Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    162s
  • max time network
    194s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    26/09/2022, 03:34

General

  • Target

    AppWizardSetup_1.97.19.exe

  • Size

    10.0MB

  • MD5

    677ddda900f89500cfc039c3bf5ba9f7

  • SHA1

    295ba9b84a4353aa3df196558449dc37b448aa02

  • SHA256

    b100a8cb051da84ce2be6f80cd9d298907af9cf6d7c01ee8ed1b91149b713417

  • SHA512

    6b970c9c986e728a06d8ed58766d4e5eaec0bfe4e5c1a0c97c3364aee3ac01e47d42d82c5eff12f3870bfcc34ea4f5492b2c2a9521a350df2bcf584df7d6f9fb

  • SSDEEP

    196608:wbxLIVzWN6fvobkIOgewBQvKKr3AMkY+pEz2AkzjCFpJqVT/7nzUHAe:CKzWN6faOmccMiEvkXKWVLLzkAe

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 16 IoCs
  • Loads dropped DLL 37 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 18 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies system certificate store 2 TTPs 6 IoCs
  • Script User-Agent 3 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of UnmapMainImage 19 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of UnmapMainImage
    PID:1216
    • C:\Users\Admin\AppData\Local\Temp\AppWizardSetup_1.97.19.exe
      "C:\Users\Admin\AppData\Local\Temp\AppWizardSetup_1.97.19.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1048
      • C:\Users\Admin\AppData\Local\Temp\is-VMCEE.tmp\AppWizardSetup_1.97.19.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-VMCEE.tmp\AppWizardSetup_1.97.19.tmp" /SL5="$60122,9685758,726016,C:\Users\Admin\AppData\Local\Temp\AppWizardSetup_1.97.19.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1996
        • C:\Program Files (x86)\AppWizard\AppWizard.exe
          "C:\Program Files (x86)\AppWizard\AppWizard.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:1328
        • C:\Users\Admin\AppData\Local\Temp\is-HA4EB.tmp\downloader.exe
          "C:\Users\Admin\AppData\Local\Temp\is-HA4EB.tmp\downloader.exe" --sync --partner 28178 --distr /quiet /msicl "YABROWSER=y YAHOMEPAGE=y YAQSEARCH=y VID=847"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:992
          • C:\Users\Admin\AppData\Local\Temp\is-HA4EB.tmp\downloader.exe
            C:\Users\Admin\AppData\Local\Temp\is-HA4EB.tmp\downloader.exe --stat dwnldr/p=28178/fail=1
            5⤵
            • Executes dropped EXE
            PID:1936
        • C:\Program Files (x86)\AppWizard\syspin.exe
          "C:\Program Files (x86)\AppWizard\syspin.exe" "C:\Users\Admin\Desktop\World of Warships.lnk" 5386
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1848
        • C:\Program Files (x86)\AppWizard\syspin.exe
          "C:\Program Files (x86)\AppWizard\syspin.exe" "C:\Users\Admin\Desktop\World of Warships.lnk" 51201
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:540
        • C:\Program Files (x86)\AppWizard\syspin.exe
          "C:\Program Files (x86)\AppWizard\syspin.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\World of Warships.lnk" 5386
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1768
        • C:\Program Files (x86)\AppWizard\syspin.exe
          "C:\Program Files (x86)\AppWizard\syspin.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\World of Warships.lnk" 51201
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1964
        • C:\Program Files (x86)\AppWizard\syspin.exe
          "C:\Program Files (x86)\AppWizard\syspin.exe" "C:\Users\Admin\Desktop\Crossout.lnk" 5386
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1660
        • C:\Program Files (x86)\AppWizard\syspin.exe
          "C:\Program Files (x86)\AppWizard\syspin.exe" "C:\Users\Admin\Desktop\Crossout.lnk" 51201
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1636
        • C:\Program Files (x86)\AppWizard\syspin.exe
          "C:\Program Files (x86)\AppWizard\syspin.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Crossout.lnk" 5386
          4⤵
          • Executes dropped EXE
          PID:972
        • C:\Program Files (x86)\AppWizard\syspin.exe
          "C:\Program Files (x86)\AppWizard\syspin.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Crossout.lnk" 51201
          4⤵
          • Executes dropped EXE
          PID:1248
        • C:\Program Files (x86)\AppWizard\syspin.exe
          "C:\Program Files (x86)\AppWizard\syspin.exe" "C:\Users\Admin\Desktop\War Thunder.lnk" 5386
          4⤵
          • Executes dropped EXE
          PID:924
        • C:\Program Files (x86)\AppWizard\syspin.exe
          "C:\Program Files (x86)\AppWizard\syspin.exe" "C:\Users\Admin\Desktop\War Thunder.lnk" 51201
          4⤵
          • Executes dropped EXE
          PID:784
        • C:\Program Files (x86)\AppWizard\syspin.exe
          "C:\Program Files (x86)\AppWizard\syspin.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\War Thunder.lnk" 5386
          4⤵
          • Executes dropped EXE
          PID:1708
        • C:\Program Files (x86)\AppWizard\syspin.exe
          "C:\Program Files (x86)\AppWizard\syspin.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\War Thunder.lnk" 51201
          4⤵
          • Executes dropped EXE
          PID:612

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\AppWizard\AppWizard.exe

    Filesize

    12.5MB

    MD5

    ffa9ada8b78f6b9f46f6b7d1d320f25e

    SHA1

    b4a9600075e14607dba960d954f769a90d08f323

    SHA256

    5b282bc459953786f637d6888c3e9ec3c4dd348759dcb132aa48560241b8235f

    SHA512

    bf82c7a1f9a76b1f44bc00f08c475151f44a13f061a59b79ec35a3bb2ea9cf9c49c376cb9a6ca347e0ee495a3169cd9fb1e82e679ba2a5523ce672ffa9d889dd

  • C:\Program Files (x86)\AppWizard\AppWizard.exe

    Filesize

    12.5MB

    MD5

    ffa9ada8b78f6b9f46f6b7d1d320f25e

    SHA1

    b4a9600075e14607dba960d954f769a90d08f323

    SHA256

    5b282bc459953786f637d6888c3e9ec3c4dd348759dcb132aa48560241b8235f

    SHA512

    bf82c7a1f9a76b1f44bc00f08c475151f44a13f061a59b79ec35a3bb2ea9cf9c49c376cb9a6ca347e0ee495a3169cd9fb1e82e679ba2a5523ce672ffa9d889dd

  • C:\Program Files (x86)\AppWizard\CROSSOUT.ico

    Filesize

    102KB

    MD5

    1716ea325b5a0426a9d0d3b8f46e9ebb

    SHA1

    7be6a62db7e76971f95899e1a61bbd1b30390de5

    SHA256

    0a56962379cfab01a4492d4ccbb45d7257e493a2f778d0f1a00a050789546a6f

    SHA512

    26f4aa571469a5bd0fddd122af43d05faddeb65537b93ce68397b2a0edc87d7d18ac9e0a9ac1372113777c3173da5cfd65032e16306f88432d3faddaa4c7e761

  • C:\Program Files (x86)\AppWizard\WAR_THUNDER.ico

    Filesize

    71KB

    MD5

    6d25c407ba5ec6bb6fa34c3f0d169f6c

    SHA1

    23a2c0585adac519b7afc333a8b81c4e560fc06e

    SHA256

    a657a3d6bf520b6629500d5eddfae332f09566a1904494283ece409000ff7586

    SHA512

    de17dd001bd70a786eae28ed079f3ebd993efcaa69174230f842252d36507c80657900dc0f9379c3f7cf9d82364a3ca66465c43fd64be438a02f4317a1e09ece

  • C:\Program Files (x86)\AppWizard\WORLD_OF_WARSHIPS.ico

    Filesize

    66KB

    MD5

    570761a7e30d245758db8c897d9b4008

    SHA1

    2fe8f0045bc3f1549297d553999aac31500902a6

    SHA256

    9ccc82983e136a630f65b937c8b69d34b6b31b57d3a1862511bc6e7a6f882bb4

    SHA512

    65b2a5500382ab579f5e93bb5137bc540c5d4a4b8c63accfb8210a0577e10e8ba530bf7c858ed7e254747b383e8eff53b6dc5187a3ebc2455d081ef858109131

  • C:\Program Files (x86)\AppWizard\syspin.exe

    Filesize

    19KB

    MD5

    2a2562abc95e695eab3eeffbe16ead5f

    SHA1

    b72a07d05e0d8f07b7c06312c34b7cf26920a6b3

    SHA256

    07d6c3a19a8e3e243e9545a41dd30a9ee1e9ad79cdd6d446c229d689e5ab574a

    SHA512

    4aa9598ffa686aca161532a60341a226052ca2c7beaf0f864009f5b92c8e45aa1738b3b17c9a02b3d9140eef74c06ff8c9e7a42dc9e47d1951ec9bbc588628e2

  • C:\Program Files (x86)\AppWizard\syspin.exe

    Filesize

    19KB

    MD5

    2a2562abc95e695eab3eeffbe16ead5f

    SHA1

    b72a07d05e0d8f07b7c06312c34b7cf26920a6b3

    SHA256

    07d6c3a19a8e3e243e9545a41dd30a9ee1e9ad79cdd6d446c229d689e5ab574a

    SHA512

    4aa9598ffa686aca161532a60341a226052ca2c7beaf0f864009f5b92c8e45aa1738b3b17c9a02b3d9140eef74c06ff8c9e7a42dc9e47d1951ec9bbc588628e2

  • C:\Program Files (x86)\AppWizard\syspin.exe

    Filesize

    19KB

    MD5

    2a2562abc95e695eab3eeffbe16ead5f

    SHA1

    b72a07d05e0d8f07b7c06312c34b7cf26920a6b3

    SHA256

    07d6c3a19a8e3e243e9545a41dd30a9ee1e9ad79cdd6d446c229d689e5ab574a

    SHA512

    4aa9598ffa686aca161532a60341a226052ca2c7beaf0f864009f5b92c8e45aa1738b3b17c9a02b3d9140eef74c06ff8c9e7a42dc9e47d1951ec9bbc588628e2

  • C:\Program Files (x86)\AppWizard\syspin.exe

    Filesize

    19KB

    MD5

    2a2562abc95e695eab3eeffbe16ead5f

    SHA1

    b72a07d05e0d8f07b7c06312c34b7cf26920a6b3

    SHA256

    07d6c3a19a8e3e243e9545a41dd30a9ee1e9ad79cdd6d446c229d689e5ab574a

    SHA512

    4aa9598ffa686aca161532a60341a226052ca2c7beaf0f864009f5b92c8e45aa1738b3b17c9a02b3d9140eef74c06ff8c9e7a42dc9e47d1951ec9bbc588628e2

  • C:\Program Files (x86)\AppWizard\syspin.exe

    Filesize

    19KB

    MD5

    2a2562abc95e695eab3eeffbe16ead5f

    SHA1

    b72a07d05e0d8f07b7c06312c34b7cf26920a6b3

    SHA256

    07d6c3a19a8e3e243e9545a41dd30a9ee1e9ad79cdd6d446c229d689e5ab574a

    SHA512

    4aa9598ffa686aca161532a60341a226052ca2c7beaf0f864009f5b92c8e45aa1738b3b17c9a02b3d9140eef74c06ff8c9e7a42dc9e47d1951ec9bbc588628e2

  • C:\Program Files (x86)\AppWizard\syspin.exe

    Filesize

    19KB

    MD5

    2a2562abc95e695eab3eeffbe16ead5f

    SHA1

    b72a07d05e0d8f07b7c06312c34b7cf26920a6b3

    SHA256

    07d6c3a19a8e3e243e9545a41dd30a9ee1e9ad79cdd6d446c229d689e5ab574a

    SHA512

    4aa9598ffa686aca161532a60341a226052ca2c7beaf0f864009f5b92c8e45aa1738b3b17c9a02b3d9140eef74c06ff8c9e7a42dc9e47d1951ec9bbc588628e2

  • C:\Program Files (x86)\AppWizard\syspin.exe

    Filesize

    19KB

    MD5

    2a2562abc95e695eab3eeffbe16ead5f

    SHA1

    b72a07d05e0d8f07b7c06312c34b7cf26920a6b3

    SHA256

    07d6c3a19a8e3e243e9545a41dd30a9ee1e9ad79cdd6d446c229d689e5ab574a

    SHA512

    4aa9598ffa686aca161532a60341a226052ca2c7beaf0f864009f5b92c8e45aa1738b3b17c9a02b3d9140eef74c06ff8c9e7a42dc9e47d1951ec9bbc588628e2

  • C:\Program Files (x86)\AppWizard\syspin.exe

    Filesize

    19KB

    MD5

    2a2562abc95e695eab3eeffbe16ead5f

    SHA1

    b72a07d05e0d8f07b7c06312c34b7cf26920a6b3

    SHA256

    07d6c3a19a8e3e243e9545a41dd30a9ee1e9ad79cdd6d446c229d689e5ab574a

    SHA512

    4aa9598ffa686aca161532a60341a226052ca2c7beaf0f864009f5b92c8e45aa1738b3b17c9a02b3d9140eef74c06ff8c9e7a42dc9e47d1951ec9bbc588628e2

  • C:\Program Files (x86)\AppWizard\syspin.exe

    Filesize

    19KB

    MD5

    2a2562abc95e695eab3eeffbe16ead5f

    SHA1

    b72a07d05e0d8f07b7c06312c34b7cf26920a6b3

    SHA256

    07d6c3a19a8e3e243e9545a41dd30a9ee1e9ad79cdd6d446c229d689e5ab574a

    SHA512

    4aa9598ffa686aca161532a60341a226052ca2c7beaf0f864009f5b92c8e45aa1738b3b17c9a02b3d9140eef74c06ff8c9e7a42dc9e47d1951ec9bbc588628e2

  • C:\Program Files (x86)\AppWizard\syspin.exe

    Filesize

    19KB

    MD5

    2a2562abc95e695eab3eeffbe16ead5f

    SHA1

    b72a07d05e0d8f07b7c06312c34b7cf26920a6b3

    SHA256

    07d6c3a19a8e3e243e9545a41dd30a9ee1e9ad79cdd6d446c229d689e5ab574a

    SHA512

    4aa9598ffa686aca161532a60341a226052ca2c7beaf0f864009f5b92c8e45aa1738b3b17c9a02b3d9140eef74c06ff8c9e7a42dc9e47d1951ec9bbc588628e2

  • C:\Program Files (x86)\AppWizard\syspin.exe

    Filesize

    19KB

    MD5

    2a2562abc95e695eab3eeffbe16ead5f

    SHA1

    b72a07d05e0d8f07b7c06312c34b7cf26920a6b3

    SHA256

    07d6c3a19a8e3e243e9545a41dd30a9ee1e9ad79cdd6d446c229d689e5ab574a

    SHA512

    4aa9598ffa686aca161532a60341a226052ca2c7beaf0f864009f5b92c8e45aa1738b3b17c9a02b3d9140eef74c06ff8c9e7a42dc9e47d1951ec9bbc588628e2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    60KB

    MD5

    6c6a24456559f305308cb1fb6c5486b3

    SHA1

    3273ac27d78572f16c3316732b9756ebc22cb6ed

    SHA256

    efc3c579bd619ceab040c4b8c1b821b2d82c64fddd9e80a00ec0d7f6577ed973

    SHA512

    587d4a9175a6aa82cd8bb1c11ca6508f95cd218f76ac322ddbd1bc7146a0e25f8937ee426a6fb0fb0bb045cedb24d8c8a9edfe9f654112f293d8701220f726b4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    333fa9714f5f85f53bb0ddffe9aa6713

    SHA1

    c75be7b2db620567c52579ab48417d429ed14d8a

    SHA256

    3fdf9b4c056af9087a2c79f5bedfed13be11c3846c0b388803d71480fbf18a52

    SHA512

    8fe82c7b595b232d4b6a11a82e359b478a8b95c081b4bae9dbcd32d9e94e698096f0d2667d5bf9e8600e376e817dc48653980251be17f7e84bacc4ff4e4ae859

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    61dd7572e6ae4d20abe65c003c2bd440

    SHA1

    fc6c95dfc86181c6d644198888c3f6d17ad49457

    SHA256

    a0f1f4a9cac5ce0d8587c5380e7d65689e61392f6bdb0a902d1c5b3bd1a0eead

    SHA512

    835ad73ebde76692bdbcfdb7737ca3c7e5570746bfd764f17292faeedb0dfda0538b53a6f2f5bd3e9b377b8558d33c328ef0d96b2ea2ca32968a5487028ea353

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    4f150e46e727a58c0da885832bceca30

    SHA1

    abaa0c7bc01d07786ae608766f8819d6b18f70f5

    SHA256

    b0df41bdd01d8c13671185d0a469f6ed065bf5718c7051ba9bd395ff76a44938

    SHA512

    bbb7a3c7a74121428939cda7880a3c4310589061baac47def8fc323142331c8cb6712eb66c9dd720e5b65e9345a81c28f06831083b44f3f7da4d0a98ae606a71

  • C:\Users\Admin\AppData\Local\Temp\is-HA4EB.tmp\downloader.exe

    Filesize

    198KB

    MD5

    64f01094081e5214edde9d6d75fca1b5

    SHA1

    d7364c6fb350843c004e18fc0bce468eaa64718f

    SHA256

    5861fcac5dcd75e856fb96a2f0563df56e321a4be2c420618763d0bf495700a0

    SHA512

    a7679967d985d006a3c6b000d32b5a258b3c489bddb303c98d9cc54fa597d8a410fa66980767fcf1defe682f7952f744fd3bace26e66244a2529dbddd7a35db0

  • C:\Users\Admin\AppData\Local\Temp\is-HA4EB.tmp\downloader.exe

    Filesize

    198KB

    MD5

    64f01094081e5214edde9d6d75fca1b5

    SHA1

    d7364c6fb350843c004e18fc0bce468eaa64718f

    SHA256

    5861fcac5dcd75e856fb96a2f0563df56e321a4be2c420618763d0bf495700a0

    SHA512

    a7679967d985d006a3c6b000d32b5a258b3c489bddb303c98d9cc54fa597d8a410fa66980767fcf1defe682f7952f744fd3bace26e66244a2529dbddd7a35db0

  • C:\Users\Admin\AppData\Local\Temp\is-HA4EB.tmp\downloader.exe

    Filesize

    198KB

    MD5

    64f01094081e5214edde9d6d75fca1b5

    SHA1

    d7364c6fb350843c004e18fc0bce468eaa64718f

    SHA256

    5861fcac5dcd75e856fb96a2f0563df56e321a4be2c420618763d0bf495700a0

    SHA512

    a7679967d985d006a3c6b000d32b5a258b3c489bddb303c98d9cc54fa597d8a410fa66980767fcf1defe682f7952f744fd3bace26e66244a2529dbddd7a35db0

  • C:\Users\Admin\AppData\Local\Temp\is-VMCEE.tmp\AppWizardSetup_1.97.19.tmp

    Filesize

    2.4MB

    MD5

    20bf8d856af2c17cc1af74eaa988f7f6

    SHA1

    f84a01cfd9e4e98caa2fb380471cb5eeecbf6a23

    SHA256

    8a2c9e81e612e434f5a26ffc06fb23da1aa053cfba57f6a048e4865417b124e4

    SHA512

    d119e20c59a5aa52f987db97455f985027683fe55ac838b1f08d28e88e2f53419ef855b05c99f76a49a7351ec67a485d518eea54d8cc6a0e0fe848f5ce3d1431

  • C:\Users\Admin\AppData\Local\Temp\is-VMCEE.tmp\AppWizardSetup_1.97.19.tmp

    Filesize

    2.4MB

    MD5

    20bf8d856af2c17cc1af74eaa988f7f6

    SHA1

    f84a01cfd9e4e98caa2fb380471cb5eeecbf6a23

    SHA256

    8a2c9e81e612e434f5a26ffc06fb23da1aa053cfba57f6a048e4865417b124e4

    SHA512

    d119e20c59a5aa52f987db97455f985027683fe55ac838b1f08d28e88e2f53419ef855b05c99f76a49a7351ec67a485d518eea54d8cc6a0e0fe848f5ce3d1431

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Crossout.lnk

    Filesize

    1KB

    MD5

    dc4ff7689569722f7c834d163aa08639

    SHA1

    3b555db867009380136404ce058f15e2fe46df5c

    SHA256

    ca55a1c59a03b833bbc3eeefcb910db99ca7a8798d2caa3d1e5357f263ac97f8

    SHA512

    07737215f144b1d3deca066bb962606a51afa970aa3a36e255b8e8c9c3dadf4ed7e108a856319ff972306cf48be00cd4ac04376cc2dac947b7074ea0e2f2743e

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\World of Warships.lnk

    Filesize

    1KB

    MD5

    d257e09a77dfd00921fee507aa12d627

    SHA1

    aa00849b753ac68ba2d2fc946bc386fb32591653

    SHA256

    252b603f41906bfbe5cd5da49a01ab8d5f8965e83ca1549535c714d15f64352f

    SHA512

    a2c568404441e3a6e94b6dc18a89c40a2a025160a87ab9f1c72f2b380c38fecd35ec0ad5f7cdb34732135e84cc3d46fa05a81da74f942c4fc03c1a7383ab20af

  • C:\Users\Admin\Desktop\Crossout.lnk

    Filesize

    1KB

    MD5

    aeb7a8df27889882c38fe6f76b8d47c9

    SHA1

    efca08dab150087a04d80e17edd608463d64b2a9

    SHA256

    9335c00f9fde9372a8b5e4261ed97590fbd45bbbf7d7139733ef1ab09b8494b5

    SHA512

    d403581e48778f981b6c84191cd0eed2c04e63af52c2f60073e7681995dea2a83c313ed489d22a178811044d955005964b898488d7f1103a50bd90436a2cf2c2

  • C:\Users\Admin\Desktop\War Thunder.lnk

    Filesize

    1KB

    MD5

    7fecf2aed5168eb94b3c155360cceb60

    SHA1

    33d61056040e4460fecae25119e7c525a06194da

    SHA256

    a9cdfab8c2ce3906e9212888e1cc4576289e752abc73b12339d3232cffa3375b

    SHA512

    8f026a61131d5b29a8bf658cfb8eda7b4abafbf7ba1ca0584edc2a4d7cc328505229614e1a1ab0fba630c3b52dcd65133e80cf07e08ec119ce6603fba5fb3505

  • C:\Users\Admin\Desktop\World of Warships.lnk

    Filesize

    1KB

    MD5

    023b992a1ccd3bf386ee845bf3d5cd97

    SHA1

    427b8ddc2078ba046c0586ff3b4caa2c0063e276

    SHA256

    7d36fbf87ddf63443eb6e1f6390d1e532e7c674e31764e98a54255bff42cf5a9

    SHA512

    bb136786fbf73328f1be451dd3faf9d58f42ba05b6d41df1f8034032cb8f04706d86c1e28c9557b9952164a31f4b58904fd380d8b9552a05fdb2ce2d72b1ba3d

  • \Program Files (x86)\AppWizard\AppWizard.exe

    Filesize

    12.5MB

    MD5

    ffa9ada8b78f6b9f46f6b7d1d320f25e

    SHA1

    b4a9600075e14607dba960d954f769a90d08f323

    SHA256

    5b282bc459953786f637d6888c3e9ec3c4dd348759dcb132aa48560241b8235f

    SHA512

    bf82c7a1f9a76b1f44bc00f08c475151f44a13f061a59b79ec35a3bb2ea9cf9c49c376cb9a6ca347e0ee495a3169cd9fb1e82e679ba2a5523ce672ffa9d889dd

  • \Program Files (x86)\AppWizard\AppWizard.exe

    Filesize

    12.5MB

    MD5

    ffa9ada8b78f6b9f46f6b7d1d320f25e

    SHA1

    b4a9600075e14607dba960d954f769a90d08f323

    SHA256

    5b282bc459953786f637d6888c3e9ec3c4dd348759dcb132aa48560241b8235f

    SHA512

    bf82c7a1f9a76b1f44bc00f08c475151f44a13f061a59b79ec35a3bb2ea9cf9c49c376cb9a6ca347e0ee495a3169cd9fb1e82e679ba2a5523ce672ffa9d889dd

  • \Program Files (x86)\AppWizard\AppWizard.exe

    Filesize

    12.5MB

    MD5

    ffa9ada8b78f6b9f46f6b7d1d320f25e

    SHA1

    b4a9600075e14607dba960d954f769a90d08f323

    SHA256

    5b282bc459953786f637d6888c3e9ec3c4dd348759dcb132aa48560241b8235f

    SHA512

    bf82c7a1f9a76b1f44bc00f08c475151f44a13f061a59b79ec35a3bb2ea9cf9c49c376cb9a6ca347e0ee495a3169cd9fb1e82e679ba2a5523ce672ffa9d889dd

  • \Program Files (x86)\AppWizard\Uninstall.exe

    Filesize

    650KB

    MD5

    bc0bd84c0b5966c1523f5d7e7c3dbb7a

    SHA1

    3a879945ab218f18257d412a37b859f517c26545

    SHA256

    2c87cd61180a1cd28b7ec7064fe8da0915fc7ce44bf986942b8079941909d1e2

    SHA512

    c7f379e159f813fda110744f89954447cad594bce6fd1e525729161c792393b816b26b070cf39a5aa7ea1663cc8580810c4de0b7640ffc1a6fdbb07c3afe2cb9

  • \Program Files (x86)\AppWizard\syspin.exe

    Filesize

    19KB

    MD5

    2a2562abc95e695eab3eeffbe16ead5f

    SHA1

    b72a07d05e0d8f07b7c06312c34b7cf26920a6b3

    SHA256

    07d6c3a19a8e3e243e9545a41dd30a9ee1e9ad79cdd6d446c229d689e5ab574a

    SHA512

    4aa9598ffa686aca161532a60341a226052ca2c7beaf0f864009f5b92c8e45aa1738b3b17c9a02b3d9140eef74c06ff8c9e7a42dc9e47d1951ec9bbc588628e2

  • \Program Files (x86)\AppWizard\syspin.exe

    Filesize

    19KB

    MD5

    2a2562abc95e695eab3eeffbe16ead5f

    SHA1

    b72a07d05e0d8f07b7c06312c34b7cf26920a6b3

    SHA256

    07d6c3a19a8e3e243e9545a41dd30a9ee1e9ad79cdd6d446c229d689e5ab574a

    SHA512

    4aa9598ffa686aca161532a60341a226052ca2c7beaf0f864009f5b92c8e45aa1738b3b17c9a02b3d9140eef74c06ff8c9e7a42dc9e47d1951ec9bbc588628e2

  • \Program Files (x86)\AppWizard\syspin.exe

    Filesize

    19KB

    MD5

    2a2562abc95e695eab3eeffbe16ead5f

    SHA1

    b72a07d05e0d8f07b7c06312c34b7cf26920a6b3

    SHA256

    07d6c3a19a8e3e243e9545a41dd30a9ee1e9ad79cdd6d446c229d689e5ab574a

    SHA512

    4aa9598ffa686aca161532a60341a226052ca2c7beaf0f864009f5b92c8e45aa1738b3b17c9a02b3d9140eef74c06ff8c9e7a42dc9e47d1951ec9bbc588628e2

  • \Program Files (x86)\AppWizard\syspin.exe

    Filesize

    19KB

    MD5

    2a2562abc95e695eab3eeffbe16ead5f

    SHA1

    b72a07d05e0d8f07b7c06312c34b7cf26920a6b3

    SHA256

    07d6c3a19a8e3e243e9545a41dd30a9ee1e9ad79cdd6d446c229d689e5ab574a

    SHA512

    4aa9598ffa686aca161532a60341a226052ca2c7beaf0f864009f5b92c8e45aa1738b3b17c9a02b3d9140eef74c06ff8c9e7a42dc9e47d1951ec9bbc588628e2

  • \Program Files (x86)\AppWizard\syspin.exe

    Filesize

    19KB

    MD5

    2a2562abc95e695eab3eeffbe16ead5f

    SHA1

    b72a07d05e0d8f07b7c06312c34b7cf26920a6b3

    SHA256

    07d6c3a19a8e3e243e9545a41dd30a9ee1e9ad79cdd6d446c229d689e5ab574a

    SHA512

    4aa9598ffa686aca161532a60341a226052ca2c7beaf0f864009f5b92c8e45aa1738b3b17c9a02b3d9140eef74c06ff8c9e7a42dc9e47d1951ec9bbc588628e2

  • \Program Files (x86)\AppWizard\syspin.exe

    Filesize

    19KB

    MD5

    2a2562abc95e695eab3eeffbe16ead5f

    SHA1

    b72a07d05e0d8f07b7c06312c34b7cf26920a6b3

    SHA256

    07d6c3a19a8e3e243e9545a41dd30a9ee1e9ad79cdd6d446c229d689e5ab574a

    SHA512

    4aa9598ffa686aca161532a60341a226052ca2c7beaf0f864009f5b92c8e45aa1738b3b17c9a02b3d9140eef74c06ff8c9e7a42dc9e47d1951ec9bbc588628e2

  • \Program Files (x86)\AppWizard\syspin.exe

    Filesize

    19KB

    MD5

    2a2562abc95e695eab3eeffbe16ead5f

    SHA1

    b72a07d05e0d8f07b7c06312c34b7cf26920a6b3

    SHA256

    07d6c3a19a8e3e243e9545a41dd30a9ee1e9ad79cdd6d446c229d689e5ab574a

    SHA512

    4aa9598ffa686aca161532a60341a226052ca2c7beaf0f864009f5b92c8e45aa1738b3b17c9a02b3d9140eef74c06ff8c9e7a42dc9e47d1951ec9bbc588628e2

  • \Program Files (x86)\AppWizard\syspin.exe

    Filesize

    19KB

    MD5

    2a2562abc95e695eab3eeffbe16ead5f

    SHA1

    b72a07d05e0d8f07b7c06312c34b7cf26920a6b3

    SHA256

    07d6c3a19a8e3e243e9545a41dd30a9ee1e9ad79cdd6d446c229d689e5ab574a

    SHA512

    4aa9598ffa686aca161532a60341a226052ca2c7beaf0f864009f5b92c8e45aa1738b3b17c9a02b3d9140eef74c06ff8c9e7a42dc9e47d1951ec9bbc588628e2

  • \Program Files (x86)\AppWizard\syspin.exe

    Filesize

    19KB

    MD5

    2a2562abc95e695eab3eeffbe16ead5f

    SHA1

    b72a07d05e0d8f07b7c06312c34b7cf26920a6b3

    SHA256

    07d6c3a19a8e3e243e9545a41dd30a9ee1e9ad79cdd6d446c229d689e5ab574a

    SHA512

    4aa9598ffa686aca161532a60341a226052ca2c7beaf0f864009f5b92c8e45aa1738b3b17c9a02b3d9140eef74c06ff8c9e7a42dc9e47d1951ec9bbc588628e2

  • \Program Files (x86)\AppWizard\syspin.exe

    Filesize

    19KB

    MD5

    2a2562abc95e695eab3eeffbe16ead5f

    SHA1

    b72a07d05e0d8f07b7c06312c34b7cf26920a6b3

    SHA256

    07d6c3a19a8e3e243e9545a41dd30a9ee1e9ad79cdd6d446c229d689e5ab574a

    SHA512

    4aa9598ffa686aca161532a60341a226052ca2c7beaf0f864009f5b92c8e45aa1738b3b17c9a02b3d9140eef74c06ff8c9e7a42dc9e47d1951ec9bbc588628e2

  • \Program Files (x86)\AppWizard\syspin.exe

    Filesize

    19KB

    MD5

    2a2562abc95e695eab3eeffbe16ead5f

    SHA1

    b72a07d05e0d8f07b7c06312c34b7cf26920a6b3

    SHA256

    07d6c3a19a8e3e243e9545a41dd30a9ee1e9ad79cdd6d446c229d689e5ab574a

    SHA512

    4aa9598ffa686aca161532a60341a226052ca2c7beaf0f864009f5b92c8e45aa1738b3b17c9a02b3d9140eef74c06ff8c9e7a42dc9e47d1951ec9bbc588628e2

  • \Program Files (x86)\AppWizard\syspin.exe

    Filesize

    19KB

    MD5

    2a2562abc95e695eab3eeffbe16ead5f

    SHA1

    b72a07d05e0d8f07b7c06312c34b7cf26920a6b3

    SHA256

    07d6c3a19a8e3e243e9545a41dd30a9ee1e9ad79cdd6d446c229d689e5ab574a

    SHA512

    4aa9598ffa686aca161532a60341a226052ca2c7beaf0f864009f5b92c8e45aa1738b3b17c9a02b3d9140eef74c06ff8c9e7a42dc9e47d1951ec9bbc588628e2

  • \Program Files (x86)\AppWizard\syspin.exe

    Filesize

    19KB

    MD5

    2a2562abc95e695eab3eeffbe16ead5f

    SHA1

    b72a07d05e0d8f07b7c06312c34b7cf26920a6b3

    SHA256

    07d6c3a19a8e3e243e9545a41dd30a9ee1e9ad79cdd6d446c229d689e5ab574a

    SHA512

    4aa9598ffa686aca161532a60341a226052ca2c7beaf0f864009f5b92c8e45aa1738b3b17c9a02b3d9140eef74c06ff8c9e7a42dc9e47d1951ec9bbc588628e2

  • \Program Files (x86)\AppWizard\syspin.exe

    Filesize

    19KB

    MD5

    2a2562abc95e695eab3eeffbe16ead5f

    SHA1

    b72a07d05e0d8f07b7c06312c34b7cf26920a6b3

    SHA256

    07d6c3a19a8e3e243e9545a41dd30a9ee1e9ad79cdd6d446c229d689e5ab574a

    SHA512

    4aa9598ffa686aca161532a60341a226052ca2c7beaf0f864009f5b92c8e45aa1738b3b17c9a02b3d9140eef74c06ff8c9e7a42dc9e47d1951ec9bbc588628e2

  • \Program Files (x86)\AppWizard\syspin.exe

    Filesize

    19KB

    MD5

    2a2562abc95e695eab3eeffbe16ead5f

    SHA1

    b72a07d05e0d8f07b7c06312c34b7cf26920a6b3

    SHA256

    07d6c3a19a8e3e243e9545a41dd30a9ee1e9ad79cdd6d446c229d689e5ab574a

    SHA512

    4aa9598ffa686aca161532a60341a226052ca2c7beaf0f864009f5b92c8e45aa1738b3b17c9a02b3d9140eef74c06ff8c9e7a42dc9e47d1951ec9bbc588628e2

  • \Program Files (x86)\AppWizard\syspin.exe

    Filesize

    19KB

    MD5

    2a2562abc95e695eab3eeffbe16ead5f

    SHA1

    b72a07d05e0d8f07b7c06312c34b7cf26920a6b3

    SHA256

    07d6c3a19a8e3e243e9545a41dd30a9ee1e9ad79cdd6d446c229d689e5ab574a

    SHA512

    4aa9598ffa686aca161532a60341a226052ca2c7beaf0f864009f5b92c8e45aa1738b3b17c9a02b3d9140eef74c06ff8c9e7a42dc9e47d1951ec9bbc588628e2

  • \Program Files (x86)\AppWizard\syspin.exe

    Filesize

    19KB

    MD5

    2a2562abc95e695eab3eeffbe16ead5f

    SHA1

    b72a07d05e0d8f07b7c06312c34b7cf26920a6b3

    SHA256

    07d6c3a19a8e3e243e9545a41dd30a9ee1e9ad79cdd6d446c229d689e5ab574a

    SHA512

    4aa9598ffa686aca161532a60341a226052ca2c7beaf0f864009f5b92c8e45aa1738b3b17c9a02b3d9140eef74c06ff8c9e7a42dc9e47d1951ec9bbc588628e2

  • \Program Files (x86)\AppWizard\syspin.exe

    Filesize

    19KB

    MD5

    2a2562abc95e695eab3eeffbe16ead5f

    SHA1

    b72a07d05e0d8f07b7c06312c34b7cf26920a6b3

    SHA256

    07d6c3a19a8e3e243e9545a41dd30a9ee1e9ad79cdd6d446c229d689e5ab574a

    SHA512

    4aa9598ffa686aca161532a60341a226052ca2c7beaf0f864009f5b92c8e45aa1738b3b17c9a02b3d9140eef74c06ff8c9e7a42dc9e47d1951ec9bbc588628e2

  • \Program Files (x86)\AppWizard\syspin.exe

    Filesize

    19KB

    MD5

    2a2562abc95e695eab3eeffbe16ead5f

    SHA1

    b72a07d05e0d8f07b7c06312c34b7cf26920a6b3

    SHA256

    07d6c3a19a8e3e243e9545a41dd30a9ee1e9ad79cdd6d446c229d689e5ab574a

    SHA512

    4aa9598ffa686aca161532a60341a226052ca2c7beaf0f864009f5b92c8e45aa1738b3b17c9a02b3d9140eef74c06ff8c9e7a42dc9e47d1951ec9bbc588628e2

  • \Program Files (x86)\AppWizard\syspin.exe

    Filesize

    19KB

    MD5

    2a2562abc95e695eab3eeffbe16ead5f

    SHA1

    b72a07d05e0d8f07b7c06312c34b7cf26920a6b3

    SHA256

    07d6c3a19a8e3e243e9545a41dd30a9ee1e9ad79cdd6d446c229d689e5ab574a

    SHA512

    4aa9598ffa686aca161532a60341a226052ca2c7beaf0f864009f5b92c8e45aa1738b3b17c9a02b3d9140eef74c06ff8c9e7a42dc9e47d1951ec9bbc588628e2

  • \Program Files (x86)\AppWizard\syspin.exe

    Filesize

    19KB

    MD5

    2a2562abc95e695eab3eeffbe16ead5f

    SHA1

    b72a07d05e0d8f07b7c06312c34b7cf26920a6b3

    SHA256

    07d6c3a19a8e3e243e9545a41dd30a9ee1e9ad79cdd6d446c229d689e5ab574a

    SHA512

    4aa9598ffa686aca161532a60341a226052ca2c7beaf0f864009f5b92c8e45aa1738b3b17c9a02b3d9140eef74c06ff8c9e7a42dc9e47d1951ec9bbc588628e2

  • \Program Files (x86)\AppWizard\syspin.exe

    Filesize

    19KB

    MD5

    2a2562abc95e695eab3eeffbe16ead5f

    SHA1

    b72a07d05e0d8f07b7c06312c34b7cf26920a6b3

    SHA256

    07d6c3a19a8e3e243e9545a41dd30a9ee1e9ad79cdd6d446c229d689e5ab574a

    SHA512

    4aa9598ffa686aca161532a60341a226052ca2c7beaf0f864009f5b92c8e45aa1738b3b17c9a02b3d9140eef74c06ff8c9e7a42dc9e47d1951ec9bbc588628e2

  • \Users\Admin\AppData\Local\Temp\is-HA4EB.tmp\CallbackCtrl.dll

    Filesize

    4KB

    MD5

    f07e819ba2e46a897cfabf816d7557b2

    SHA1

    8d5fd0a741dd3fd84650e40dd3928ae1f15323cc

    SHA256

    68f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d

    SHA512

    7ed26d41ead2ace0b5379639474d319af9a3e4ed2dd9795c018f8c5b9b533fd36bfc1713a1f871789bf14884d186fd0559939de511dde24673b0515165d405af

  • \Users\Admin\AppData\Local\Temp\is-HA4EB.tmp\botva2.dll

    Filesize

    41KB

    MD5

    ef899fa243c07b7b82b3a45f6ec36771

    SHA1

    4a86313cc8766dcad1c2b00c2b8f9bbe0cf8bbbe

    SHA256

    da7d0368712ee419952eb2640a65a7f24e39fb7872442ed4d2ee847ec4cfde77

    SHA512

    3f98b5ad9adfad2111ebd1d8cbab9ae423d624d1668cc64c0bfcdbfedf30c1ce3ea6bc6bcf70f7dd1b01172a4349e7c84fb75d395ee5af73866574c1d734c6e8

  • \Users\Admin\AppData\Local\Temp\is-HA4EB.tmp\downloader.exe

    Filesize

    198KB

    MD5

    64f01094081e5214edde9d6d75fca1b5

    SHA1

    d7364c6fb350843c004e18fc0bce468eaa64718f

    SHA256

    5861fcac5dcd75e856fb96a2f0563df56e321a4be2c420618763d0bf495700a0

    SHA512

    a7679967d985d006a3c6b000d32b5a258b3c489bddb303c98d9cc54fa597d8a410fa66980767fcf1defe682f7952f744fd3bace26e66244a2529dbddd7a35db0

  • \Users\Admin\AppData\Local\Temp\is-HA4EB.tmp\downloader.exe

    Filesize

    198KB

    MD5

    64f01094081e5214edde9d6d75fca1b5

    SHA1

    d7364c6fb350843c004e18fc0bce468eaa64718f

    SHA256

    5861fcac5dcd75e856fb96a2f0563df56e321a4be2c420618763d0bf495700a0

    SHA512

    a7679967d985d006a3c6b000d32b5a258b3c489bddb303c98d9cc54fa597d8a410fa66980767fcf1defe682f7952f744fd3bace26e66244a2529dbddd7a35db0

  • \Users\Admin\AppData\Local\Temp\is-HA4EB.tmp\idp.dll

    Filesize

    232KB

    MD5

    55c310c0319260d798757557ab3bf636

    SHA1

    0892eb7ed31d8bb20a56c6835990749011a2d8de

    SHA256

    54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed

    SHA512

    e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57

  • \Users\Admin\AppData\Local\Temp\is-HA4EB.tmp\params.dll

    Filesize

    3KB

    MD5

    969ce988621ed50c93912b105bc6dab0

    SHA1

    ede3444ca9fcef23254d8dfdf5b626d7db6d4452

    SHA256

    adcecdf9f78ffca7143bb43ae6c5ef171a061f026da40a1e5deb7fc79597ef89

    SHA512

    efa7bdb989ebd4d0bebff9469825e5369534e87032d99a5bc427c741f8c1a285a91d3040236cf99f8509277d7f7857a1d91bde014fc7a68c5118540981b07902

  • \Users\Admin\AppData\Local\Temp\is-HA4EB.tmp\resource.dll

    Filesize

    1.6MB

    MD5

    1d61244742fc07ad93f546ed295f0315

    SHA1

    81ff2afa7e6e1d9fed9135574a8784e9f3074271

    SHA256

    b79aa0c165ab022d86400f108e5e3252a3f68cc65bc7c04fc2e2429ffa913b97

    SHA512

    19427da93561a0a569c3b49b00bc091dcd6b4c9e2b88c41a8f769228275de67cc958e09d2170db838079e1bce060175c92b873b1189324c64e2d2524092f5494

  • \Users\Admin\AppData\Local\Temp\is-VMCEE.tmp\AppWizardSetup_1.97.19.tmp

    Filesize

    2.4MB

    MD5

    20bf8d856af2c17cc1af74eaa988f7f6

    SHA1

    f84a01cfd9e4e98caa2fb380471cb5eeecbf6a23

    SHA256

    8a2c9e81e612e434f5a26ffc06fb23da1aa053cfba57f6a048e4865417b124e4

    SHA512

    d119e20c59a5aa52f987db97455f985027683fe55ac838b1f08d28e88e2f53419ef855b05c99f76a49a7351ec67a485d518eea54d8cc6a0e0fe848f5ce3d1431

  • memory/1048-189-0x0000000000400000-0x00000000004BF000-memory.dmp

    Filesize

    764KB

  • memory/1048-54-0x0000000076171000-0x0000000076173000-memory.dmp

    Filesize

    8KB

  • memory/1048-61-0x0000000000400000-0x00000000004BF000-memory.dmp

    Filesize

    764KB

  • memory/1048-55-0x0000000000400000-0x00000000004BF000-memory.dmp

    Filesize

    764KB

  • memory/1216-117-0x0000000002A20000-0x0000000002A2A000-memory.dmp

    Filesize

    40KB

  • memory/1216-125-0x0000000002A20000-0x0000000002A2A000-memory.dmp

    Filesize

    40KB

  • memory/1216-149-0x0000000002A20000-0x0000000002A2A000-memory.dmp

    Filesize

    40KB

  • memory/1216-188-0x0000000002A20000-0x0000000002A2A000-memory.dmp

    Filesize

    40KB

  • memory/1216-151-0x0000000002A20000-0x0000000002A2A000-memory.dmp

    Filesize

    40KB

  • memory/1216-152-0x0000000002A20000-0x0000000002A2A000-memory.dmp

    Filesize

    40KB

  • memory/1216-134-0x0000000002A20000-0x0000000002A2A000-memory.dmp

    Filesize

    40KB

  • memory/1216-132-0x0000000002A20000-0x0000000002A2A000-memory.dmp

    Filesize

    40KB

  • memory/1216-142-0x0000000002A20000-0x0000000002A2A000-memory.dmp

    Filesize

    40KB

  • memory/1216-187-0x0000000002A20000-0x0000000002A2A000-memory.dmp

    Filesize

    40KB

  • memory/1216-159-0x0000000002A20000-0x0000000002A2A000-memory.dmp

    Filesize

    40KB

  • memory/1216-176-0x0000000002A20000-0x0000000002A2A000-memory.dmp

    Filesize

    40KB

  • memory/1216-186-0x0000000002A20000-0x0000000002A2A000-memory.dmp

    Filesize

    40KB

  • memory/1216-118-0x0000000002A20000-0x0000000002A2A000-memory.dmp

    Filesize

    40KB

  • memory/1216-115-0x0000000002A20000-0x0000000002A2A000-memory.dmp

    Filesize

    40KB

  • memory/1216-166-0x0000000002A20000-0x0000000002A2A000-memory.dmp

    Filesize

    40KB

  • memory/1216-182-0x0000000002A20000-0x0000000002A2A000-memory.dmp

    Filesize

    40KB

  • memory/1216-108-0x0000000002A20000-0x0000000002A2A000-memory.dmp

    Filesize

    40KB

  • memory/1216-169-0x0000000002A20000-0x0000000002A2A000-memory.dmp

    Filesize

    40KB

  • memory/1216-101-0x0000000002A20000-0x0000000002A2A000-memory.dmp

    Filesize

    40KB

  • memory/1216-98-0x0000000002A20000-0x0000000002A2A000-memory.dmp

    Filesize

    40KB

  • memory/1216-96-0x0000000002A20000-0x0000000002A2A000-memory.dmp

    Filesize

    40KB

  • memory/1996-68-0x0000000074711000-0x0000000074713000-memory.dmp

    Filesize

    8KB