588
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 1088
      2⤵
      • Program crash
      PID:2784
  • C:\Users\Admin\AppData\Local\Temp\9BE3.exe
    C:\Users\Admin\AppData\Local\Temp\9BE3.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1644
    • C:\Users\Admin\AppData\Local\Temp\9BE3.exe
      C:\Users\Admin\AppData\Local\Temp\9BE3.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:4804
  • C:\Users\Admin\AppData\Local\Temp\9D7A.exe
    C:\Users\Admin\AppData\Local\Temp\9D7A.exe
    1⤵
    • Executes dropped EXE
    • Writes to the Master Boot Record (MBR)
    PID:2472
  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\A23E.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3536
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\A23E.dll
      2⤵
      • Loads dropped DLL
      PID:4440
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3408 -ip 3408
    1⤵
      PID:2552
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3408 -ip 3408
      1⤵
        PID:4288
      • C:\Users\Admin\AppData\Local\Temp\C008.exe
        C:\Users\Admin\AppData\Local\Temp\C008.exe
        1⤵
          PID:5092
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 1064
            2⤵
            • Program crash
            PID:3972
        • C:\Users\Admin\AppData\Local\Temp\CCCB.exe
          C:\Users\Admin\AppData\Local\Temp\CCCB.exe
          1⤵
            PID:3060
            • C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe
              "C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe"
              2⤵
                PID:1776
                • C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
                  C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
                  3⤵
                    PID:64
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
                      4⤵
                        PID:3928
                        • C:\Windows\SysWOW64\chcp.com
                          chcp 1251
                          5⤵
                            PID:1880
                          • C:\Windows\SysWOW64\schtasks.exe
                            schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
                            5⤵
                            • Creates scheduled task(s)
                            PID:3748
                      • C:\Users\Admin\AppData\Local\Temp\nslE1B7.tmp
                        C:\Users\Admin\AppData\Local\Temp\nslE1B7.tmp
                        3⤵
                          PID:1000
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\nslE1B7.tmp" & del "C:\ProgramData\*.dll"" & exit
                            4⤵
                              PID:1404
                              • C:\Windows\SysWOW64\timeout.exe
                                timeout /t 5
                                5⤵
                                • Delays execution with timeout.exe
                                PID:412
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -u -p 1000 -s 2376
                              4⤵
                              • Program crash
                              PID:3940
                        • C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
                          "C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
                          2⤵
                            PID:1212
                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                              powershell -nologo -noprofile
                              3⤵
                                PID:1068
                              • C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
                                "C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
                                3⤵
                                  PID:2860
                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                    powershell -nologo -noprofile
                                    4⤵
                                      PID:3896
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 1212 -s 788
                                    3⤵
                                    • Program crash
                                    PID:1420
                              • C:\Users\Admin\AppData\Local\Temp\D5A5.exe
                                C:\Users\Admin\AppData\Local\Temp\D5A5.exe
                                1⤵
                                  PID:1584
                                  • C:\Users\Admin\AppData\Local\Temp\is-DT0UB.tmp\D5A5.tmp
                                    "C:\Users\Admin\AppData\Local\Temp\is-DT0UB.tmp\D5A5.tmp" /SL5="$C01F8,7349384,54272,C:\Users\Admin\AppData\Local\Temp\D5A5.exe"
                                    2⤵
                                      PID:636
                                      • C:\Users\Admin\AppData\Local\Key Signatures verification\ksverify.exe
                                        "C:\Users\Admin\AppData\Local\Key Signatures verification\ksverify.exe" -i
                                        3⤵
                                          PID:968
                                        • C:\Users\Admin\AppData\Local\Key Signatures verification\ksverify.exe
                                          "C:\Users\Admin\AppData\Local\Key Signatures verification\ksverify.exe" -s
                                          3⤵
                                            PID:4712
                                      • C:\Users\Admin\AppData\Local\Temp\F033.exe
                                        C:\Users\Admin\AppData\Local\Temp\F033.exe
                                        1⤵
                                          PID:2624
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5092 -ip 5092
                                          1⤵
                                            PID:2184
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1000 -ip 1000
                                            1⤵
                                              PID:4260
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1212 -ip 1212
                                              1⤵
                                                PID:2744

                                              Network

                                              MITRE ATT&CK Enterprise v15

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              • C:\ProgramData\Are.docx

                                                Filesize

                                                11KB

                                                MD5

                                                a33e5b189842c5867f46566bdbf7a095

                                                SHA1

                                                e1c06359f6a76da90d19e8fd95e79c832edb3196

                                                SHA256

                                                5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

                                                SHA512

                                                f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

                                              • C:\ProgramData\DeliveryStatusFields_65\DeliveryStatusFields_65.exe

                                                Filesize

                                                174KB

                                                MD5

                                                dd74b545e44e8af8e58366c01e1ee2df

                                                SHA1

                                                dade5beb5e7924a23d46759bf8c988eb0d72ad80

                                                SHA256

                                                4da99125175ccd2a75caf7653f4ad1a9daae947ff833341a6319928db4d5162e

                                                SHA512

                                                a88c9ea12378b5cddbce05c313d5ed1bd32ad7391bdba947a48778d1e050bb73b005bfd75e62ab37cc3dd3fc560264e28ebd5c15022ffb205be24b42d84be6f2

                                              • C:\ProgramData\mozglue.dll

                                                Filesize

                                                57KB

                                                MD5

                                                4d10baa547aa800a2d649ec99f51655c

                                                SHA1

                                                0b9f434dc0651470a3fc0e31b8b35e648b6e5455

                                                SHA256

                                                972ba258826d2f518b0a854fd2010da88980bf5971288decc866cb55e9ee5874

                                                SHA512

                                                d59aa98cadd93cbd031eb15816728c5568e22fe319c4f3e55a629254b3798a9ae8b2d1da1adad0efdb13b516781050f80d8bccdba07179faf61d709cab4e594b

                                              • C:\ProgramData\mozglue.dll

                                                Filesize

                                                108KB

                                                MD5

                                                aa9b7f4a7a9c4245f5ed978ad255e542

                                                SHA1

                                                98d1ce7f27f57bce314e5df008632df8f1b29f02

                                                SHA256

                                                1b3457d3b8a7a5f971ec623b06ea71b63b9035f4938f13e606e14e00895fb597

                                                SHA512

                                                ac3b41e461e12323172a815dfa59645f89c6db741834fc802b428348e65e0b1825712382d50a97e00df47af3f0e2c1f5d9cb436c13d675d82fa5480ee9702b12

                                              • C:\ProgramData\nss3.dll

                                                Filesize

                                                49KB

                                                MD5

                                                af0dd962c2b1874e4e31bc87a9baea8c

                                                SHA1

                                                6dc4b4eca1a6d3c779f3190f0ef3a35362dcb215

                                                SHA256

                                                68e2d706e79d39c534602fc179244b301f0421d66a1cbe04f32c6468a651f66c

                                                SHA512

                                                3319aded8388fafc1288c02e6ae4b6b782f73034c9e45fa196f761c3ddc559380d5bdabc67d7eb31a15ecedd9f2bed4050b0ef0bd5aa69e28317a34730674f7c

                                              • C:\Users\Admin\AppData\Local\Key Signatures verification\ksverify.exe

                                                Filesize

                                                38KB

                                                MD5

                                                a96957b56df42c4dbd09b75c7faf908e

                                                SHA1

                                                9262db40f1fea0277f1a3a33f7ca08d417e35167

                                                SHA256

                                                3daf5f68047458eaf6e3ad513aab6aa5cafaf1f399a11839462a426e9f4ef73a

                                                SHA512

                                                315264e6823f3493c953687ff21e34b204a15dbb9e9d893c28b785e73912de023383224deb6f96a2899735080aac058ae0fe354035a0adfa29fe411e8a365e1a

                                              • C:\Users\Admin\AppData\Local\Key Signatures verification\ksverify.exe

                                                Filesize

                                                333KB

                                                MD5

                                                9346b9d5474d84a7ddca2822e6fc683f

                                                SHA1

                                                d61b9afbbd35ab3c018b1e12c5820f2550980741

                                                SHA256

                                                9d379d9a8d2c3623894f6d6793b0e9c28a1e04003bb16d7348f9c1b480c49364

                                                SHA512

                                                8466c21cad4ff376211e0d5fc7ec5946e3da1f67b9cf2f038a6ef0817568cedecef1639d4f259d5240573f799b938edaf3d85a5d70f33afd95e3f703f5dbdc07

                                              • C:\Users\Admin\AppData\Local\Key Signatures verification\ksverify.exe

                                                Filesize

                                                122KB

                                                MD5

                                                5f63317f6c4bef21d748ef16c34bf84e

                                                SHA1

                                                2fc4367503db7d8529213a2f2678301a8468eab2

                                                SHA256

                                                5c90508b33cf92b55773a9d89eea2a5b0885813480e342848e3b0329fa5c7fdc

                                                SHA512

                                                d20d1e7d34315ed17792c51159c41bcbd9afd04692e323b5483912c908396a7f411d6b6a296c945d9de57c31ff9bde9d4798a29accd75913ff5bba46659717eb

                                              • C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

                                                Filesize

                                                133KB

                                                MD5

                                                fe0fd2d82218bc180c2287bf570184db

                                                SHA1

                                                fb6bd930fd4bb1384e7f3c0cf5814e0c7c36d1bf

                                                SHA256

                                                128f71e2cb0b5ee70f586d1f6b108f02befd93ae4822cc3670332df340d26a0b

                                                SHA512

                                                2d6a79fc7d1892d55d9ee2f5d5a30237aebbde61e922f6d17ce236984104a563655416954197fa2e34ae63cfeb8c500c988aaa148892ded0f6b56fc430d66620

                                              • C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

                                                Filesize

                                                128KB

                                                MD5

                                                a8987754533409666e6c12fe2b8b0cfc

                                                SHA1

                                                75f6c019a09b442e961d933db4e52b3bb8c4a34e

                                                SHA256

                                                394132410be47e74b9d11a3c1073700ae4fb8ca7b7504e2591099743464f4aa2

                                                SHA512

                                                00299d2bbb4cfa83e8e2eaff5e77691b2aa6e95e39004f8a1288bb1dd136d2633c69656f12aad9e8f56fd40cb959cb04e28ce4a57b7ad003aa5fdadf8e77e8bd

                                              • C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

                                                Filesize

                                                252KB

                                                MD5

                                                e2962664526119d0198a3675342e2869

                                                SHA1

                                                910e3110699edd44aeb6261e7505c82426a7cd73

                                                SHA256

                                                a19b6a6f375e99c6d2363cd0db88d34f0d453ab122dae02752b9df1c262f2479

                                                SHA512

                                                ed039f2b45cb417b364ae7f5573351a3be073d1ea13799c631e191699a3027e2f9a6649ddfc35f7108007c4f97b7dc550308e32fd49f849e60e6826273c7bc78

                                              • C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

                                                Filesize

                                                32KB

                                                MD5

                                                08a6fe34218c252ad527a8f8d5906271

                                                SHA1

                                                a5d9ae782fd7aeb16477e15a77bb28e74eec9acc

                                                SHA256

                                                ed4495fa11bd55371857fcad111b2471dd1069098df9bb589c2ec29fb6bf2af1

                                                SHA512

                                                b827d995032d07786a6096c8208fc6081b146bd739b0e3dd4e9196cafba934a61d5dd18138a0d55ad235058009d51150b74bc21ca44989201ab086f5111a9bfb

                                              • C:\Users\Admin\AppData\Local\Temp\97CB.exe

                                                Filesize

                                                664KB

                                                MD5

                                                dd0a3ebcd915e422f47141770af20252

                                                SHA1

                                                16343e4da2dcc27729e4ffb8dd03f7fac379cda9

                                                SHA256

                                                c5028cdb9a2633a84fc9311176e8250b49d280235e9a370b492b582b43df41c7

                                                SHA512

                                                9f449d1a0d0b524de62056f98104dc57f16483533f112ca787742b71bfb6f7df01ae1a3ae020bb541ecf0d903b290ad75c93eb188aef6575dcdbbfc92079b067

                                              • C:\Users\Admin\AppData\Local\Temp\9BE3.exe

                                                Filesize

                                                1.8MB

                                                MD5

                                                1274287f7daa409eea3e07059cf8fd51

                                                SHA1

                                                a1df35b30ccd295c319f5e3778f8bf0dedc996f6

                                                SHA256

                                                eab7f930dc57aba040449bf4a2a9e2481873aa897a2305d7be3c3e36765e2843

                                                SHA512

                                                136da364c7733f6243eebd74ca914714e65b60aca86a5c96a4751803d40e5c729bd032bdc879f880a083501a544213a5bce6920057aeb3742b19d7562f0e479e

                                              • C:\Users\Admin\AppData\Local\Temp\9BE3.exe

                                                Filesize

                                                509KB

                                                MD5

                                                5ec880b7d643b0cd07eed638e9bce503

                                                SHA1

                                                074dedf86aee6e78603c77db3dec9abf9f30114d

                                                SHA256

                                                62cc0af2a4643b414e2fefa293d7c984f6849756b6f84f207cda15d3c35ff46c

                                                SHA512

                                                ce4240c9c3e62d5dfe2f4d995a723ee2abf8d04f9cdd117cfdea64b1b3a38c6f4a5411a0e3493ada04bc3b7266de4bab14feb0ab020d706eb0129439f19fe7ee

                                              • C:\Users\Admin\AppData\Local\Temp\9D7A.exe

                                                Filesize

                                                421KB

                                                MD5

                                                1996a23c7c764a77ccacf5808fec23b0

                                                SHA1

                                                5a7141b167056bf8f01c067ebe12ed4ccc608dc7

                                                SHA256

                                                e40c8e14e8cb8a0667026a35e6e281c7a8a02bdf7bc39b53cfe0605e29372888

                                                SHA512

                                                430c8b43c2cbb937d2528fa79c754be1a1b80c95c45c49dba323e3fe6097a7505fc437ddafab54b21d00fba9300b5fa36555535a6fa2eb656b5aa45ccf942e23

                                              • C:\Users\Admin\AppData\Local\Temp\A23E.dll

                                                Filesize

                                                138KB

                                                MD5

                                                a2abb39ed39025841062508867156570

                                                SHA1

                                                8792ec7cb6692dd875c09cb50dbc9cfeed2876fb

                                                SHA256

                                                4e6dc610bdb36553b1d78a015d86fdf0db7580f92d7c9c090a792f8a91de568e

                                                SHA512

                                                0c24db7de43bdbbf85f20f7bcf27700c68802926ab91a616be0cf74caef2bc834c7399d2c7542f57f3e762800697669928002b54f00cff51dace3ae350640978

                                              • C:\Users\Admin\AppData\Local\Temp\A23E.dll

                                                Filesize

                                                57KB

                                                MD5

                                                596f227876d757a1ffe7c22a9b37fc7a

                                                SHA1

                                                965581699060570ae8fbf744a677873df1782d2d

                                                SHA256

                                                91f17ee72dc60fed824d36c6fa89598f7bb25565dcb78c8ff00519b60d6069b5

                                                SHA512

                                                655e4f4639be1d27e9386e3b3b2e8ab05bb860222c1ccb7035938c3aef4fc468d348137783d16d16d5dd946f7cbc190e5b5552e67f8285cd20f107fa92d676ea

                                              • C:\Users\Admin\AppData\Local\Temp\A23E.dll

                                                Filesize

                                                708KB

                                                MD5

                                                734bb1de2d2a720499f388efc79ec041

                                                SHA1

                                                8c67a1ad3a8fce79b886007d60e13af08d0e1d28

                                                SHA256

                                                6f499747aac31734669fdc952432c62957e8f1a091be67d99814427103328e07

                                                SHA512

                                                b488852ec46380c1cb851b2bfa635926f62094f3c1b341cac42b3860f76230047b245a54c10c2ecbaaaf020e3fb10dc0c28ed92dbd79d6283ad496eba7947df9

                                              • C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe

                                                Filesize

                                                302KB

                                                MD5

                                                c17c44a89f41af17fec6dd6fea6722fe

                                                SHA1

                                                a82e46fca7d178eb4f3d13f1676b7a9678cd47ea

                                                SHA256

                                                3d5eab5738a21fc2755eda79a95f992705cc07f9a7ac4b0e254fdbdab3475cfb

                                                SHA512

                                                e3e0b0c01cfa9db6a8ba850a9976b2c9390a80e885f0020f4c3c3dfdb3c0bc657a02633e4f1faef750e249a61ad1a27105e757780bb7790b79095bc98a5cfe14

                                              • C:\Users\Admin\AppData\Local\Temp\C008.exe

                                                Filesize

                                                585KB

                                                MD5

                                                19bf43b16d320d99bc28b8dbfb5ead16

                                                SHA1

                                                86c1b94a68f1f9a3b5c4d08a380000436311a49d

                                                SHA256

                                                09b72d1e17360a93541b44875491ef50d1a79063363930f61505faad2bfc5b6b

                                                SHA512

                                                f1a9dbba265322aad8595db1d6f1cd5c9c9f910d8dac6dd2a0a4c231481c341278fe18cabc715e6136ad89742048985c9eb83b040c221abc93684e58d23c2c50

                                              • C:\Users\Admin\AppData\Local\Temp\C008.exe

                                                Filesize

                                                561KB

                                                MD5

                                                03b5900715fadf1f564190f7d19a68eb

                                                SHA1

                                                4482d5deb78e9f2676594fb20afa83c8f9eabe13

                                                SHA256

                                                f279f95f3c569b496718b463118a8749b240e338c526857c1dfe2b7ba97a3464

                                                SHA512

                                                70ee13e0f83564343987dc37eecf59d5ecb9755ee1717834009f140a5d356942bf1545908f86d75b6ce784ba38d07070096062266fdda4d494047f22e01c881a

                                              • C:\Users\Admin\AppData\Local\Temp\CCCB.exe

                                                Filesize

                                                203KB

                                                MD5

                                                5881bf4de83bf8e12f024c8162f76233

                                                SHA1

                                                4be9bed5639dfdf458062cf3334ea510981bfaf2

                                                SHA256

                                                060b63e6433a3ffe70432835a5ac4ecfa029996b3f25289d76ae4596610f56f4

                                                SHA512

                                                bfffdeb725f58c6c000b4e40c19ff752b1ffbf35efedf9f81879155eca8826c4346b61e71d3051843581410e04b8b64e1cfb957a0750986c90c5bd497680cd76

                                              • C:\Users\Admin\AppData\Local\Temp\CCCB.exe

                                                Filesize

                                                200KB

                                                MD5

                                                b7c96f7f97b3769d6d49c846fca02495

                                                SHA1

                                                09d5b2bcd80e4bb841bbc00511749f9e43425854

                                                SHA256

                                                6076fd9f5172e7848846caa9287a76f8937491fba417e2e500ccd4ea57902c29

                                                SHA512

                                                c0124858a67ebab5da23f782fb36cbf48b3dbdb1d08d3614550734012c7916357fede0736927cbafb950a514edfe4d4132e11c1a63045dce3ba03c241ddc50a6

                                              • C:\Users\Admin\AppData\Local\Temp\D5A5.exe

                                                Filesize

                                                330KB

                                                MD5

                                                4cc62edb09a890eb85a1f0211aca9d3e

                                                SHA1

                                                91a7954d7c9ecbe775cec8b454d7af8a67eb92e2

                                                SHA256

                                                d090f82161f18616aec757f093fde3e61434a419e06857b39c7e9b7ba492c28b

                                                SHA512

                                                befa43e9d0c4616f69bba03f27f0ee3a1015c8a2e17abd86de4040ebb4b2405a77a3818b0dcfc24cea08e39c1dc6081dfa20a7e76d94c52eb3295bc29ee144a5

                                              • C:\Users\Admin\AppData\Local\Temp\D5A5.exe

                                                Filesize

                                                84KB

                                                MD5

                                                df01b655028e7928f2bbc5e0d848c881

                                                SHA1

                                                05e16b382f28db7898a484244359bf3e9d149422

                                                SHA256

                                                6bac58797642fdc21cefb2456699e8b42d47c55cf47013f54a82ba3d852b951b

                                                SHA512

                                                5c84c46ef6ea40c55087dd8f48a11d0e88043d8ac288374b84c48080d8e7b5e40e0e5783507804e53122a454a751dd87a391b5f474de8eced09083977964459a

                                              • C:\Users\Admin\AppData\Local\Temp\F033.exe

                                                Filesize

                                                188KB

                                                MD5

                                                31a6c56da13533f4addef7bab188e395

                                                SHA1

                                                faaa36754ae4b8b04e89e6928338eb137a327a73

                                                SHA256

                                                a2d67daea33a52de3b121b43ebf8d2c8f5f5e1ef897bc1c7cfaaa9591a9d4172

                                                SHA512

                                                ae939cfdfee3568d4fdd848e6f026c2a09fb45aad5885247e80323411b33df46b28e78506dd322b2379915f1c2b61ef7e2c6c25166f93b5581a8c5bbb76caa73

                                              • C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe

                                                Filesize

                                                128KB

                                                MD5

                                                7cc17ec34f267d074ac8cb530f1bd50c

                                                SHA1

                                                3102b5ac561dcd5ae2b385b83077b54fb9068cf5

                                                SHA256

                                                dac7ffd01ddff7716370493c4fe3c258f8e366550f408b458633c0c6dc0b98f9

                                                SHA512

                                                2193ba0238ec172049052358d524077a25b823b90bb223d245838f2627a07bf2b4cd71fbaee386d4968207d31166736ed2967417fbb7fa00d49e6da26fa1b35a

                                              • C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe

                                                Filesize

                                                112KB

                                                MD5

                                                4109b18bba291c1e6938d57b8d02e73b

                                                SHA1

                                                9054095e40d58cf5d5c7f45ce112c957424e45fe

                                                SHA256

                                                4626d128dff5fa3b79c1c627bc349c1bd193aee14dd3888a8d4c23e62fd4cdb8

                                                SHA512

                                                ba37ef5756e1b879aa634362fd8accc29bdaa5431111438d59c8b7be80659160746749c2410dec4e85dce48f60fa934129744048f87e9f0ba5ea4531fb4b9775

                                              • C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe

                                                Filesize

                                                5KB

                                                MD5

                                                2f4e27e3f53e54c5f026dd3443d3b25b

                                                SHA1

                                                61ee9d5fd0911cb2181be495d1dc69f219c0e72f

                                                SHA256

                                                cd58befe2735f0b225de3b8f689b60a81e40ff5ccbebb0524ab2f63d49bfb148

                                                SHA512

                                                68f4172d7d0eb7e4ff160a43cd3d039c42d480228e8152001f9997ae08770872c9c30624c54297d11d9de7081af05e8f339a917a54087bf586ae1e08ef8cf0b0

                                              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iymnpxs4.0kv.ps1

                                                Filesize

                                                60B

                                                MD5

                                                d17fe0a3f47be24a6453e9ef58c94641

                                                SHA1

                                                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                SHA256

                                                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                SHA512

                                                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                              • C:\Users\Admin\AppData\Local\Temp\is-DT0UB.tmp\D5A5.tmp

                                                Filesize

                                                161KB

                                                MD5

                                                04c8e0790d007d9516692deba066979d

                                                SHA1

                                                1b9fef00c67ee579443d342b1a3666dfb7e1633e

                                                SHA256

                                                041c4131a6bf0447b9a6e257fd68a0d1fe51de07ca9525ea92e9f66995304f6b

                                                SHA512

                                                9df994ffd1c5b5c721697f3563ee6da0163c284b546bc9881ac6397d06111f151dba338dd24a6dc542f88b03c1cf8c0b274539ebafe50f9f14808c9076f24674

                                              • C:\Users\Admin\AppData\Local\Temp\is-DT0UB.tmp\D5A5.tmp

                                                Filesize

                                                77KB

                                                MD5

                                                c8d8d7d8022af4308d4cd97c3d101c5b

                                                SHA1

                                                0c019791797b807768c8c613e46dbdf66d3de2f9

                                                SHA256

                                                61481c0c92419d0115c9c9d78c62b2bf33d6b29cfd2a6e253c8a4a2023b05940

                                                SHA512

                                                5977e285d88db3eec50f558465d8a333b79838ede9b4d2daaa49a4eb5191c644b2bb91c70701ac0416ffd0340cf59fe626b8a7fab126f7b4945a5fbe10338cec

                                              • C:\Users\Admin\AppData\Local\Temp\is-FQI6V.tmp\_isetup\_iscrypt.dll

                                                Filesize

                                                2KB

                                                MD5

                                                a69559718ab506675e907fe49deb71e9

                                                SHA1

                                                bc8f404ffdb1960b50c12ff9413c893b56f2e36f

                                                SHA256

                                                2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

                                                SHA512

                                                e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

                                              • C:\Users\Admin\AppData\Local\Temp\is-FQI6V.tmp\_isetup\_isdecmp.dll

                                                Filesize

                                                19KB

                                                MD5

                                                3adaa386b671c2df3bae5b39dc093008

                                                SHA1

                                                067cf95fbdb922d81db58432c46930f86d23dded

                                                SHA256

                                                71cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38

                                                SHA512

                                                bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303

                                              • C:\Users\Admin\AppData\Local\Temp\nshD6BA.tmp\INetC.dll

                                                Filesize

                                                25KB

                                                MD5

                                                40d7eca32b2f4d29db98715dd45bfac5

                                                SHA1

                                                124df3f617f562e46095776454e1c0c7bb791cc7

                                                SHA256

                                                85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9

                                                SHA512

                                                5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d

                                              • C:\Users\Admin\AppData\Local\Temp\nslE1B7.tmp

                                                Filesize

                                                16KB

                                                MD5

                                                9dcb9d4107040c684f2f2f24f071beb4

                                                SHA1

                                                74b2f6f1e7efca19c1a1f704845c298b945534b8

                                                SHA256

                                                24f06c8e6119d29af5ece50750f40a141de51ea94d8a808aba159df9c2a47aa2

                                                SHA512

                                                1c690012e5a5b81aa5cf2773285edffadd169e642b923eb32f726192962fc97fe7f049a3686a006cc7c4ecda89cf47246684ba12dc935dd0bbebb3255e558d8f

                                              • C:\Users\Admin\AppData\Local\Temp\nslE1B7.tmp

                                                Filesize

                                                188KB

                                                MD5

                                                f90ab999ca323da846279f15fc70c470

                                                SHA1

                                                9e51fcf51a237e838bb96f8aee97c4bb0a9d41b2

                                                SHA256

                                                9c0b3abcfb29ff48eef5294be24dca94426396c861c76f6f32924ccc779ab077

                                                SHA512

                                                78fdb53c709ebc85d12b207b19f18cbc4c36debbbd838388e860c4292c4b6684d5cf4ff25f1bf9f69bddac9e6ecdaf1d6599c4083b62c9c6ce8b4b9d2ad31752

                                              • C:\Users\Admin\AppData\Roaming\Temp\Task.bat

                                                Filesize

                                                128B

                                                MD5

                                                11bb3db51f701d4e42d3287f71a6a43e

                                                SHA1

                                                63a4ee82223be6a62d04bdfe40ef8ba91ae49a86

                                                SHA256

                                                6be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331

                                                SHA512

                                                907ad2c070cc1db89f43459a94d7f48985d939d749c9648b78572a266f0d3fde47813a129e9151dbf4a7d96d36f588172f57c88b8b947b56ed818d7d068abab2

                                              • C:\Users\Admin\AppData\Roaming\arftfsf

                                                Filesize

                                                100KB

                                                MD5

                                                b75bbfcc8651dd6209b2152004dbfff7

                                                SHA1

                                                7bc8721b03771f4b924f65fbdaef6e271be4a2d5

                                                SHA256

                                                ec6b499ebebecce43c44672ef2d9e4172cd5e0fd755a28c80e1d538e5065afb4

                                                SHA512

                                                39a5b1f6e6662afa481dee4b9ff21cba3a3fb9773151509cf4988e43773a6f1cf728c74e462b7a359a913337929e46eb930d6a5bf378083a9f4d5382057bc2ec

                                              • memory/64-289-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

                                                Filesize

                                                4KB

                                              • memory/64-141-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

                                                Filesize

                                                4KB

                                              • memory/64-220-0x0000000000400000-0x00000000008E2000-memory.dmp

                                                Filesize

                                                4.9MB

                                              • memory/636-136-0x0000000000610000-0x0000000000611000-memory.dmp

                                                Filesize

                                                4KB

                                              • memory/636-222-0x0000000000400000-0x00000000004BD000-memory.dmp

                                                Filesize

                                                756KB

                                              • memory/872-1-0x00000000005C0000-0x00000000006C0000-memory.dmp

                                                Filesize

                                                1024KB

                                              • memory/872-2-0x0000000000400000-0x000000000043B000-memory.dmp

                                                Filesize

                                                236KB

                                              • memory/872-3-0x00000000005A0000-0x00000000005AB000-memory.dmp

                                                Filesize

                                                44KB

                                              • memory/872-5-0x0000000000400000-0x000000000043B000-memory.dmp

                                                Filesize

                                                236KB

                                              • memory/968-183-0x0000000000400000-0x00000000006E2000-memory.dmp

                                                Filesize

                                                2.9MB

                                              • memory/968-181-0x0000000000400000-0x00000000006E2000-memory.dmp

                                                Filesize

                                                2.9MB

                                              • memory/1000-334-0x0000000000400000-0x0000000002B07000-memory.dmp

                                                Filesize

                                                39.0MB

                                              • memory/1000-227-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                                                Filesize

                                                972KB

                                              • memory/1000-213-0x0000000000400000-0x0000000002B07000-memory.dmp

                                                Filesize

                                                39.0MB

                                              • memory/1000-211-0x0000000002C70000-0x0000000002D70000-memory.dmp

                                                Filesize

                                                1024KB

                                              • memory/1000-212-0x0000000002B90000-0x0000000002BAC000-memory.dmp

                                                Filesize

                                                112KB

                                              • memory/1068-395-0x00000000709A0000-0x0000000070CF4000-memory.dmp

                                                Filesize

                                                3.3MB

                                              • memory/1068-373-0x0000000005C20000-0x0000000005C86000-memory.dmp

                                                Filesize

                                                408KB

                                              • memory/1068-406-0x00000000078A0000-0x00000000078BE000-memory.dmp

                                                Filesize

                                                120KB

                                              • memory/1068-408-0x00000000078C0000-0x0000000007963000-memory.dmp

                                                Filesize

                                                652KB

                                              • memory/1068-393-0x0000000071250000-0x000000007129C000-memory.dmp

                                                Filesize

                                                304KB

                                              • memory/1068-417-0x0000000008170000-0x0000000008206000-memory.dmp

                                                Filesize

                                                600KB

                                              • memory/1068-391-0x0000000007860000-0x0000000007892000-memory.dmp

                                                Filesize

                                                200KB

                                              • memory/1068-390-0x00000000074A0000-0x00000000074BA000-memory.dmp

                                                Filesize

                                                104KB

                                              • memory/1068-389-0x0000000007AF0000-0x000000000816A000-memory.dmp

                                                Filesize

                                                6.5MB

                                              • memory/1068-388-0x00000000073E0000-0x0000000007456000-memory.dmp

                                                Filesize

                                                472KB

                                              • memory/1068-387-0x0000000007210000-0x0000000007254000-memory.dmp

                                                Filesize

                                                272KB

                                              • memory/1068-386-0x00000000063B0000-0x00000000063FC000-memory.dmp

                                                Filesize

                                                304KB

                                              • memory/1068-385-0x00000000062E0000-0x00000000062FE000-memory.dmp

                                                Filesize

                                                120KB

                                              • memory/1068-351-0x0000000004D20000-0x0000000004D56000-memory.dmp

                                                Filesize

                                                216KB

                                              • memory/1068-381-0x0000000005E70000-0x00000000061C4000-memory.dmp

                                                Filesize

                                                3.3MB

                                              • memory/1068-379-0x0000000005E00000-0x0000000005E66000-memory.dmp

                                                Filesize

                                                408KB

                                              • memory/1068-355-0x00000000053B0000-0x00000000059D8000-memory.dmp

                                                Filesize

                                                6.2MB

                                              • memory/1068-411-0x00000000079B0000-0x00000000079BA000-memory.dmp

                                                Filesize

                                                40KB

                                              • memory/1068-359-0x00000000728F0000-0x00000000730A0000-memory.dmp

                                                Filesize

                                                7.7MB

                                              • memory/1068-360-0x0000000004D70000-0x0000000004D80000-memory.dmp

                                                Filesize

                                                64KB

                                              • memory/1068-364-0x0000000005310000-0x0000000005332000-memory.dmp

                                                Filesize

                                                136KB

                                              • memory/1068-416-0x0000000004D70000-0x0000000004D80000-memory.dmp

                                                Filesize

                                                64KB

                                              • memory/1068-415-0x000000007FC10000-0x000000007FC20000-memory.dmp

                                                Filesize

                                                64KB

                                              • memory/1068-361-0x0000000004D70000-0x0000000004D80000-memory.dmp

                                                Filesize

                                                64KB

                                              • memory/1212-363-0x0000000004BD0000-0x0000000004FCE000-memory.dmp

                                                Filesize

                                                4.0MB

                                              • memory/1212-202-0x0000000000400000-0x0000000002EE8000-memory.dmp

                                                Filesize

                                                42.9MB

                                              • memory/1212-201-0x0000000004FD0000-0x00000000058BB000-memory.dmp

                                                Filesize

                                                8.9MB

                                              • memory/1212-200-0x0000000004BD0000-0x0000000004FCE000-memory.dmp

                                                Filesize

                                                4.0MB

                                              • memory/1212-221-0x0000000000400000-0x0000000002EE8000-memory.dmp

                                                Filesize

                                                42.9MB

                                              • memory/1212-367-0x0000000004FD0000-0x00000000058BB000-memory.dmp

                                                Filesize

                                                8.9MB

                                              • memory/1584-215-0x0000000000400000-0x0000000000414000-memory.dmp

                                                Filesize

                                                80KB

                                              • memory/1584-97-0x0000000000400000-0x0000000000414000-memory.dmp

                                                Filesize

                                                80KB

                                              • memory/1644-34-0x0000000004900000-0x0000000004ABE000-memory.dmp

                                                Filesize

                                                1.7MB

                                              • memory/1644-35-0x0000000004AC0000-0x0000000004C77000-memory.dmp

                                                Filesize

                                                1.7MB

                                              • memory/2624-225-0x0000000000400000-0x0000000002B07000-memory.dmp

                                                Filesize

                                                39.0MB

                                              • memory/2624-217-0x0000000002C90000-0x0000000002C9B000-memory.dmp

                                                Filesize

                                                44KB

                                              • memory/2624-216-0x0000000002B40000-0x0000000002C40000-memory.dmp

                                                Filesize

                                                1024KB

                                              • memory/2624-218-0x0000000000400000-0x0000000002B07000-memory.dmp

                                                Filesize

                                                39.0MB

                                              • memory/3060-84-0x0000000073980000-0x0000000074130000-memory.dmp

                                                Filesize

                                                7.7MB

                                              • memory/3060-114-0x0000000073980000-0x0000000074130000-memory.dmp

                                                Filesize

                                                7.7MB

                                              • memory/3060-83-0x0000000000520000-0x0000000000B40000-memory.dmp

                                                Filesize

                                                6.1MB

                                              • memory/3408-24-0x00000000005A0000-0x00000000005AB000-memory.dmp

                                                Filesize

                                                44KB

                                              • memory/3408-16-0x00000000020F0000-0x000000000217B000-memory.dmp

                                                Filesize

                                                556KB

                                              • memory/3408-22-0x00000000005A0000-0x00000000005AB000-memory.dmp

                                                Filesize

                                                44KB

                                              • memory/3408-23-0x00000000005A0000-0x00000000005AB000-memory.dmp

                                                Filesize

                                                44KB

                                              • memory/3408-21-0x00000000005A0000-0x00000000005AB000-memory.dmp

                                                Filesize

                                                44KB

                                              • memory/3408-64-0x00000000020F0000-0x000000000217B000-memory.dmp

                                                Filesize

                                                556KB

                                              • memory/3408-65-0x00000000005A0000-0x00000000005AB000-memory.dmp

                                                Filesize

                                                44KB

                                              • memory/3420-4-0x0000000002B10000-0x0000000002B26000-memory.dmp

                                                Filesize

                                                88KB

                                              • memory/3420-223-0x0000000002A20000-0x0000000002A36000-memory.dmp

                                                Filesize

                                                88KB

                                              • memory/4440-62-0x00000000029F0000-0x0000000002B04000-memory.dmp

                                                Filesize

                                                1.1MB

                                              • memory/4440-54-0x00000000028C0000-0x00000000029EF000-memory.dmp

                                                Filesize

                                                1.2MB

                                              • memory/4440-52-0x0000000000C40000-0x0000000000C46000-memory.dmp

                                                Filesize

                                                24KB

                                              • memory/4440-56-0x00000000029F0000-0x0000000002B04000-memory.dmp

                                                Filesize

                                                1.1MB

                                              • memory/4712-382-0x0000000000800000-0x00000000008A2000-memory.dmp

                                                Filesize

                                                648KB

                                              • memory/4712-191-0x0000000000400000-0x00000000006E2000-memory.dmp

                                                Filesize

                                                2.9MB

                                              • memory/4712-358-0x0000000000400000-0x00000000006E2000-memory.dmp

                                                Filesize

                                                2.9MB

                                              • memory/4712-362-0x0000000000400000-0x00000000006E2000-memory.dmp

                                                Filesize

                                                2.9MB

                                              • memory/4804-63-0x0000000002DE0000-0x0000000002EF4000-memory.dmp

                                                Filesize

                                                1.1MB

                                              • memory/4804-76-0x0000000010000000-0x0000000010175000-memory.dmp

                                                Filesize

                                                1.5MB

                                              • memory/4804-58-0x0000000002DE0000-0x0000000002EF4000-memory.dmp

                                                Filesize

                                                1.1MB

                                              • memory/4804-47-0x0000000000E70000-0x0000000000E76000-memory.dmp

                                                Filesize

                                                24KB

                                              • memory/4804-36-0x0000000000400000-0x0000000000848000-memory.dmp

                                                Filesize

                                                4.3MB

                                              • memory/4804-42-0x0000000000400000-0x0000000000848000-memory.dmp

                                                Filesize

                                                4.3MB

                                              • memory/4804-41-0x0000000000400000-0x0000000000848000-memory.dmp

                                                Filesize

                                                4.3MB

                                              • memory/4804-39-0x0000000000400000-0x0000000000848000-memory.dmp

                                                Filesize

                                                4.3MB

                                              • memory/4804-40-0x0000000000400000-0x0000000000848000-memory.dmp

                                                Filesize

                                                4.3MB

                                              • memory/4804-48-0x0000000010000000-0x0000000010175000-memory.dmp

                                                Filesize

                                                1.5MB

                                              • memory/4804-55-0x0000000002CB0000-0x0000000002DDF000-memory.dmp

                                                Filesize

                                                1.2MB

                                              • memory/4804-43-0x0000000000400000-0x0000000000848000-memory.dmp

                                                Filesize

                                                4.3MB

                                              • memory/5092-77-0x0000000000C40000-0x0000000000C46000-memory.dmp

                                                Filesize

                                                24KB

                                              • memory/5092-73-0x0000000000410000-0x0000000000F32000-memory.dmp

                                                Filesize

                                                11.1MB

                                              • memory/5092-69-0x0000000000410000-0x0000000000F32000-memory.dmp

                                                Filesize

                                                11.1MB