Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

08/04/2024, 14:58

240408-scmmhaca56 8

03/04/2024, 19:45

240403-ygeeksag7v 8

Analysis

  • max time kernel
    589s
  • max time network
    454s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/04/2024, 19:45

General

  • Target

    TruCheck_v3.03.70_b3647_Updater.exe

  • Size

    195.7MB

  • MD5

    719e9af110e7527608b8006f6290a29c

  • SHA1

    74a0684bffc141503c55572c12eecba2a3d9e5a1

  • SHA256

    29dc4464ba770c14edd38234dc1a26fc6a983212831ed653b50945be99153c12

  • SHA512

    140e648a28ac5e7a3180f7f311f84ee0a393146f066d3d800d25efff9e5f278d97445117b10c28a382b45c5b345183bdf11fc5227d6e687dedbfc3b8372d87ae

  • SSDEEP

    3145728:caSFaGTMXZ+IasZ4AR/gh6O6gx7AFaTzT6B7jdsOL9Nf0iVbSJNTRK:2aGwJ+TO496nU/nO7jdnky

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Manipulates Digital Signatures 1 TTPs 1 IoCs

    Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 64 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Blocklisted process makes network request 2 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 63 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 42 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 14 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\TruCheck_v3.03.70_b3647_Updater.exe
    "C:\Users\Admin\AppData\Local\Temp\TruCheck_v3.03.70_b3647_Updater.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3464
    • C:\Users\Admin\AppData\Local\Temp\UpdateTool.exe
      "C:\Users\Admin\AppData\Local\Temp\UpdateTool.exe" ud=true uf="Setup.exe PreInstallDriver=true"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3888
      • C:\Users\Admin\AppData\Local\Temp\TruCheckSetup.exe
        "C:\Users\Admin\AppData\Local\Temp\TruCheckSetup.exe" PreInstallDriver=true
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4636
        • C:\Windows\SysWOW64\msiexec.exe
          "C:\Windows\SysWOW64\msiexec.exe" -I "C:\Users\Admin\AppData\Local\Temp\TruCheckSetup.msi" PreInstallDriver=true
          4⤵
          • Blocklisted process makes network request
          • Enumerates connected drives
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          PID:4120
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Drops file in Drivers directory
    • Sets service image path in registry
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:536
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 5478D6A5C52F38DF7ACE4DB918FC6B72 C
      2⤵
      • Loads dropped DLL
      PID:736
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:4920
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding C2055FE60CAFB896F979C4E0D54D5C25
        2⤵
        • Loads dropped DLL
        PID:1088
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding D227E7ED511291C72B76D224856D8E7A E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Checks SCSI registry key(s)
        • Suspicious use of WriteProcessMemory
        PID:4284
        • C:\Program Files (x86)\Webscan Inc\TruCheck\Drivers\x64\W64Install.exe
          "C:\Program Files (x86)\Webscan Inc\TruCheck\Drivers\x64\W64Install.exe" p
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          PID:432
    • C:\Windows\system32\vssvc.exe
      C:\Windows\system32\vssvc.exe
      1⤵
      • Checks SCSI registry key(s)
      PID:384
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
      1⤵
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of WriteProcessMemory
      PID:856
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "4" "1" "C:\Program Files (x86)\Webscan Inc\TruCheck\Drivers\trucheck.inf" "9" "455d358b7" "0000000000000138" "WinSta0\Default" "0000000000000158" "208" "C:\Program Files (x86)\Webscan Inc\TruCheck\Drivers"
        2⤵
        • Manipulates Digital Signatures
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Modifies data under HKEY_USERS
        • Suspicious use of WriteProcessMemory
        PID:2784
        • C:\Windows\system32\rundll32.exe
          rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{9e5e2699-50cd-df44-9ea7-c81824b93f57} Global\{dfd6cca4-b688-7248-a073-b53ab8d6b45a} C:\Windows\System32\DriverStore\Temp\{9da650e8-91b2-304d-adaa-1d762f8feb49}\trucheck.inf C:\Windows\System32\DriverStore\Temp\{9da650e8-91b2-304d-adaa-1d762f8feb49}\webscan.cat
          3⤵
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          PID:3720
    • C:\Program Files (x86)\Webscan Inc\TruCheck\TruCheck.exe
      "C:\Program Files (x86)\Webscan Inc\TruCheck\TruCheck.exe"
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5040
      • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
        dw20.exe -x -s 2632
        2⤵
        • Drops file in Windows directory
        • Checks processor information in registry
        • Enumerates system info in registry
        PID:988
    • C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
      C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
      1⤵
        PID:1896
      • C:\Program Files (x86)\Webscan Inc\TruCheck\TruCheck.exe
        "C:\Program Files (x86)\Webscan Inc\TruCheck\TruCheck.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        PID:3400
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Program Files (x86)\Webscan Inc\TruCheck\Webscan TruCheck User Manual.pdf"
        1⤵
        • Checks processor information in registry
        • Modifies Internet Explorer settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3064
        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2540
          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=EEF33F6A0B943DC0C5DD73A106071C8B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=EEF33F6A0B943DC0C5DD73A106071C8B --renderer-client-id=2 --mojo-platform-channel-handle=1784 --allow-no-sandbox-job /prefetch:1
            3⤵
              PID:1832
            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6A33C4BE2A760262DB9FCE69C42292DF --mojo-platform-channel-handle=1776 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
              3⤵
                PID:1164
              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=03458777CDBA83F0A26B4EF10A14EB9C --mojo-platform-channel-handle=2336 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                3⤵
                  PID:840
                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=9D51D9018A0AC54011A8F186106EB85C --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=9D51D9018A0AC54011A8F186106EB85C --renderer-client-id=5 --mojo-platform-channel-handle=2024 --allow-no-sandbox-job /prefetch:1
                  3⤵
                    PID:4800
                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D8F4D2E849635111E8AFF0683AC435E0 --mojo-platform-channel-handle=2732 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                    3⤵
                      PID:1336
                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=18D0DA889F2B606E2C12F8C785A2AE61 --mojo-platform-channel-handle=2360 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
                      3⤵
                        PID:3352
                  • C:\Windows\system32\taskmgr.exe
                    "C:\Windows\system32\taskmgr.exe" /4
                    1⤵
                    • Checks SCSI registry key(s)
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    PID:1680
                  • C:\Program Files (x86)\Webscan Inc\TruCheck\TruCheck.exe
                    "C:\Program Files (x86)\Webscan Inc\TruCheck\TruCheck.exe"
                    1⤵
                    • Executes dropped EXE
                    • Checks processor information in registry
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4188
                    • C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
                      dw20.exe -x -s 2568
                      2⤵
                      • Checks processor information in registry
                      • Enumerates system info in registry
                      PID:2908
                  • C:\Program Files (x86)\Webscan Inc\TruCheck\Drivers\Sleepstates_Tool.exe
                    "C:\Program Files (x86)\Webscan Inc\TruCheck\Drivers\Sleepstates_Tool.exe"
                    1⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2664
                  • C:\Program Files (x86)\Webscan Inc\TruCheck\Drivers\HardwareWizard.exe
                    "C:\Program Files (x86)\Webscan Inc\TruCheck\Drivers\HardwareWizard.exe"
                    1⤵
                    • Executes dropped EXE
                    PID:1128
                    • C:\Program Files (x86)\Webscan Inc\TruCheck\Drivers\x64\devcon.exe
                      ".\x64\devcon.exe" status "USB\VID_09DB&PID_0076" & "USB\VID_04D8&PID_FED8" & "USB\VID_1FCE&PID_0001" & "USB\VID_1409&PID_1000" & "USB\VID_1409&PID_2230" & "USB\VID_1409&PID_2280" & "USB\VID_1421&PID_1106" & "USB\VID_1421&PID_0805" & "USB\VID_1421&PID_1506" & "USB\VID_1E10&PID_2005" & "USB\VID_04FA&PID_2490" & "USB\VID_04D8&PID_FED8" & "USB\VID_1FCE&PID_0001"
                      2⤵
                      • Executes dropped EXE
                      • Checks SCSI registry key(s)
                      PID:1540
                    • C:\Program Files (x86)\Webscan Inc\TruCheck\Drivers\x64\devcon.exe
                      ".\x64\devcon.exe" status "USB\VID_1FCE&PID_0002" & "USB\VID_1FCE&PID_0003"
                      2⤵
                      • Executes dropped EXE
                      • Checks SCSI registry key(s)
                      PID:2944

                  Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Config.Msi\e583564.rbs

                    Filesize

                    186KB

                    MD5

                    e7be61e11e3988f26e1072fae917634c

                    SHA1

                    fa9991d7d17ea17472ac84b5fd491b451e2e2ce9

                    SHA256

                    ca8506968e038662450d91abe031b1aaf8f0fb6d7526e4b2c1f2b2bb80ac93a8

                    SHA512

                    4b4d220b41ac7c86e36adc14c91370f6e54a03c59fde032d8770fd28898efa2e46ff41cabb5ce015959efeea45d19a3f6110c08a2f266d2503b91f3376ec6cb4

                  • C:\PROGRA~2\WEBSCA~1\TruCheck\Drivers\tcusbld.spt

                    Filesize

                    52KB

                    MD5

                    0bc66dacfaa51cc1836424e3bec2a3f2

                    SHA1

                    a4913f8b55ab23be811768bb654e3ee501c7b4ac

                    SHA256

                    a64efa8dbf365c9f5db260047911d47cbf75cdb39cc21adb6b569644849ba1b7

                    SHA512

                    f374987a8c15f901f9ec6a7b75fcc712a4313dd3c42dd05b8dc8f8b3d0e7a4c66f04bd640d90cf16078b73f8122e2ccce0d9f96ac9296842b353660a310b02ec

                  • C:\PROGRA~2\WEBSCA~1\TruCheck\Drivers\webscan.cat

                    Filesize

                    12KB

                    MD5

                    e8cd2be72e86698bf847c8ab02969af5

                    SHA1

                    7aa588e580dfa1c4699f6f27dbfed1d8c365ab48

                    SHA256

                    a41c6951d9365e774d97958b129679d175f70ca47c3a5ecd58bd42744ef21640

                    SHA512

                    f55cf41c5c07283fa6d55cf4a11979bcf120f31c1af7dcf69fc387b215374342aa6783d1a66fec0cd7d4599e5b0e4cc7513a8a380007c15178b256cbeb3b08a6

                  • C:\PROGRA~2\WEBSCA~1\TruCheck\Drivers\x64\CyUsb.sys

                    Filesize

                    51KB

                    MD5

                    f3f07cdd21b7b220a68005e6731496ca

                    SHA1

                    68e54ba66bb8e591d633e3d79658e03586e83311

                    SHA256

                    251b04deac7cecff790287dc6b212222ad85fea40e5e7f6e675a63000b336d93

                    SHA512

                    9ae2e7f6f7fca1dfe18c60653442adef506f8cb31e65624ff19cbfe4e20bd9d681236ad58ec15e80f427ef70dc289bf731b171257f2c86f85414c505b3555137

                  • C:\PROGRA~2\WEBSCA~1\TruCheck\Drivers\x64\PGRUSBCam.sys

                    Filesize

                    53KB

                    MD5

                    ba738127ecde978bbc9e5a07898601f8

                    SHA1

                    d7be3f8e02fb91f2ca75a6c783e3dc8e3ad2c10c

                    SHA256

                    2680bafd34a04aa9e6c220cbd75c54b945520aa66c9544274835533ed68f4a43

                    SHA512

                    f9d73a2fbe1d15ee23bc2aa074d62795faf0fe3ad5af57865038b19d3f279bfdef6b671bb6a4477eee843fc289e828b9e31f0b842e8642b0d15cc5658880e3cd

                  • C:\PROGRA~2\WEBSCA~1\TruCheck\Drivers\x64\StUSB.sys

                    Filesize

                    43KB

                    MD5

                    8da0f189cc61a7952e472a17d10fac7b

                    SHA1

                    cd4f3677f2abbdaf1297d79efe37f1a980663aa5

                    SHA256

                    9e576d0302b6e2a27b3b2e03300020c20a359b8201eb20ce5adede0a9f12675a

                    SHA512

                    c2179066d0a2556f05b96ab5486e01b37431750f74ad97dac17cac9787445d52e266fd3024eacdda128a8e8ba65f49a9da87ba395d373d64f28c4ecc3bedb3ea

                  • C:\PROGRA~2\WEBSCA~1\TruCheck\Drivers\x64\uEye_boot.sys

                    Filesize

                    1.6MB

                    MD5

                    330c321024ec9e5156392ba8b8e85a3b

                    SHA1

                    41c5d8a7a016d59398520da17974569e9e700aed

                    SHA256

                    91bff3c6164610f38a96c4fdbc5ae7315c0badbc499f1bf8bf111e7296e8e690

                    SHA512

                    8fb9c3ac3a56201bdba13344a2b1c7bfab11f7964ae1b39094c4d68ead2b19e8245add32be99260b9473bedf2dbee39dcb70ccd1f28085ce3a48af7db5f5c292

                  • C:\PROGRA~2\WEBSCA~1\TruCheck\Drivers\x64\uEye_usb.sys

                    Filesize

                    1.7MB

                    MD5

                    16b24166eb196aabe418b8d0d83aa60d

                    SHA1

                    8908b4ead1a791d185bc3af927ac6f194f8734d7

                    SHA256

                    407c590b2f222dfc9424d0d8a65a76e4ed2ad3b8ba3b302d10ebcdaff787410a

                    SHA512

                    1ac67c8f822a5069cb670f18d77259bd1effece7b7d326a528b1175d7df2fe3684c0eeae1393de94d309d90bb94f3472438674034277b2435db9ea6ac6eac5c3

                  • C:\PROGRA~2\WEBSCA~1\TruCheck\Drivers\x64\wdfcoinstaller01009.dll

                    Filesize

                    1.6MB

                    MD5

                    4da5da193e0e4f86f6f8fd43ef25329a

                    SHA1

                    68a44d37ff535a2c454f2440e1429833a1c6d810

                    SHA256

                    18487b4ff94edccc98ed59d9fca662d4a1331c5f1e14df8db3093256dd9f1c3e

                    SHA512

                    b3d73ed5e45d6f2908b2f3086390dd28c1631e298756cee9bdf26b185f0b77d1b8c03ad55e0495dba982c5bed4a03337b130c76f7112f3e19821127d2cf36853

                  • C:\Program Files (x86)\Webscan Inc\TruCheck\Drivers\InstallDriver.dll

                    Filesize

                    50KB

                    MD5

                    fd6054ccda68e02610b899cdc16d186b

                    SHA1

                    f23d3f737991466d758caabe1dac0fa0977384f3

                    SHA256

                    3e271de68ca66ec912976e347816ceecab7540e05a98b1d8d0690c662d65d2da

                    SHA512

                    efe63d70fd7d454b57cdd4c2fe85ccd20cd6ab68cc6f990f2436f4f7a9083a2443e7868af513c55e9f1f865395a5262787e2b588ece13ff0cd10ae1146f050ad

                  • C:\Program Files (x86)\Webscan Inc\TruCheck\Drivers\trucheck.inf

                    Filesize

                    9KB

                    MD5

                    2987d40e46e1c0b1701e0fac75b141a5

                    SHA1

                    0ec7e21728fa7d950f1107be0aa7ae30696941c5

                    SHA256

                    ce7d779c2671a33ede4c0313571733243b732a79330aed0ef9eabe129c38d6c0

                    SHA512

                    613ce470b5334d7c0658c86180b17f3a9a79256a655f41de59d60bad46176f62a882b75f97a8314b0f077ca098c985b3633d8249a3ebb06e2517bfd51b0ef22b

                  • C:\Program Files (x86)\Webscan Inc\TruCheck\Drivers\x64\DIFxAPI.dll

                    Filesize

                    507KB

                    MD5

                    9495b07f33ded991c65d9b04945d44c5

                    SHA1

                    db9d5ec47980eb0709faba0cda283ff99d643b7c

                    SHA256

                    bf0798d3a4540b15f45c5b329798a2ac532ff693764948b9b4757265e145216e

                    SHA512

                    36ff4bd8b252f78a91a8e205bda17bd7f159a11f1616f5bf90fa08164201c272efa817c3974680603ab19a2086ce4dc3a26a504ee811d5a530ccc9e8af6d4815

                  • C:\Program Files (x86)\Webscan Inc\TruCheck\Drivers\x64\W64Install.exe

                    Filesize

                    9KB

                    MD5

                    f4cb6e0ad8de576f746e7121eb61c364

                    SHA1

                    636dbc63fc48cace097d332055cb42c190e65984

                    SHA256

                    1053e632d1f5e43d1db5d263e1bacc52d199f3acb3ab8ee26e7d505569de376d

                    SHA512

                    93cef1a63616b8b651c790d2236640c99ed9cd03de1c606345d5d8d7b2b901758459b317c1c0a0811c622d88833336d46e2c0a2ca7d1619d8614f7a2f04fb617

                  • C:\Program Files (x86)\Webscan Inc\TruCheck\Ionic.Zip.Reduced.DLL

                    Filesize

                    247KB

                    MD5

                    7c359500407dd393a276010ab778d5af

                    SHA1

                    4d63d669b73acaca3fc62ec263589acaaea91c0b

                    SHA256

                    a4009288982e4c30d22b544167f72db882e34f0fda7d4061b2c02c84688c0ed1

                    SHA512

                    88a25138d0a491e5ee27499206e05b8c501da0c73ad2b3e23d70e810a09bfc1b701817de7f22c9f0b9f81f90235fe5eeadd112773035a11f01706eac364b34bc

                  • C:\Program Files (x86)\Webscan Inc\TruCheck\TruCheck.exe

                    Filesize

                    982KB

                    MD5

                    8a33495d8e72035488d6bfe0ce276202

                    SHA1

                    5acefd68888410407c01c72b985b973046a286ff

                    SHA256

                    c9af2411972dd18e6842cc37caa61d60ba1e44160668109eba99b2be72d15c72

                    SHA512

                    c39857654d88d047afe126da4e0ed4f29a473bde4f085f044e12fcde43e1e1d5787030a0bb761db32438133874fef5ce4c0870fe139b6efb13b8b80dd0972c05

                  • C:\Program Files (x86)\Webscan Inc\TruCheck\TruCheckControl.dll

                    Filesize

                    20.9MB

                    MD5

                    283aa6dc39b6b9e4267a9f5bb620ab4d

                    SHA1

                    9daddab44c9182d51ea886110adb41fc90854f68

                    SHA256

                    c3885de8c87ff9ddf33193bed64c5599ed161957f762245e6316b126b95f6d99

                    SHA512

                    7d9929c6fc99115945dec89cd03e1f0da9dd26302e415fe28b62420ef4ef60a2bdeaf6ba8f97c4b0286a20553a9eefb4fcffacbf17650e052020ac9bbe15eeb0

                  • C:\Program Files (x86)\Webscan Inc\TruCheck\TruCheckDataTypes.DLL

                    Filesize

                    93KB

                    MD5

                    1a9cc11b7e7c3ea0a8683eff665e9b54

                    SHA1

                    2805aed696d065093bc4b9fa9f0b980b2fdbdfcc

                    SHA256

                    e68a4d36e349f23cef88e00015aae8f3e896e79838a881f9d5fa2642bac7352e

                    SHA512

                    cc6a34a9ac4cf5cf7b7c64bc603913b09ca3ec29b6a639a559200ad58d3d4dd66c73110a2581e848f361a0917d7060ec310104ff38e36c20049522d016c7d33a

                  • C:\Program Files (x86)\Webscan Inc\TruCheck\en-US\TruCheck.resources.dll

                    Filesize

                    27.9MB

                    MD5

                    32f25312407a630c6d3b6f4d8347b681

                    SHA1

                    b098a4fa60d30c95ffdd9130e9c07606a1e152b0

                    SHA256

                    b82e38950e9053134e116884016844a2e871d691498b7c6398a1d5bb668da0ef

                    SHA512

                    41785e6fef3147fc8a39c02a7bc2645a413a1b5d3af837bc320c8bcf793004454ac04e8123d9dbb34897d788474d035687c0e1153a6c3138951a9f3980f60dd8

                  • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                    Filesize

                    36KB

                    MD5

                    b30d3becc8731792523d599d949e63f5

                    SHA1

                    19350257e42d7aee17fb3bf139a9d3adb330fad4

                    SHA256

                    b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

                    SHA512

                    523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

                  • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                    Filesize

                    56KB

                    MD5

                    752a1f26b18748311b691c7d8fc20633

                    SHA1

                    c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

                    SHA256

                    111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

                    SHA512

                    a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

                  • C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

                    Filesize

                    64KB

                    MD5

                    c0844ec77d540023f505c6e6b1f796ae

                    SHA1

                    382541769c5231985234cbcf1a0d0e1a3689338b

                    SHA256

                    2e456967f4910eae22108fa2183e297850b9e3c615b6f5484a9b9ed71215540d

                    SHA512

                    26a484aba36a127485bfb5cbc1b9a5073873e9c171f8e3e68be9e3a882026afcdc52aeb1eaeffe8c4c2b52fba78bfa04fbd6c5eb0691b5066a5b266ea9092951

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164

                    Filesize

                    1KB

                    MD5

                    e1a4b2b787a91b3f548716ed5b1b8171

                    SHA1

                    767452821035bc9da20d0917474bff2b336f0b3a

                    SHA256

                    f98370d45aa93a5f04e53bd92219b358491d6fef09c1aebba5fc0a120ab861d9

                    SHA512

                    848296397cb7676717d94114bd8a344516edc750404b34aa1dee1d571ce2e2c9b345786c387e3f4ef57012528d3b8161291c6a6c248554ea26b714b8f673a6a3

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1D627669EFC8CD4F21BCF387D97F9B5_B8EC29A9F6EE1252C61F50A231A186F2

                    Filesize

                    1KB

                    MD5

                    eb8ecac08f744f5ac9637c0f0129f045

                    SHA1

                    612c3e5375f0a6cc63cfeca549a361534b373889

                    SHA256

                    3f95e4a685db2a4cc50df8dae853a0f38e574dc58983067d1e30842ff3955cd7

                    SHA512

                    71a18d91c014986ff3e85fd23e268d227e84aa30216faa5bf542ea6cecbd9cd0329119a1aceb11f08cb940ccba55e23db48591fbae26a446ff6a6f4f84ad66da

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164

                    Filesize

                    532B

                    MD5

                    1a52868c7ab6b2be2435328ed0e0965d

                    SHA1

                    274bad697c27cb867ad427895723a4f9aa624b03

                    SHA256

                    a7c41108f9c37a1d6e222f3c9a627f60644bc3fafa2dcfbf8c64dd60d9cff1ea

                    SHA512

                    d8c42f8ffbc0ecd24ce0337f15b52a0a13ed0da1ca02880993070567d27417a1c23ae9895bbd8114eaf4977752e420476837b2e4de39a70d947a74d3d5159e81

                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1D627669EFC8CD4F21BCF387D97F9B5_B8EC29A9F6EE1252C61F50A231A186F2

                    Filesize

                    544B

                    MD5

                    8cc4627bd01b016344f92867dac634f2

                    SHA1

                    0869f59bb3a1941353b424d4b36bed167a756ea8

                    SHA256

                    ffc57891156858add5e2f798223681f258e7c383c1aab0f26c8e1e17d362e7ca

                    SHA512

                    cfa699403ab18c3ac2e20eb1b69c03f8e646fc77f45c80780e73be78ceb6f6e2e63e63837c7615feb3af5d3f6f74a1cc5055ee4a42bfa7ee2ec64605c23b17cd

                  • C:\Users\Admin\AppData\Local\Temp\CFG39F7.tmp

                    Filesize

                    123B

                    MD5

                    17af548f88a3199aa8a63a72201f470f

                    SHA1

                    4e64bb20a2f54d778ed684aa21abebad63a5c2c0

                    SHA256

                    a558dbe555749cd3bdd62060fdbba72720c4f4a186d5870b977ed2acf9721d9e

                    SHA512

                    08bdbc75f5fd4d9ec85c53253e4030ce7245b20ecc95e032835609c7c43a07d6c9e7776f48c5494a788a543240c0649a9f1a34a0e514ebc4dda5730953647338

                  • C:\Users\Admin\AppData\Local\Temp\MSI702F.tmp

                    Filesize

                    221KB

                    MD5

                    911aa8d08b7ccab654e897b0e4439354

                    SHA1

                    4f4f16048deae47a2ff5b9849042f62ec51794bc

                    SHA256

                    ba56a2fa13e5dae48b6d74a8fa40f2f44473b386e71ba1e7ec2ded90ad56bb8b

                    SHA512

                    8aa11f26093e54a62c5390c64e218a8a57cd3374bbce8ecc243042dd8a2214ede1f3befa699837698c0bd42b9b4e011f95c62588b8bdd4da9aae12dabe4b46e4

                  • C:\Users\Admin\AppData\Local\Temp\TruCheckSetup.exe

                    Filesize

                    384KB

                    MD5

                    776851d4a843a0717892e075d03f46ce

                    SHA1

                    71158f473006c4bbe7c0a5e969c0b346e0c57ac8

                    SHA256

                    3242c4e31b2158a950b66220ba6029138be0c00a4534c7e3c3c109cb882f239b

                    SHA512

                    57130f320b81da24c784d84b94d2968437f48a7a950944e4c5c31858741d2e31f33cd01992f36fd55b9fcd2fdd425b831da6b7a196bba4d9486d4a8f0aead7aa

                  • C:\Users\Admin\AppData\Local\Temp\TruCheckSetup.msi

                    Filesize

                    191.6MB

                    MD5

                    b42d32a276b782d58420ec171789ed34

                    SHA1

                    789505e6363e2fc9942e5b73df99884760273abf

                    SHA256

                    704f21dd7d649d9875b903727e232316dda3075feaf9f25efd46134af9c31839

                    SHA512

                    63741b75309f8f41a57bd9e1daa4f7e408a73de2d2fe19e2ef3b51dc7d0e1cc5b9d3ba2c2bc3250649992e693a206825081a6cf25badd93c12592c359ec61684

                  • C:\Users\Admin\AppData\Local\Temp\UpdateTool.exe

                    Filesize

                    59KB

                    MD5

                    d42b83e5e46d7cc78baf0fc96c9eb676

                    SHA1

                    f8749d8dcfc7e5ca8ae9c1c61cd07c69ba5179e8

                    SHA256

                    1d346380993baeddb1b36928497cc442415e05b761dd66296f85815b13091cb6

                    SHA512

                    bafd9284e3de19607cc64c2f1b4ec7d18906f49618aac246ae2ef103e36a918d7f6d0c8df7a45d11e36281dcd95da8b65add4e72228d97fd4f4c43de086b6508

                  • C:\Windows\Installer\MSI4823.tmp

                    Filesize

                    63KB

                    MD5

                    384a729b4093250d9786013e15e9aa31

                    SHA1

                    c7ebd3366e0b05b2eb0cd17a6a8354427436774c

                    SHA256

                    e83ddd458b0433c98f4d13853cc88cf72fada6ffce6d56fcaca8e83bd76abfad

                    SHA512

                    d6f70005e29e6e8b5c926d7fa4280ae1081c8c0626f74417a73fb81dd5522abab300dd7105f8842a2f41b8f036edacb4853bc6ca7be8f67e5da80ca9de9bc66e

                  • C:\Windows\Installer\{3F408034-3680-483F-A303-286D629038CA}\_B5F8CC6E4F9FA1A6023003.exe

                    Filesize

                    14KB

                    MD5

                    07282ca770d5cc6fba8e0c1598c485f2

                    SHA1

                    b7bb6f83b446f73499059d2e14cafba3fc09eb81

                    SHA256

                    c7669bc86c8102ab2cec262de32ac4aca06e4904959c088d85440ae77b85ec36

                    SHA512

                    845fd16f032fd40456d74f30045e688044b5d2b4014a06ec700fd0211ed4a2b9fbe53dc89ad8bd7f2407c0ce6cb12885f06185c56065672071d682b39716903b

                  • C:\Windows\System32\CatRoot2\dberr.txt

                    Filesize

                    19KB

                    MD5

                    65d8cb74df760cacbf52f33c6ed80422

                    SHA1

                    43e19b9b26354bfbb6121ef31c35192c970833cb

                    SHA256

                    0ee74043a1c34dc7d5bd0e3631624d39bd006e917652d5052506030c0bf8dd59

                    SHA512

                    34e8a0c1296940ff27ff4fc7109fbacb96ce52364c7ebbd7d05ca2de70cadfcf96b37898367b5174becddb559a3d8c24840f23c5f6091f9756cf96493f3d80d2

                  • \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

                    Filesize

                    23.7MB

                    MD5

                    837f963747e9766d1b375e7507c2a3b8

                    SHA1

                    84d4ec9d272b8f19d27221cc58781f3f301467f6

                    SHA256

                    1aacff796dc3f32585be4c39a42565467733323a46c4ba3429f09e332aca2014

                    SHA512

                    84bffa202540cabcf6f379f49536f0e72da756435b4accb93cbf7b3466560330bd98c7fa7614347f7c6bcedb835a913edcac1d0d6a079114b49008bcfb6ff183

                  • \??\Volume{2dcc6a48-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{35e9e445-d28c-4960-9245-01fefc1fdbed}_OnDiskSnapshotProp

                    Filesize

                    6KB

                    MD5

                    9213479081383672ed67e83c93ef854b

                    SHA1

                    5e107f2f2e3ed7afe39ca5b0521b883a29585ea0

                    SHA256

                    1482955eb13fad7d47cb0684c341c64ddf6747f150c496f05a8b0b10289ecd0b

                    SHA512

                    92e3dcf747b9790fd4bcf1c371a82a2cb37ae098a43aebd4b066d4b09933d857e5b7fef8b895c1fad566f5e01294c7925775b736ef36aa99ef0460266bb0e3f4

                  • memory/1128-755-0x0000000002160000-0x0000000002170000-memory.dmp

                    Filesize

                    64KB

                  • memory/1128-745-0x0000000002160000-0x0000000002170000-memory.dmp

                    Filesize

                    64KB

                  • memory/1128-746-0x0000000002160000-0x0000000002170000-memory.dmp

                    Filesize

                    64KB

                  • memory/1128-744-0x0000000002160000-0x0000000002170000-memory.dmp

                    Filesize

                    64KB

                  • memory/1128-763-0x0000000073FF0000-0x00000000745A1000-memory.dmp

                    Filesize

                    5.7MB

                  • memory/1128-743-0x0000000073FF0000-0x00000000745A1000-memory.dmp

                    Filesize

                    5.7MB

                  • memory/1128-764-0x0000000002160000-0x0000000002170000-memory.dmp

                    Filesize

                    64KB

                  • memory/1128-767-0x0000000073FF0000-0x00000000745A1000-memory.dmp

                    Filesize

                    5.7MB

                  • memory/1680-694-0x0000021ECA050000-0x0000021ECA051000-memory.dmp

                    Filesize

                    4KB

                  • memory/1680-693-0x0000021ECA050000-0x0000021ECA051000-memory.dmp

                    Filesize

                    4KB

                  • memory/1680-691-0x0000021ECA050000-0x0000021ECA051000-memory.dmp

                    Filesize

                    4KB

                  • memory/1680-689-0x0000021ECA050000-0x0000021ECA051000-memory.dmp

                    Filesize

                    4KB

                  • memory/1680-690-0x0000021ECA050000-0x0000021ECA051000-memory.dmp

                    Filesize

                    4KB

                  • memory/1680-685-0x0000021ECA050000-0x0000021ECA051000-memory.dmp

                    Filesize

                    4KB

                  • memory/1680-684-0x0000021ECA050000-0x0000021ECA051000-memory.dmp

                    Filesize

                    4KB

                  • memory/1680-695-0x0000021ECA050000-0x0000021ECA051000-memory.dmp

                    Filesize

                    4KB

                  • memory/1680-692-0x0000021ECA050000-0x0000021ECA051000-memory.dmp

                    Filesize

                    4KB

                  • memory/1680-683-0x0000021ECA050000-0x0000021ECA051000-memory.dmp

                    Filesize

                    4KB

                  • memory/1896-470-0x000000001A3E0000-0x000000001A7B4000-memory.dmp

                    Filesize

                    3.8MB

                  • memory/1896-471-0x00007FFAFC190000-0x00007FFAFCB31000-memory.dmp

                    Filesize

                    9.6MB

                  • memory/1896-472-0x000000001AA00000-0x000000001AB36000-memory.dmp

                    Filesize

                    1.2MB

                  • memory/1896-473-0x0000000000E70000-0x0000000000E80000-memory.dmp

                    Filesize

                    64KB

                  • memory/1896-469-0x0000000000E70000-0x0000000000E80000-memory.dmp

                    Filesize

                    64KB

                  • memory/1896-467-0x0000000000C00000-0x0000000000C20000-memory.dmp

                    Filesize

                    128KB

                  • memory/1896-496-0x0000000000E70000-0x0000000000E80000-memory.dmp

                    Filesize

                    64KB

                  • memory/1896-468-0x00007FFAFC190000-0x00007FFAFCB31000-memory.dmp

                    Filesize

                    9.6MB

                  • memory/1896-495-0x00007FFAFC190000-0x00007FFAFCB31000-memory.dmp

                    Filesize

                    9.6MB

                  • memory/3064-673-0x000000000FB00000-0x000000000FC4D000-memory.dmp

                    Filesize

                    1.3MB

                  • memory/3064-672-0x000000000FB00000-0x000000000FDAB000-memory.dmp

                    Filesize

                    2.7MB

                  • memory/3400-500-0x0000000001150000-0x0000000001160000-memory.dmp

                    Filesize

                    64KB

                  • memory/3400-525-0x0000000001150000-0x0000000001160000-memory.dmp

                    Filesize

                    64KB

                  • memory/3400-498-0x0000000001150000-0x0000000001160000-memory.dmp

                    Filesize

                    64KB

                  • memory/3400-499-0x0000000074CB0000-0x0000000075261000-memory.dmp

                    Filesize

                    5.7MB

                  • memory/3400-697-0x0000000074CB0000-0x0000000075261000-memory.dmp

                    Filesize

                    5.7MB

                  • memory/3400-501-0x0000000010E30000-0x0000000013135000-memory.dmp

                    Filesize

                    35.0MB

                  • memory/3400-503-0x0000000001150000-0x0000000001160000-memory.dmp

                    Filesize

                    64KB

                  • memory/3400-504-0x0000000001150000-0x0000000001160000-memory.dmp

                    Filesize

                    64KB

                  • memory/3400-516-0x0000000017330000-0x00000000173FC000-memory.dmp

                    Filesize

                    816KB

                  • memory/3400-518-0x00000000177B0000-0x00000000183D0000-memory.dmp

                    Filesize

                    12.1MB

                  • memory/3400-519-0x00000000177B0000-0x00000000183D0000-memory.dmp

                    Filesize

                    12.1MB

                  • memory/3400-521-0x0000000001150000-0x0000000001160000-memory.dmp

                    Filesize

                    64KB

                  • memory/3400-522-0x00000000177B0000-0x00000000183D0000-memory.dmp

                    Filesize

                    12.1MB

                  • memory/3400-523-0x0000000074CB0000-0x0000000075261000-memory.dmp

                    Filesize

                    5.7MB

                  • memory/3400-524-0x0000000001150000-0x0000000001160000-memory.dmp

                    Filesize

                    64KB

                  • memory/3400-497-0x0000000074CB0000-0x0000000075261000-memory.dmp

                    Filesize

                    5.7MB

                  • memory/3400-526-0x0000000001150000-0x0000000001160000-memory.dmp

                    Filesize

                    64KB

                  • memory/3400-527-0x0000000001150000-0x0000000001160000-memory.dmp

                    Filesize

                    64KB

                  • memory/3400-529-0x0000000001150000-0x0000000001160000-memory.dmp

                    Filesize

                    64KB

                  • memory/3400-530-0x0000000001150000-0x0000000001160000-memory.dmp

                    Filesize

                    64KB

                  • memory/3400-531-0x0000000001150000-0x0000000001160000-memory.dmp

                    Filesize

                    64KB

                  • memory/3400-533-0x0000000001150000-0x0000000001160000-memory.dmp

                    Filesize

                    64KB

                  • memory/3888-18-0x00007FFAFD830000-0x00007FFAFE1D1000-memory.dmp

                    Filesize

                    9.6MB

                  • memory/3888-33-0x0000000020380000-0x00000000203E2000-memory.dmp

                    Filesize

                    392KB

                  • memory/3888-32-0x0000000001950000-0x0000000001960000-memory.dmp

                    Filesize

                    64KB

                  • memory/3888-30-0x000000001CA30000-0x000000001CACC000-memory.dmp

                    Filesize

                    624KB

                  • memory/3888-39-0x00007FFAFD830000-0x00007FFAFE1D1000-memory.dmp

                    Filesize

                    9.6MB

                  • memory/3888-19-0x0000000001950000-0x0000000001960000-memory.dmp

                    Filesize

                    64KB

                  • memory/3888-31-0x00000000018F0000-0x00000000018F8000-memory.dmp

                    Filesize

                    32KB

                  • memory/3888-20-0x00007FFAFD830000-0x00007FFAFE1D1000-memory.dmp

                    Filesize

                    9.6MB

                  • memory/3888-29-0x000000001D090000-0x000000001D55E000-memory.dmp

                    Filesize

                    4.8MB

                  • memory/4188-706-0x0000000010120000-0x000000001097F000-memory.dmp

                    Filesize

                    8.4MB

                  • memory/4188-704-0x0000000074CB0000-0x0000000075261000-memory.dmp

                    Filesize

                    5.7MB

                  • memory/4188-724-0x0000000074CB0000-0x0000000075261000-memory.dmp

                    Filesize

                    5.7MB

                  • memory/4188-717-0x0000000001530000-0x0000000001540000-memory.dmp

                    Filesize

                    64KB

                  • memory/4188-709-0x00000000135C0000-0x00000000158C5000-memory.dmp

                    Filesize

                    35.0MB

                  • memory/4188-708-0x0000000001530000-0x0000000001540000-memory.dmp

                    Filesize

                    64KB

                  • memory/4188-705-0x0000000001530000-0x0000000001540000-memory.dmp

                    Filesize

                    64KB

                  • memory/4284-359-0x0000000072E10000-0x00000000733C1000-memory.dmp

                    Filesize

                    5.7MB

                  • memory/4284-360-0x0000000002600000-0x0000000002610000-memory.dmp

                    Filesize

                    64KB

                  • memory/4284-265-0x0000000072E10000-0x00000000733C1000-memory.dmp

                    Filesize

                    5.7MB

                  • memory/4284-444-0x0000000072E10000-0x00000000733C1000-memory.dmp

                    Filesize

                    5.7MB

                  • memory/4284-266-0x0000000002600000-0x0000000002610000-memory.dmp

                    Filesize

                    64KB

                  • memory/4284-271-0x0000000072E10000-0x00000000733C1000-memory.dmp

                    Filesize

                    5.7MB

                  • memory/5040-479-0x0000000013570000-0x0000000015875000-memory.dmp

                    Filesize

                    35.0MB

                  • memory/5040-477-0x00000000017A0000-0x00000000017B0000-memory.dmp

                    Filesize

                    64KB

                  • memory/5040-449-0x00000000017A0000-0x00000000017B0000-memory.dmp

                    Filesize

                    64KB

                  • memory/5040-450-0x0000000074C10000-0x00000000751C1000-memory.dmp

                    Filesize

                    5.7MB

                  • memory/5040-481-0x00000000017A0000-0x00000000017B0000-memory.dmp

                    Filesize

                    64KB

                  • memory/5040-494-0x0000000074C10000-0x00000000751C1000-memory.dmp

                    Filesize

                    5.7MB

                  • memory/5040-448-0x0000000074C10000-0x00000000751C1000-memory.dmp

                    Filesize

                    5.7MB

                  • memory/5040-466-0x00000000017A0000-0x00000000017B0000-memory.dmp

                    Filesize

                    64KB

                  • memory/5040-478-0x00000000017A0000-0x00000000017B0000-memory.dmp

                    Filesize

                    64KB