qakbot | 91647ac947d5d5d3a0dc69e98070bfc2f9841d7839b579d69c524b02869a497f

Resubmissions

16-10-2020 05:49

201016-1g17p444t6 10

15-10-2020 18:27

201015-k8r5q4zt2a 10

Analysis

max time kernel
601s
max time network
584s
platform
windows7_x64
resource
win7v200722
submitted
16-10-2020 05:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bemaji.exe
Size

135KB
MD5

6cc41d1ccd61ccdb3857703f83959aca
SHA1

caf89ae09f7435dcef4e886b056d020ee34925cf
SHA256

91647ac947d5d5d3a0dc69e98070bfc2f9841d7839b579d69c524b02869a497f
SHA512

4adde26f8e13509a6ead86ebe23b7b45742e4dea5faf364b0559f0b5142b8faa2e8331e79528e60af1e290804e9ebbc29cba94833cede3e723b83b55fd7bcc8e

Score

10^/10

qakbot smokeloader systembc tr01 1602688146 backdoor banker stealer trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

http://sm15sdsd.xyz/

rc4.i32

Extracted

Family

qakbot

Version

325.43

Botnet

tr01

Campaign

1602688146

73.228.1.246:443

74.109.219.145:443

76.111.128.194:443

90.175.88.99:2222

108.191.28.158:443

68.225.60.77:443

75.136.40.155:443

5.193.181.221:2078

72.204.242.138:20

118.160.162.234:443

68.14.210.246:22

148.101.74.12:443

74.222.204.82:443

96.30.198.161:443

140.82.27.132:443

2.50.131.64:443

45.32.155.12:995

45.63.104.123:443

45.32.165.134:443

217.162.149.212:443

Signatures

Qakbot/Qbot
Qbot or Qakbot is a sophisticated worm with banking capabilities.
trojan banker stealer qakbot
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Downloads MZ/PE file
Executes dropped EXE 8 IoCs

Processes:

7446.exe7975.exe7975.exeimrfr.exeftediq.exeftediq.exe7975.exebvaurdr

pid process

1660 7446.exe
1952 7975.exe
1940 7975.exe
1684 imrfr.exe
1060 ftediq.exe
1120 ftediq.exe
1636 7975.exe
2040 bvaurdr
Deletes itself 1 IoCs

Processes:

pid process

1260
Loads dropped DLL 4 IoCs

Processes:

bemaji.exe7975.exe

pid process

1620 bemaji.exe
1952 7975.exe
1952 7975.exe
1952 7975.exe
Drops file in Windows directory 2 IoCs

Processes:

7446.exe

description ioc process

File created C:\Windows\Tasks\imrfr.job 7446.exe
File opened for modification C:\Windows\Tasks\imrfr.job 7446.exe

pid	process
1660	7446.exe
1952	7975.exe
1940	7975.exe
1684	imrfr.exe
1060	ftediq.exe
1120	ftediq.exe
1636	7975.exe
2040	bvaurdr

pid	process
1260

description	ioc	process
File created	C:\Windows\Tasks\imrfr.job	7446.exe
File opened for modification	C:\Windows\Tasks\imrfr.job	7446.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

bemaji.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	bemaji.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	bemaji.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	bemaji.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1016 schtasks.exe
Discovers systems in the same network 1 TTPs 1 IoCs
discovery

Remote System Discovery
T1018

Processes:

net.exe

pid process

1860 net.exe
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command-Line Interface
T1059

Processes:

ipconfig.exenetstat.exe

pid process

1508 ipconfig.exe
980 netstat.exe
Runs net.exe

pid	process
1016	schtasks.exe

pid	process
1860	net.exe

pid	process
1508	ipconfig.exe
980	netstat.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

bemaji.exe

pid	process
1620	bemaji.exe
1620	bemaji.exe
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260

Suspicious behavior: MapViewOfSection 32 IoCs

Processes:

bemaji.exeftediq.exe

pid	process
1620	bemaji.exe
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1260
1060	ftediq.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

Processes:

whoami.exenetstat.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	1260
Token: SeShutdownPrivilege	1260
Token: SeShutdownPrivilege	1260
Token: SeDebugPrivilege	1288	whoami.exe
Token: SeDebugPrivilege	1288	whoami.exe
Token: SeDebugPrivilege	1288	whoami.exe
Token: SeDebugPrivilege	1288	whoami.exe
Token: SeDebugPrivilege	1288	whoami.exe
Token: SeDebugPrivilege	1288	whoami.exe
Token: SeDebugPrivilege	1288	whoami.exe
Token: SeDebugPrivilege	1288	whoami.exe
Token: SeDebugPrivilege	1288	whoami.exe
Token: SeDebugPrivilege	1288	whoami.exe
Token: SeDebugPrivilege	1288	whoami.exe
Token: SeDebugPrivilege	1288	whoami.exe
Token: SeDebugPrivilege	1288	whoami.exe
Token: SeDebugPrivilege	1288	whoami.exe
Token: SeDebugPrivilege	1288	whoami.exe
Token: SeDebugPrivilege	1288	whoami.exe
Token: SeDebugPrivilege	1288	whoami.exe
Token: SeDebugPrivilege	1288	whoami.exe
Token: SeDebugPrivilege	1288	whoami.exe
Token: SeDebugPrivilege	1288	whoami.exe
Token: SeDebugPrivilege	1288	whoami.exe
Token: SeDebugPrivilege	1288	whoami.exe
Token: SeDebugPrivilege	1288	whoami.exe
Token: SeDebugPrivilege	980	netstat.exe
Token: SeRestorePrivilege	1964	msiexec.exe
Token: SeTakeOwnershipPrivilege	1964	msiexec.exe
Token: SeSecurityPrivilege	1964	msiexec.exe

Suspicious use of FindShellTrayWindow 4 IoCs

Processes:

pid process

1260
1260
1260
1260
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

pid process

1260
1260
1260
1260

pid	process
1260
1260
1260
1260

pid	process
1260
1260
1260
1260

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

7975.exe

description	pid	process	target process
PID 1260 wrote to memory of 1660	1260		7446.exe
PID 1260 wrote to memory of 1660	1260		7446.exe
PID 1260 wrote to memory of 1660	1260		7446.exe
PID 1260 wrote to memory of 1660	1260		7446.exe
PID 1260 wrote to memory of 1952	1260		7975.exe
PID 1260 wrote to memory of 1952	1260		7975.exe
PID 1260 wrote to memory of 1952	1260		7975.exe
PID 1260 wrote to memory of 1952	1260		7975.exe
PID 1260 wrote to memory of 1984	1260		explorer.exe
PID 1260 wrote to memory of 1984	1260		explorer.exe
PID 1260 wrote to memory of 1984	1260		explorer.exe
PID 1260 wrote to memory of 1984	1260		explorer.exe
PID 1260 wrote to memory of 1984	1260		explorer.exe
PID 1260 wrote to memory of 1096	1260		explorer.exe
PID 1260 wrote to memory of 1096	1260		explorer.exe
PID 1260 wrote to memory of 1096	1260		explorer.exe
PID 1260 wrote to memory of 1096	1260		explorer.exe
PID 1260 wrote to memory of 1056	1260		explorer.exe
PID 1260 wrote to memory of 1056	1260		explorer.exe
PID 1260 wrote to memory of 1056	1260		explorer.exe
PID 1260 wrote to memory of 1056	1260		explorer.exe
PID 1260 wrote to memory of 1056	1260		explorer.exe
PID 1260 wrote to memory of 1460	1260		explorer.exe
PID 1260 wrote to memory of 1460	1260		explorer.exe
PID 1260 wrote to memory of 1460	1260		explorer.exe
PID 1260 wrote to memory of 1460	1260		explorer.exe
PID 1260 wrote to memory of 1460	1260		explorer.exe
PID 1952 wrote to memory of 1940	1952	7975.exe	7975.exe
PID 1952 wrote to memory of 1940	1952	7975.exe	7975.exe
PID 1952 wrote to memory of 1940	1952	7975.exe	7975.exe
PID 1952 wrote to memory of 1940	1952	7975.exe	7975.exe
PID 1260 wrote to memory of 1036	1260		explorer.exe
PID 1260 wrote to memory of 1036	1260		explorer.exe
PID 1260 wrote to memory of 1036	1260		explorer.exe
PID 1260 wrote to memory of 1036	1260		explorer.exe
PID 1260 wrote to memory of 1036	1260		explorer.exe
PID 1260 wrote to memory of 972	1260		explorer.exe
PID 1260 wrote to memory of 972	1260		explorer.exe
PID 1260 wrote to memory of 972	1260		explorer.exe
PID 1260 wrote to memory of 972	1260		explorer.exe
PID 1260 wrote to memory of 1868	1260		explorer.exe
PID 1260 wrote to memory of 1868	1260		explorer.exe
PID 1260 wrote to memory of 1868	1260		explorer.exe
PID 1260 wrote to memory of 1868	1260		explorer.exe
PID 1260 wrote to memory of 1868	1260		explorer.exe
PID 1260 wrote to memory of 1796	1260		explorer.exe
PID 1260 wrote to memory of 1796	1260		explorer.exe
PID 1260 wrote to memory of 1796	1260		explorer.exe
PID 1260 wrote to memory of 1796	1260		explorer.exe
PID 1260 wrote to memory of 1448	1260		explorer.exe
PID 1260 wrote to memory of 1448	1260		explorer.exe
PID 1260 wrote to memory of 1448	1260		explorer.exe
PID 1260 wrote to memory of 1448	1260		explorer.exe
PID 1260 wrote to memory of 1448	1260		explorer.exe
PID 1260 wrote to memory of 1464	1260		explorer.exe
PID 1260 wrote to memory of 1464	1260		explorer.exe
PID 1260 wrote to memory of 1464	1260		explorer.exe
PID 1260 wrote to memory of 1464	1260		explorer.exe
PID 1260 wrote to memory of 1472	1260		explorer.exe
PID 1260 wrote to memory of 1472	1260		explorer.exe
PID 1260 wrote to memory of 1472	1260		explorer.exe
PID 1260 wrote to memory of 1472	1260		explorer.exe
PID 1260 wrote to memory of 1472	1260		explorer.exe
PID 1260 wrote to memory of 1232	1260		explorer.exe

C:\Users\Admin\AppData\Local\Temp\bemaji.exe
"C:\Users\Admin\AppData\Local\Temp\bemaji.exe"
1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1620

C:\Users\Admin\AppData\Local\Temp\7446.exe
C:\Users\Admin\AppData\Local\Temp\7446.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1660

C:\Users\Admin\AppData\Local\Temp\7975.exe
C:\Users\Admin\AppData\Local\Temp\7975.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1952

C:\Users\Admin\AppData\Local\Temp\7975.exe
C:\Users\Admin\AppData\Local\Temp\7975.exe /C
2⤵
- Executes dropped EXE
PID:1940

C:\Users\Admin\AppData\Roaming\Microsoft\Lasmia\ftediq.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Lasmia\ftediq.exe
2⤵
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
PID:1060

C:\Users\Admin\AppData\Roaming\Microsoft\Lasmia\ftediq.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Lasmia\ftediq.exe /C
3⤵
- Executes dropped EXE
PID:1120

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
3⤵
PID:1880

C:\Windows\SysWOW64\whoami.exe
whoami /all
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1288

C:\Windows\SysWOW64\cmd.exe
cmd /c set
4⤵
PID:1936

C:\Windows\SysWOW64\arp.exe
arp -a
4⤵
PID:1632

C:\Windows\SysWOW64\ipconfig.exe
ipconfig /all
4⤵
- Gathers network information
PID:1508

C:\Windows\SysWOW64\net.exe
net view /all
4⤵
- Discovers systems in the same network
PID:1860

C:\Windows\SysWOW64\nslookup.exe
nslookup -querytype=ALL -timeout=10 _ldap._tcp.dc._msdcs.WORKGROUP
4⤵
PID:1792

C:\Windows\SysWOW64\net.exe
net share
4⤵
PID:1772

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 share
5⤵
PID:284

C:\Windows\SysWOW64\route.exe
route print
4⤵
PID:1512

C:\Windows\SysWOW64\netstat.exe
netstat -nao
4⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:980

C:\Windows\SysWOW64\net.exe
net localgroup
4⤵
PID:1664

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 localgroup
5⤵
PID:1944

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn ttwppwxpp /tr "\"C:\Users\Admin\AppData\Local\Temp\7975.exe\" /I ttwppwxpp" /SC ONCE /Z /ST 07:50 /ET 08:02
2⤵
- Creates scheduled task(s)
PID:1016

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1984

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1096

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1056

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1460

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1036

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:972

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1868

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1796

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1448

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1464

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1472

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1232

C:\Windows\system32\taskeng.exe
taskeng.exe {A48D6D48-A97B-477C-B8B7-40F71382DF4E} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:616

C:\ProgramData\wievw\imrfr.exe
C:\ProgramData\wievw\imrfr.exe start
2⤵
- Executes dropped EXE
PID:1684

C:\Users\Admin\AppData\Local\Temp\7975.exe
C:\Users\Admin\AppData\Local\Temp\7975.exe /I ttwppwxpp
2⤵
- Executes dropped EXE
PID:1636

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:812

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:1048

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1032

C:\Windows\system32\taskeng.exe
taskeng.exe {2110440D-51AA-4247-B4B7-3A237D40442F} S-1-5-21-2090973689-680783404-4292415065-1000:UCQFZDUI\Admin:Interactive:[1]
1⤵
PID:1944

C:\Users\Admin\AppData\Roaming\bvaurdr
C:\Users\Admin\AppData\Roaming\bvaurdr
2⤵
- Executes dropped EXE
PID:2040

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1964

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Command-Line Interface

T1059

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\wievw\imrfr.exe
MD5
4aef5f2ad701e545419482a46082c65e

SHA1
71db3e124cd78d00edfc5f96a5da48f372e0f97e

SHA256
30c8db3998286b76d7a50407b167b298c17c8861ecfd62e75244c6af1513eb29

SHA512
256202cda772da29bbc2b6a90d06970aa64913bbf806d76fafa8b6bc5493a3b2ad51f9c6d1307dab5218a8f9315c16a2298821d4897f560f9809ff60bab44865

Download Submit
C:\ProgramData\wievw\imrfr.exe
MD5
4aef5f2ad701e545419482a46082c65e

SHA1
71db3e124cd78d00edfc5f96a5da48f372e0f97e

SHA256
30c8db3998286b76d7a50407b167b298c17c8861ecfd62e75244c6af1513eb29

SHA512
256202cda772da29bbc2b6a90d06970aa64913bbf806d76fafa8b6bc5493a3b2ad51f9c6d1307dab5218a8f9315c16a2298821d4897f560f9809ff60bab44865

Download Submit
C:\Users\Admin\AppData\Local\Temp\554B.tmp
MD5
d124f55b9393c976963407dff51ffa79

SHA1
2c7bbedd79791bfb866898c85b504186db610b5d

SHA256
ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

SHA512
278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

Download Submit
C:\Users\Admin\AppData\Local\Temp\7446.exe
MD5
4aef5f2ad701e545419482a46082c65e

SHA1
71db3e124cd78d00edfc5f96a5da48f372e0f97e

SHA256
30c8db3998286b76d7a50407b167b298c17c8861ecfd62e75244c6af1513eb29

SHA512
256202cda772da29bbc2b6a90d06970aa64913bbf806d76fafa8b6bc5493a3b2ad51f9c6d1307dab5218a8f9315c16a2298821d4897f560f9809ff60bab44865

Download Submit
C:\Users\Admin\AppData\Local\Temp\7446.exe
MD5
4aef5f2ad701e545419482a46082c65e

SHA1
71db3e124cd78d00edfc5f96a5da48f372e0f97e

SHA256
30c8db3998286b76d7a50407b167b298c17c8861ecfd62e75244c6af1513eb29

SHA512
256202cda772da29bbc2b6a90d06970aa64913bbf806d76fafa8b6bc5493a3b2ad51f9c6d1307dab5218a8f9315c16a2298821d4897f560f9809ff60bab44865

Download Submit
C:\Users\Admin\AppData\Local\Temp\7975.exe
MD5
026f2b7b0dd8684b6589befa6c2f338b

SHA1
4f6f4f805e1f676c48cd3df5a0574b41f1e32b7f

SHA256
a87d4a2718ab0a23c77fc887891f13ccc1ea4def9d8e4c3bba1f7da9057349cb

SHA512
b1d2eb2865380e60830b1cfaa22f665e2e6dcadbfc1dd90bae94eb8a856652f75911a67143cce3894f9ea22f32fff83c27a420a8468b095b71ef3439d57a0d1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7975.exe
MD5
026f2b7b0dd8684b6589befa6c2f338b

SHA1
4f6f4f805e1f676c48cd3df5a0574b41f1e32b7f

SHA256
a87d4a2718ab0a23c77fc887891f13ccc1ea4def9d8e4c3bba1f7da9057349cb

SHA512
b1d2eb2865380e60830b1cfaa22f665e2e6dcadbfc1dd90bae94eb8a856652f75911a67143cce3894f9ea22f32fff83c27a420a8468b095b71ef3439d57a0d1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7975.exe
MD5
026f2b7b0dd8684b6589befa6c2f338b

SHA1
4f6f4f805e1f676c48cd3df5a0574b41f1e32b7f

SHA256
a87d4a2718ab0a23c77fc887891f13ccc1ea4def9d8e4c3bba1f7da9057349cb

SHA512
b1d2eb2865380e60830b1cfaa22f665e2e6dcadbfc1dd90bae94eb8a856652f75911a67143cce3894f9ea22f32fff83c27a420a8468b095b71ef3439d57a0d1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7975.exe
MD5
026f2b7b0dd8684b6589befa6c2f338b

SHA1
4f6f4f805e1f676c48cd3df5a0574b41f1e32b7f

SHA256
a87d4a2718ab0a23c77fc887891f13ccc1ea4def9d8e4c3bba1f7da9057349cb

SHA512
b1d2eb2865380e60830b1cfaa22f665e2e6dcadbfc1dd90bae94eb8a856652f75911a67143cce3894f9ea22f32fff83c27a420a8468b095b71ef3439d57a0d1d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Lasmia\ftediq.dat
MD5
4ad9100b2c8312e7a195101b9e773689

SHA1
a2ca6106b4385ac1d42a41bddb31cfa458f62d3d

SHA256
6dd743b3e51a3fde820e792db43756b797eb32a6988c4a15cfc6ea95b2c32766

SHA512
a613c66d57158734832b62b7e4a854a62fe702c0e3d8e69cc7a6ea9e88f4a54640bed0a3230adf8f3cec8d2c7d60af04905317e2303fe93aedf1a70efb3d64b7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Lasmia\ftediq.exe
MD5
026f2b7b0dd8684b6589befa6c2f338b

SHA1
4f6f4f805e1f676c48cd3df5a0574b41f1e32b7f

SHA256
a87d4a2718ab0a23c77fc887891f13ccc1ea4def9d8e4c3bba1f7da9057349cb

SHA512
b1d2eb2865380e60830b1cfaa22f665e2e6dcadbfc1dd90bae94eb8a856652f75911a67143cce3894f9ea22f32fff83c27a420a8468b095b71ef3439d57a0d1d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Lasmia\ftediq.exe
MD5
026f2b7b0dd8684b6589befa6c2f338b

SHA1
4f6f4f805e1f676c48cd3df5a0574b41f1e32b7f

SHA256
a87d4a2718ab0a23c77fc887891f13ccc1ea4def9d8e4c3bba1f7da9057349cb

SHA512
b1d2eb2865380e60830b1cfaa22f665e2e6dcadbfc1dd90bae94eb8a856652f75911a67143cce3894f9ea22f32fff83c27a420a8468b095b71ef3439d57a0d1d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Lasmia\ftediq.exe
MD5
026f2b7b0dd8684b6589befa6c2f338b

SHA1
4f6f4f805e1f676c48cd3df5a0574b41f1e32b7f

SHA256
a87d4a2718ab0a23c77fc887891f13ccc1ea4def9d8e4c3bba1f7da9057349cb

SHA512
b1d2eb2865380e60830b1cfaa22f665e2e6dcadbfc1dd90bae94eb8a856652f75911a67143cce3894f9ea22f32fff83c27a420a8468b095b71ef3439d57a0d1d

Download Submit
C:\Users\Admin\AppData\Roaming\bvaurdr
MD5
6cc41d1ccd61ccdb3857703f83959aca

SHA1
caf89ae09f7435dcef4e886b056d020ee34925cf

SHA256
91647ac947d5d5d3a0dc69e98070bfc2f9841d7839b579d69c524b02869a497f

SHA512
4adde26f8e13509a6ead86ebe23b7b45742e4dea5faf364b0559f0b5142b8faa2e8331e79528e60af1e290804e9ebbc29cba94833cede3e723b83b55fd7bcc8e

Download Submit
C:\Users\Admin\AppData\Roaming\bvaurdr
MD5
6cc41d1ccd61ccdb3857703f83959aca

SHA1
caf89ae09f7435dcef4e886b056d020ee34925cf

SHA256
91647ac947d5d5d3a0dc69e98070bfc2f9841d7839b579d69c524b02869a497f

SHA512
4adde26f8e13509a6ead86ebe23b7b45742e4dea5faf364b0559f0b5142b8faa2e8331e79528e60af1e290804e9ebbc29cba94833cede3e723b83b55fd7bcc8e

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\PIPE\wkssvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\554B.tmp
MD5
d124f55b9393c976963407dff51ffa79

SHA1
2c7bbedd79791bfb866898c85b504186db610b5d

SHA256
ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

SHA512
278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

Download Submit
\Users\Admin\AppData\Local\Temp\7975.exe
MD5
026f2b7b0dd8684b6589befa6c2f338b

SHA1
4f6f4f805e1f676c48cd3df5a0574b41f1e32b7f

SHA256
a87d4a2718ab0a23c77fc887891f13ccc1ea4def9d8e4c3bba1f7da9057349cb

SHA512
b1d2eb2865380e60830b1cfaa22f665e2e6dcadbfc1dd90bae94eb8a856652f75911a67143cce3894f9ea22f32fff83c27a420a8468b095b71ef3439d57a0d1d

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Lasmia\ftediq.exe
MD5
026f2b7b0dd8684b6589befa6c2f338b

SHA1
4f6f4f805e1f676c48cd3df5a0574b41f1e32b7f

SHA256
a87d4a2718ab0a23c77fc887891f13ccc1ea4def9d8e4c3bba1f7da9057349cb

SHA512
b1d2eb2865380e60830b1cfaa22f665e2e6dcadbfc1dd90bae94eb8a856652f75911a67143cce3894f9ea22f32fff83c27a420a8468b095b71ef3439d57a0d1d

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Lasmia\ftediq.exe
MD5
026f2b7b0dd8684b6589befa6c2f338b

SHA1
4f6f4f805e1f676c48cd3df5a0574b41f1e32b7f

SHA256
a87d4a2718ab0a23c77fc887891f13ccc1ea4def9d8e4c3bba1f7da9057349cb

SHA512
b1d2eb2865380e60830b1cfaa22f665e2e6dcadbfc1dd90bae94eb8a856652f75911a67143cce3894f9ea22f32fff83c27a420a8468b095b71ef3439d57a0d1d

Download Submit
memory/284-1549-0x0000000000000000-mapping.dmp

Download
memory/812-701-0x00000000000C0000-0x00000000000CB000-memory.dmp

Filesize
44KB

Download
memory/812-700-0x0000000000000000-mapping.dmp

Download
memory/972-248-0x0000000000060000-0x000000000006E000-memory.dmp

Filesize
56KB

Download
memory/972-239-0x0000000000000000-mapping.dmp

Download
memory/972-251-0x0000000000070000-0x0000000000079000-memory.dmp

Filesize
36KB

Download
memory/980-1551-0x0000000000000000-mapping.dmp

Download
memory/1016-1225-0x0000000000000000-mapping.dmp

Download
memory/1032-903-0x0000000000090000-0x0000000000098000-memory.dmp

Filesize
32KB

Download
memory/1032-894-0x0000000000000000-mapping.dmp

Download
memory/1032-900-0x0000000000080000-0x000000000008C000-memory.dmp

Filesize
48KB

Download
memory/1036-199-0x0000000000090000-0x0000000000097000-memory.dmp

Filesize
28KB

Download
memory/1036-197-0x0000000000080000-0x000000000008B000-memory.dmp

Filesize
44KB

Download
memory/1036-192-0x0000000000000000-mapping.dmp

Download
memory/1048-841-0x00000000000E0000-0x00000000000ED000-memory.dmp

Filesize
52KB

Download
memory/1048-838-0x0000000000000000-mapping.dmp

Download
memory/1048-843-0x00000000000F0000-0x00000000000F7000-memory.dmp

Filesize
28KB

Download
memory/1056-82-0x00000000000C0000-0x00000000000C9000-memory.dmp

Filesize
36KB

Download
memory/1056-81-0x0000000000000000-mapping.dmp

Download
memory/1056-83-0x00000000000D0000-0x00000000000D4000-memory.dmp

Filesize
16KB

Download
memory/1060-1280-0x0000000001E60000-0x0000000001E97000-memory.dmp

Filesize
220KB

Download
memory/1060-1220-0x0000000000000000-mapping.dmp

Download
memory/1096-21-0x0000000000070000-0x0000000000077000-memory.dmp

Filesize
28KB

Download
memory/1096-20-0x0000000000060000-0x000000000006C000-memory.dmp

Filesize
48KB

Download
memory/1096-19-0x0000000000000000-mapping.dmp

Download
memory/1120-1250-0x0000000000000000-mapping.dmp

Download
memory/1120-1279-0x00000000026F0000-0x0000000002701000-memory.dmp

Filesize
68KB

Download
memory/1232-540-0x0000000000000000-mapping.dmp

Download
memory/1232-541-0x00000000000C0000-0x00000000000C9000-memory.dmp

Filesize
36KB

Download
memory/1232-542-0x00000000000D0000-0x00000000000D5000-memory.dmp

Filesize
20KB

Download
memory/1260-994-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-862-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-3-0x0000000002C20000-0x0000000002C36000-memory.dmp

Filesize
88KB

Download
memory/1260-23-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-24-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-141-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-140-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-79-0x0000000002A80000-0x0000000002A87000-memory.dmp

Filesize
28KB

Download
memory/1260-234-0x0000000002A90000-0x0000000002A9B000-memory.dmp

Filesize
44KB

Download
memory/1260-49-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-48-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-47-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-25-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-26-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-27-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-28-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-29-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-30-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-46-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-375-0x0000000002A90000-0x0000000002A99000-memory.dmp

Filesize
36KB

Download
memory/1260-31-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-32-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-1128-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-423-0x0000000002A90000-0x0000000002A99000-memory.dmp

Filesize
36KB

Download
memory/1260-1126-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-1127-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-1125-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-478-0x0000000002A90000-0x0000000002A99000-memory.dmp

Filesize
36KB

Download
memory/1260-1124-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-1123-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-1122-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-45-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-44-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-43-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-584-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-585-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-586-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-587-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-588-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-589-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-590-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-591-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-592-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-593-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-594-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-595-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-596-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-597-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-598-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-599-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-600-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-601-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-602-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-603-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-604-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-605-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-606-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-608-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-607-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-609-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-610-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-611-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-612-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-613-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-614-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-615-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-616-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-617-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-618-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-619-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-660-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-661-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-662-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-663-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-664-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-665-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-666-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-667-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-668-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-669-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-670-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-671-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-672-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-673-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-674-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-675-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-676-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-677-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-678-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-679-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-680-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-681-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-682-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-683-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-684-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-685-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-686-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-687-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-689-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-688-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-690-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-691-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-692-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-693-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-694-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-695-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-696-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-698-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-699-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-42-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-41-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-40-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-1121-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-39-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-1120-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-1119-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-1118-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-831-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-832-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-833-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-837-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-834-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-38-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-839-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-840-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-37-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-842-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-36-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-844-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-846-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-848-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-850-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-852-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-854-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-856-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-858-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-860-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-1117-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-864-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-866-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-868-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-870-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-872-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-874-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-876-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-878-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-880-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-882-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-884-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-886-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-890-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-893-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-34-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-896-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-898-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-35-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-901-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-33-0x0000000002A80000-0x0000000002A84000-memory.dmp

Filesize
16KB

Download
memory/1260-904-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-905-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-907-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-963-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-964-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-965-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-966-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-967-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-968-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-969-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-970-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-971-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-972-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-973-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-974-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-975-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-976-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-977-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-978-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-979-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-980-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-981-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-982-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-983-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-984-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-985-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-986-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-988-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-987-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-989-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-990-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-991-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-992-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-993-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-1116-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-995-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-996-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-997-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-998-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-999-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-1000-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-1001-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-1002-0x0000000002A80000-0x0000000002A85000-memory.dmp

Filesize
20KB

Download
memory/1260-1089-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-1090-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-1091-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-1092-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-1093-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-1094-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-1095-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-1096-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-1097-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-1098-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-1099-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-1100-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-1102-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-1101-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-1103-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-1104-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-1105-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-1106-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-1107-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-1108-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-1109-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-1110-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-1111-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-1112-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-1113-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-1115-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1260-1114-0x0000000002A80000-0x0000000002A86000-memory.dmp

Filesize
24KB

Download
memory/1288-1542-0x0000000000000000-mapping.dmp

Download
memory/1448-381-0x0000000000000000-mapping.dmp

Download
memory/1448-386-0x0000000000080000-0x0000000000089000-memory.dmp

Filesize
36KB

Download
memory/1448-389-0x0000000000090000-0x0000000000094000-memory.dmp

Filesize
16KB

Download
memory/1460-142-0x0000000000000000-mapping.dmp

Download
memory/1460-145-0x0000000000090000-0x000000000009A000-memory.dmp

Filesize
40KB

Download
memory/1460-143-0x0000000000080000-0x000000000008B000-memory.dmp

Filesize
44KB

Download
memory/1464-436-0x0000000000070000-0x0000000000075000-memory.dmp

Filesize
20KB

Download
memory/1464-434-0x0000000000060000-0x0000000000069000-memory.dmp

Filesize
36KB

Download
memory/1464-429-0x0000000000000000-mapping.dmp

Download
memory/1472-482-0x0000000000000000-mapping.dmp

Download
memory/1472-490-0x0000000000080000-0x00000000000A7000-memory.dmp

Filesize
156KB

Download
memory/1472-497-0x00000000000B0000-0x00000000000D2000-memory.dmp

Filesize
136KB

Download
memory/1508-1545-0x0000000000000000-mapping.dmp

Download
memory/1512-1550-0x0000000000000000-mapping.dmp

Download
memory/1620-0-0x0000000000A7B000-0x0000000000A7C000-memory.dmp

Filesize
4KB

Download
memory/1620-1-0x00000000020F0000-0x0000000002101000-memory.dmp

Filesize
68KB

Download
memory/1632-1544-0x0000000000000000-mapping.dmp

Download
memory/1636-1533-0x0000000000000000-mapping.dmp

Download
memory/1660-4-0x0000000000000000-mapping.dmp

Download
memory/1660-6-0x0000000000D45000-0x0000000000D46000-memory.dmp

Filesize
4KB

Download
memory/1660-7-0x0000000000F60000-0x0000000000F71000-memory.dmp

Filesize
68KB

Download
memory/1664-1552-0x0000000000000000-mapping.dmp

Download
memory/1684-758-0x0000000001180000-0x0000000001191000-memory.dmp

Filesize
68KB

Download
memory/1684-744-0x0000000000000000-mapping.dmp

Download
memory/1684-756-0x0000000000D75000-0x0000000000D76000-memory.dmp

Filesize
4KB

Download
memory/1772-1548-0x0000000000000000-mapping.dmp

Download
memory/1792-1547-0x0000000000000000-mapping.dmp

Download
memory/1796-341-0x0000000000060000-0x000000000006C000-memory.dmp

Filesize
48KB

Download
memory/1796-345-0x0000000000070000-0x0000000000076000-memory.dmp

Filesize
24KB

Download
memory/1796-334-0x0000000000000000-mapping.dmp

Download
memory/1860-1546-0x0000000000000000-mapping.dmp

Download
memory/1868-277-0x0000000000000000-mapping.dmp

Download
memory/1868-279-0x00000000000C0000-0x00000000000C9000-memory.dmp

Filesize
36KB

Download
memory/1868-281-0x00000000000D0000-0x00000000000D5000-memory.dmp

Filesize
20KB

Download
memory/1880-1281-0x0000000000000000-mapping.dmp

Download
memory/1936-1543-0x0000000000000000-mapping.dmp

Download
memory/1940-188-0x0000000000000000-mapping.dmp

Download
memory/1940-746-0x0000000002640000-0x0000000002651000-memory.dmp

Filesize
68KB

Download
memory/1944-1553-0x0000000000000000-mapping.dmp

Download
memory/1952-8-0x0000000000000000-mapping.dmp

Download
memory/1984-10-0x0000000000000000-mapping.dmp

Download
memory/1984-11-0x0000000000110000-0x000000000017B000-memory.dmp

Filesize
428KB

Download
memory/1984-12-0x0000000000220000-0x0000000000295000-memory.dmp

Filesize
468KB

Download
memory/2020-1554-0x000007FEF8510000-0x000007FEF878A000-memory.dmp

Filesize
2.5MB

Download
memory/2040-1539-0x0000000002380000-0x0000000002391000-memory.dmp

Filesize
68KB

Download
memory/2040-1538-0x00000000009BB000-0x00000000009BC000-memory.dmp

Filesize
4KB

Download
memory/2040-1536-0x0000000000000000-mapping.dmp

Download