Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-10-2022 09:13

General

  • Target

    Ref671005018.xls

  • Size

    232KB

  • MD5

    169f284d5cb718718ef756d97e962d66

  • SHA1

    f83c9e72f5d03e30e8d99b8ac3a7ea9e3ab98960

  • SHA256

    f9068e24dc32b9314c21966284886537051e1ea8b7044772489a99c4906925af

  • SHA512

    fd82a9a0044be3eb01b95dd5de63b0ac57072cf67fc2959ac1180f22f7ed5375ba9178e37b2fe3c2ddabe883aadb90e85d77c19406af1c5c41861d2d4bd34c26

  • SSDEEP

    6144:yk3hOdsylKlgryzc4bNhZF+E+W2knA1ADM/NuNNFNNXNNuNNdNNPNNaNNbNNWNNb:GAcNuNNFNNXNNuNNdNNPNNaNNbNNWNNb

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

37.139.128.94:6000

Mutex

407839af-e81b-4512-9071-482887f971db

Attributes
  • activate_away_mode

    true

  • backup_connection_host

  • backup_dns_server

    8.8.4.4

  • buffer_size

    65535

  • build_time

    2022-08-07T10:00:20.190590236Z

  • bypass_user_account_control

    true

  • bypass_user_account_control_data

  • clear_access_control

    true

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    6000

  • default_group

    client

  • enable_debug_mode

    true

  • gc_threshold

    1.048576e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.048576e+07

  • mutex

    407839af-e81b-4512-9071-482887f971db

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    37.139.128.94

  • primary_dns_server

    8.8.8.8

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    true

  • set_critical_process

    true

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8000

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

  • Downloads MZ/PE file
  • Executes dropped EXE 4 IoCs
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 8 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 4 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Ref671005018.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1268
    • C:\Users\Admin\AppData\Local\Temp\svchost.exe
      "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4384
      • C:\Users\Admin\AppData\Local\temp\6_910\gst.exe
        "C:\Users\Admin\AppData\Local\temp\6_910\gst.exe" Saint-Étienne-du-Mont is a church located on the Montagne Sainte-Geneviève
        3⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:4936
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\temp\9_105\pmsg.vbe"
          4⤵
          • Checks computer location settings
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:3292
          • C:\Users\Admin\AppData\Local\Temp\9_105\akfng.exe
            "C:\Users\Admin\AppData\Local\Temp\9_105\akfng.exe" whofhgk.sos
            5⤵
            • Executes dropped EXE
            • Drops startup file
            • Adds Run key to start application
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2796
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
              6⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:4680
      • C:\Windows\SysWOW64\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\temp\6_910\npssxoovaq.vbe"
        3⤵
        • Checks computer location settings
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:1324
        • C:\Users\Admin\AppData\Local\Temp\6_910\ddkvmcjj.exe
          "C:\Users\Admin\AppData\Local\Temp\6_910\ddkvmcjj.exe" cjnm.edm
          4⤵
          • Executes dropped EXE
          • Drops startup file
          • Adds Run key to start application
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:1936
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
            5⤵
            • Accesses Microsoft Outlook profiles
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • outlook_office_path
            • outlook_win_path
            PID:4720

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\6_910\cbxfue.ico

    Filesize

    57KB

    MD5

    783d3de8de9f375875e62b690541c6fc

    SHA1

    bd76af531029b646f383f24095ddbb327877abde

    SHA256

    1529dda9873dbc7882fde74f145d8aba3c63091e573968c294e6a6187fc709f2

    SHA512

    af3875fe94118c774edc6e7de9ba3ec0368d6c1959ba3c40478751e94dc87197d0bdd2a4bb34eeebb2647df743c18419e16738647c68e25076e9a6b2fb87b8d6

  • C:\Users\Admin\AppData\Local\Temp\6_910\cjnm.edm

    Filesize

    144.9MB

    MD5

    cbbc308c7a75e37ed4135bfbecbdfbbc

    SHA1

    6205245d1ce6b0682aef9079aeeee096b99ccb9d

    SHA256

    17770d3cec381de78db80be431bb5450ed477b99a1ed288ee3f6c7048f0563f5

    SHA512

    8991da2bc43747d1079fa18162d0f5a6e87009c8161c701750ebbb9592b6b81242b75e6f412cc47d9a6edd390735bbe55a183811ffaf3322e47758eae29ffdfa

  • C:\Users\Admin\AppData\Local\Temp\6_910\ddkvmcjj.exe

    Filesize

    911KB

    MD5

    81221edd11b5995e95e971646d9653c0

    SHA1

    f1b09d14995f24270af8d67050b4e5a38de074f3

    SHA256

    c809f3429bcc2c666d4b6135c720c8df30ff1ede2f76e73308b82202bd904a6f

    SHA512

    6780988267df3368e3aec9d1a58c7a9700117b6439bf9545291417cc490ed069ef6068d682138fe870093dab6c8a389a1b5f1256e21c103eb4681b1ac236248a

  • C:\Users\Admin\AppData\Local\Temp\6_910\ddkvmcjj.exe

    Filesize

    911KB

    MD5

    81221edd11b5995e95e971646d9653c0

    SHA1

    f1b09d14995f24270af8d67050b4e5a38de074f3

    SHA256

    c809f3429bcc2c666d4b6135c720c8df30ff1ede2f76e73308b82202bd904a6f

    SHA512

    6780988267df3368e3aec9d1a58c7a9700117b6439bf9545291417cc490ed069ef6068d682138fe870093dab6c8a389a1b5f1256e21c103eb4681b1ac236248a

  • C:\Users\Admin\AppData\Local\Temp\6_910\gst.exe

    Filesize

    1.1MB

    MD5

    110281413953d3f0417e6444b0004644

    SHA1

    236630dbc2635dbcb704a78278892948ea224c5d

    SHA256

    046d38d00b4703467e142264a3b66bea51ed16ca07da98ccf410e90ddd6e95c2

    SHA512

    a8abd219c73f8742cff7ea7b3ac73bc7276c9040c2f6ba6d868029129fd95c04c5346534bd6a83f0dd32d7ee6b81b45c702958914557cffc87a355648de84f84

  • C:\Users\Admin\AppData\Local\Temp\6_910\pfuum.nqi

    Filesize

    436KB

    MD5

    dd9aaeff1f2e6f7572b0a59c68e5f0dc

    SHA1

    e32da5f93c5c94f8b4b12ccb4069a0e8e94dd038

    SHA256

    b3dff265c8ec050020c7213d027ca1e5aaad1d9895dafedaaf58cd98ba1e7861

    SHA512

    5d8ae10375edce231721368e5d8a6ceef3d7475d0286aeaace11514e0f9c2c2694b2c7b637bc7712dc7ed894430081ce5370142c3eade4becca9034cfbabf6a8

  • C:\Users\Admin\AppData\Local\Temp\9_105\akfng.exe

    Filesize

    915KB

    MD5

    303c86d5e26a663bdb09481f93be2e90

    SHA1

    b269a394afcf82a26150a8e16daa933176c1d3b2

    SHA256

    1f13ccb643426fc2b63d2b8492ffd29eb86eb5de53ce3a7f598823fb5311263f

    SHA512

    7c239f299d29ecd4015e8b53da93188dc814d135597e49b81178ac3da7be1faed8cf2eef41d3eb8b6bbd8f06e6e09fd49b3e0346f1bd3a5c5acca1703b6de955

  • C:\Users\Admin\AppData\Local\Temp\9_105\akfng.exe

    Filesize

    915KB

    MD5

    303c86d5e26a663bdb09481f93be2e90

    SHA1

    b269a394afcf82a26150a8e16daa933176c1d3b2

    SHA256

    1f13ccb643426fc2b63d2b8492ffd29eb86eb5de53ce3a7f598823fb5311263f

    SHA512

    7c239f299d29ecd4015e8b53da93188dc814d135597e49b81178ac3da7be1faed8cf2eef41d3eb8b6bbd8f06e6e09fd49b3e0346f1bd3a5c5acca1703b6de955

  • C:\Users\Admin\AppData\Local\Temp\9_105\qcmqueptsl.ppt

    Filesize

    59KB

    MD5

    aa511ad88b62774609eccded56fe6921

    SHA1

    bc7995786dd2f464ca72e472588d0d2f8441cba5

    SHA256

    e1411732032805d54c5c51af508764272d144bb559ca7e45dff1e036049c741d

    SHA512

    7ec89454e2b09cb0d1dc2cfb8e97e9ca3c27ff552e206d5069ad117c961f607644e2512ff7eb76d78c3ee429c4a044f32c44931e710ba8f600ce36e2b516e960

  • C:\Users\Admin\AppData\Local\Temp\9_105\whofhgk.sos

    Filesize

    79.3MB

    MD5

    111689a0b6b4f08522b7b577692c1001

    SHA1

    5e88d66c4e5d21676ed9f7117669efbda2e71778

    SHA256

    92a969067cee6fa37cbe337baaebf53a2a1912975f09be78ef90384eeda6deda

    SHA512

    f11d8d57295ddb7ae812abfb77cbea08227b1d4751e3d93a9e6c6af7e8d130a2621fc8b30a1bcd0a1a3c41220f89289c10591ab8a7a42b6e29657d377678fcf6

  • C:\Users\Admin\AppData\Local\Temp\9_105\xsmiqu.crn

    Filesize

    405KB

    MD5

    81db3971acf8ec7739e75f8861885f89

    SHA1

    2f2b8a2302c29e72a28697afa6b7728819469c8e

    SHA256

    4ce2fd6069f41e43443cc1666a24ebc9e02833b70ba407b6c343cd1c1a3acc3a

    SHA512

    b237c9d227d69a8d3f42428040e6e162f7868a932272ef48ac92616281bb2ec8f28bc071e248de6b9ce4d762f5f673eef2c362cafac4badc54fc8e08e1abef13

  • C:\Users\Admin\AppData\Local\Temp\svchost.exe

    Filesize

    2.1MB

    MD5

    71bc3a380454c4bf0c29f7ce462f5a44

    SHA1

    13d0575bffee9c37a4bd83f9636b1f0cd028f975

    SHA256

    c3b54b1b12f48682ca31c77c5783db4c235268c52fcf11f2f7a3ee0364c9f8df

    SHA512

    03da38432163c1c5f4b063eae32933492b9f60e21f6016c0a1c5c27d46d447672002fe0b82fbb648f497c35549497c999a6f8f68dc2567d350f30bf1eb6db5aa

  • C:\Users\Admin\AppData\Local\Temp\svchost.exe

    Filesize

    2.1MB

    MD5

    71bc3a380454c4bf0c29f7ce462f5a44

    SHA1

    13d0575bffee9c37a4bd83f9636b1f0cd028f975

    SHA256

    c3b54b1b12f48682ca31c77c5783db4c235268c52fcf11f2f7a3ee0364c9f8df

    SHA512

    03da38432163c1c5f4b063eae32933492b9f60e21f6016c0a1c5c27d46d447672002fe0b82fbb648f497c35549497c999a6f8f68dc2567d350f30bf1eb6db5aa

  • C:\Users\Admin\AppData\Local\temp\6_910\gst.exe

    Filesize

    1.1MB

    MD5

    110281413953d3f0417e6444b0004644

    SHA1

    236630dbc2635dbcb704a78278892948ea224c5d

    SHA256

    046d38d00b4703467e142264a3b66bea51ed16ca07da98ccf410e90ddd6e95c2

    SHA512

    a8abd219c73f8742cff7ea7b3ac73bc7276c9040c2f6ba6d868029129fd95c04c5346534bd6a83f0dd32d7ee6b81b45c702958914557cffc87a355648de84f84

  • C:\Users\Admin\AppData\Local\temp\6_910\npssxoovaq.vbe

    Filesize

    28KB

    MD5

    e84f87dacfb7eb1b00eeec1aaac1d4cf

    SHA1

    b263f4462b1d3ecb6e0dfeae04ef6dadd96f608c

    SHA256

    c91dc9fae6dbf85acddcba2c0966de01d6a48e56a779488fec5731e6fda2e242

    SHA512

    a0449c4648f2e7356c9334fc0d7b6c201e7e646661e444d53961b6c9b847e7b53a772e06fb7be25f26019b70b78f51d67120fb2ee70ff7eee561526d2b3917c9

  • C:\Users\Admin\AppData\Local\temp\9_105\pmsg.vbe

    Filesize

    32KB

    MD5

    dbeb963635b0737ceca13c7f9bc566d7

    SHA1

    10b6334645131d81b311c71eca7a8f9ccde127d1

    SHA256

    01299ecd0169896c320e2690a782a45a7e8f2d94cbc221dbe153ceb694febbe6

    SHA512

    b48d909051ecbb73ab47c89fcfee3cbdb9a08c5a246e3e0ec4780e64e402e01d16ff2f2fa3025bc11f2efaaf28b47496aa83f1957db8d131e9ea8e7a20bef3d9

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

    Filesize

    1KB

    MD5

    55f596ebfed69c8819860eaaa02049fa

    SHA1

    a30ac1a04169ed5799f4c4239a3a61bfea1a43e8

    SHA256

    d1640e131265fa2a7624bedef5f8f06ab8b9ebe24ca1f11db0772f61d6437110

    SHA512

    3802f5e5ff7d5217225b21eb9314c45fc19b0c01ba553355dc32239292efa8611bcae01e1e9abad8eb636dfa6cb806f3630b18a32bc8539dfcd62b564467a336

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

    Filesize

    1KB

    MD5

    89604977a3449d5d1e458518f73306d9

    SHA1

    de73b25a11a6026afa6513f22ee34aace245a231

    SHA256

    8a8e21d98d953efbee713106994e3783760f319371d7101a80823c56cbee20af

    SHA512

    dfb1ec3056ca4441c54b6ab9b6c778359a9ba52bf313cb8ceb23560f246ef9303a267012df19b51b0e9db7b0716052bbdb0198256d9632f693d8283fe84f7ba4

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

    Filesize

    1KB

    MD5

    55f596ebfed69c8819860eaaa02049fa

    SHA1

    a30ac1a04169ed5799f4c4239a3a61bfea1a43e8

    SHA256

    d1640e131265fa2a7624bedef5f8f06ab8b9ebe24ca1f11db0772f61d6437110

    SHA512

    3802f5e5ff7d5217225b21eb9314c45fc19b0c01ba553355dc32239292efa8611bcae01e1e9abad8eb636dfa6cb806f3630b18a32bc8539dfcd62b564467a336

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

    Filesize

    1KB

    MD5

    89604977a3449d5d1e458518f73306d9

    SHA1

    de73b25a11a6026afa6513f22ee34aace245a231

    SHA256

    8a8e21d98d953efbee713106994e3783760f319371d7101a80823c56cbee20af

    SHA512

    dfb1ec3056ca4441c54b6ab9b6c778359a9ba52bf313cb8ceb23560f246ef9303a267012df19b51b0e9db7b0716052bbdb0198256d9632f693d8283fe84f7ba4

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

    Filesize

    1KB

    MD5

    55f596ebfed69c8819860eaaa02049fa

    SHA1

    a30ac1a04169ed5799f4c4239a3a61bfea1a43e8

    SHA256

    d1640e131265fa2a7624bedef5f8f06ab8b9ebe24ca1f11db0772f61d6437110

    SHA512

    3802f5e5ff7d5217225b21eb9314c45fc19b0c01ba553355dc32239292efa8611bcae01e1e9abad8eb636dfa6cb806f3630b18a32bc8539dfcd62b564467a336

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

    Filesize

    1KB

    MD5

    55f596ebfed69c8819860eaaa02049fa

    SHA1

    a30ac1a04169ed5799f4c4239a3a61bfea1a43e8

    SHA256

    d1640e131265fa2a7624bedef5f8f06ab8b9ebe24ca1f11db0772f61d6437110

    SHA512

    3802f5e5ff7d5217225b21eb9314c45fc19b0c01ba553355dc32239292efa8611bcae01e1e9abad8eb636dfa6cb806f3630b18a32bc8539dfcd62b564467a336

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

    Filesize

    1KB

    MD5

    55f596ebfed69c8819860eaaa02049fa

    SHA1

    a30ac1a04169ed5799f4c4239a3a61bfea1a43e8

    SHA256

    d1640e131265fa2a7624bedef5f8f06ab8b9ebe24ca1f11db0772f61d6437110

    SHA512

    3802f5e5ff7d5217225b21eb9314c45fc19b0c01ba553355dc32239292efa8611bcae01e1e9abad8eb636dfa6cb806f3630b18a32bc8539dfcd62b564467a336

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

    Filesize

    1KB

    MD5

    55f596ebfed69c8819860eaaa02049fa

    SHA1

    a30ac1a04169ed5799f4c4239a3a61bfea1a43e8

    SHA256

    d1640e131265fa2a7624bedef5f8f06ab8b9ebe24ca1f11db0772f61d6437110

    SHA512

    3802f5e5ff7d5217225b21eb9314c45fc19b0c01ba553355dc32239292efa8611bcae01e1e9abad8eb636dfa6cb806f3630b18a32bc8539dfcd62b564467a336

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

    Filesize

    1KB

    MD5

    55f596ebfed69c8819860eaaa02049fa

    SHA1

    a30ac1a04169ed5799f4c4239a3a61bfea1a43e8

    SHA256

    d1640e131265fa2a7624bedef5f8f06ab8b9ebe24ca1f11db0772f61d6437110

    SHA512

    3802f5e5ff7d5217225b21eb9314c45fc19b0c01ba553355dc32239292efa8611bcae01e1e9abad8eb636dfa6cb806f3630b18a32bc8539dfcd62b564467a336

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

    Filesize

    1KB

    MD5

    55f596ebfed69c8819860eaaa02049fa

    SHA1

    a30ac1a04169ed5799f4c4239a3a61bfea1a43e8

    SHA256

    d1640e131265fa2a7624bedef5f8f06ab8b9ebe24ca1f11db0772f61d6437110

    SHA512

    3802f5e5ff7d5217225b21eb9314c45fc19b0c01ba553355dc32239292efa8611bcae01e1e9abad8eb636dfa6cb806f3630b18a32bc8539dfcd62b564467a336

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

    Filesize

    1KB

    MD5

    55f596ebfed69c8819860eaaa02049fa

    SHA1

    a30ac1a04169ed5799f4c4239a3a61bfea1a43e8

    SHA256

    d1640e131265fa2a7624bedef5f8f06ab8b9ebe24ca1f11db0772f61d6437110

    SHA512

    3802f5e5ff7d5217225b21eb9314c45fc19b0c01ba553355dc32239292efa8611bcae01e1e9abad8eb636dfa6cb806f3630b18a32bc8539dfcd62b564467a336

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

    Filesize

    1KB

    MD5

    55f596ebfed69c8819860eaaa02049fa

    SHA1

    a30ac1a04169ed5799f4c4239a3a61bfea1a43e8

    SHA256

    d1640e131265fa2a7624bedef5f8f06ab8b9ebe24ca1f11db0772f61d6437110

    SHA512

    3802f5e5ff7d5217225b21eb9314c45fc19b0c01ba553355dc32239292efa8611bcae01e1e9abad8eb636dfa6cb806f3630b18a32bc8539dfcd62b564467a336

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

    Filesize

    1KB

    MD5

    55f596ebfed69c8819860eaaa02049fa

    SHA1

    a30ac1a04169ed5799f4c4239a3a61bfea1a43e8

    SHA256

    d1640e131265fa2a7624bedef5f8f06ab8b9ebe24ca1f11db0772f61d6437110

    SHA512

    3802f5e5ff7d5217225b21eb9314c45fc19b0c01ba553355dc32239292efa8611bcae01e1e9abad8eb636dfa6cb806f3630b18a32bc8539dfcd62b564467a336

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

    Filesize

    1KB

    MD5

    89604977a3449d5d1e458518f73306d9

    SHA1

    de73b25a11a6026afa6513f22ee34aace245a231

    SHA256

    8a8e21d98d953efbee713106994e3783760f319371d7101a80823c56cbee20af

    SHA512

    dfb1ec3056ca4441c54b6ab9b6c778359a9ba52bf313cb8ceb23560f246ef9303a267012df19b51b0e9db7b0716052bbdb0198256d9632f693d8283fe84f7ba4

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

    Filesize

    1KB

    MD5

    89604977a3449d5d1e458518f73306d9

    SHA1

    de73b25a11a6026afa6513f22ee34aace245a231

    SHA256

    8a8e21d98d953efbee713106994e3783760f319371d7101a80823c56cbee20af

    SHA512

    dfb1ec3056ca4441c54b6ab9b6c778359a9ba52bf313cb8ceb23560f246ef9303a267012df19b51b0e9db7b0716052bbdb0198256d9632f693d8283fe84f7ba4

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

    Filesize

    1KB

    MD5

    89604977a3449d5d1e458518f73306d9

    SHA1

    de73b25a11a6026afa6513f22ee34aace245a231

    SHA256

    8a8e21d98d953efbee713106994e3783760f319371d7101a80823c56cbee20af

    SHA512

    dfb1ec3056ca4441c54b6ab9b6c778359a9ba52bf313cb8ceb23560f246ef9303a267012df19b51b0e9db7b0716052bbdb0198256d9632f693d8283fe84f7ba4

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

    Filesize

    1KB

    MD5

    89604977a3449d5d1e458518f73306d9

    SHA1

    de73b25a11a6026afa6513f22ee34aace245a231

    SHA256

    8a8e21d98d953efbee713106994e3783760f319371d7101a80823c56cbee20af

    SHA512

    dfb1ec3056ca4441c54b6ab9b6c778359a9ba52bf313cb8ceb23560f246ef9303a267012df19b51b0e9db7b0716052bbdb0198256d9632f693d8283fe84f7ba4

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

    Filesize

    1KB

    MD5

    89604977a3449d5d1e458518f73306d9

    SHA1

    de73b25a11a6026afa6513f22ee34aace245a231

    SHA256

    8a8e21d98d953efbee713106994e3783760f319371d7101a80823c56cbee20af

    SHA512

    dfb1ec3056ca4441c54b6ab9b6c778359a9ba52bf313cb8ceb23560f246ef9303a267012df19b51b0e9db7b0716052bbdb0198256d9632f693d8283fe84f7ba4

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

    Filesize

    1KB

    MD5

    89604977a3449d5d1e458518f73306d9

    SHA1

    de73b25a11a6026afa6513f22ee34aace245a231

    SHA256

    8a8e21d98d953efbee713106994e3783760f319371d7101a80823c56cbee20af

    SHA512

    dfb1ec3056ca4441c54b6ab9b6c778359a9ba52bf313cb8ceb23560f246ef9303a267012df19b51b0e9db7b0716052bbdb0198256d9632f693d8283fe84f7ba4

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

    Filesize

    1KB

    MD5

    89604977a3449d5d1e458518f73306d9

    SHA1

    de73b25a11a6026afa6513f22ee34aace245a231

    SHA256

    8a8e21d98d953efbee713106994e3783760f319371d7101a80823c56cbee20af

    SHA512

    dfb1ec3056ca4441c54b6ab9b6c778359a9ba52bf313cb8ceb23560f246ef9303a267012df19b51b0e9db7b0716052bbdb0198256d9632f693d8283fe84f7ba4

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

    Filesize

    1KB

    MD5

    55f596ebfed69c8819860eaaa02049fa

    SHA1

    a30ac1a04169ed5799f4c4239a3a61bfea1a43e8

    SHA256

    d1640e131265fa2a7624bedef5f8f06ab8b9ebe24ca1f11db0772f61d6437110

    SHA512

    3802f5e5ff7d5217225b21eb9314c45fc19b0c01ba553355dc32239292efa8611bcae01e1e9abad8eb636dfa6cb806f3630b18a32bc8539dfcd62b564467a336

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

    Filesize

    1KB

    MD5

    89604977a3449d5d1e458518f73306d9

    SHA1

    de73b25a11a6026afa6513f22ee34aace245a231

    SHA256

    8a8e21d98d953efbee713106994e3783760f319371d7101a80823c56cbee20af

    SHA512

    dfb1ec3056ca4441c54b6ab9b6c778359a9ba52bf313cb8ceb23560f246ef9303a267012df19b51b0e9db7b0716052bbdb0198256d9632f693d8283fe84f7ba4

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

    Filesize

    1KB

    MD5

    a9885e99c860cea1bf6f924f3b96d0c1

    SHA1

    943c83be9248834ee3877c2e647bea9fc486bc9b

    SHA256

    cb57527c13fae29a06f9c278537407f6be087a929c63592270d5035a2b5993e1

    SHA512

    f290146ac3150c3407ee5e5f45c33e7002db53dd1dea64b9036983996ef5b3e8f0b4522ea0ac7279ba9476e7137818bf4b7da05f328887c47e9d57a4ad80a8bd

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

    Filesize

    1KB

    MD5

    a9885e99c860cea1bf6f924f3b96d0c1

    SHA1

    943c83be9248834ee3877c2e647bea9fc486bc9b

    SHA256

    cb57527c13fae29a06f9c278537407f6be087a929c63592270d5035a2b5993e1

    SHA512

    f290146ac3150c3407ee5e5f45c33e7002db53dd1dea64b9036983996ef5b3e8f0b4522ea0ac7279ba9476e7137818bf4b7da05f328887c47e9d57a4ad80a8bd

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

    Filesize

    1KB

    MD5

    89b5e137d46fa7efbf09d1c259ac4a40

    SHA1

    7b68cc6a3a622e6e8f14b7ef64cf1a4ea3431569

    SHA256

    b3004be5ea1e2689a5a4ee72c38e37830796e9d3a399c7375f94a55fa7535858

    SHA512

    a7f37999e6b2f5bde3e77a5f322bf5fbd8ffad13827c6d0428c7144aabd8fd4c47e5faa9aa0003b63c8da3ef49abbc2059ae573140cd4f953839abc28acb1c9c

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

    Filesize

    1KB

    MD5

    a9885e99c860cea1bf6f924f3b96d0c1

    SHA1

    943c83be9248834ee3877c2e647bea9fc486bc9b

    SHA256

    cb57527c13fae29a06f9c278537407f6be087a929c63592270d5035a2b5993e1

    SHA512

    f290146ac3150c3407ee5e5f45c33e7002db53dd1dea64b9036983996ef5b3e8f0b4522ea0ac7279ba9476e7137818bf4b7da05f328887c47e9d57a4ad80a8bd

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

    Filesize

    1KB

    MD5

    89b5e137d46fa7efbf09d1c259ac4a40

    SHA1

    7b68cc6a3a622e6e8f14b7ef64cf1a4ea3431569

    SHA256

    b3004be5ea1e2689a5a4ee72c38e37830796e9d3a399c7375f94a55fa7535858

    SHA512

    a7f37999e6b2f5bde3e77a5f322bf5fbd8ffad13827c6d0428c7144aabd8fd4c47e5faa9aa0003b63c8da3ef49abbc2059ae573140cd4f953839abc28acb1c9c

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

    Filesize

    1KB

    MD5

    a9885e99c860cea1bf6f924f3b96d0c1

    SHA1

    943c83be9248834ee3877c2e647bea9fc486bc9b

    SHA256

    cb57527c13fae29a06f9c278537407f6be087a929c63592270d5035a2b5993e1

    SHA512

    f290146ac3150c3407ee5e5f45c33e7002db53dd1dea64b9036983996ef5b3e8f0b4522ea0ac7279ba9476e7137818bf4b7da05f328887c47e9d57a4ad80a8bd

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

    Filesize

    1KB

    MD5

    89b5e137d46fa7efbf09d1c259ac4a40

    SHA1

    7b68cc6a3a622e6e8f14b7ef64cf1a4ea3431569

    SHA256

    b3004be5ea1e2689a5a4ee72c38e37830796e9d3a399c7375f94a55fa7535858

    SHA512

    a7f37999e6b2f5bde3e77a5f322bf5fbd8ffad13827c6d0428c7144aabd8fd4c47e5faa9aa0003b63c8da3ef49abbc2059ae573140cd4f953839abc28acb1c9c

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

    Filesize

    1KB

    MD5

    a9885e99c860cea1bf6f924f3b96d0c1

    SHA1

    943c83be9248834ee3877c2e647bea9fc486bc9b

    SHA256

    cb57527c13fae29a06f9c278537407f6be087a929c63592270d5035a2b5993e1

    SHA512

    f290146ac3150c3407ee5e5f45c33e7002db53dd1dea64b9036983996ef5b3e8f0b4522ea0ac7279ba9476e7137818bf4b7da05f328887c47e9d57a4ad80a8bd

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

    Filesize

    1KB

    MD5

    a9885e99c860cea1bf6f924f3b96d0c1

    SHA1

    943c83be9248834ee3877c2e647bea9fc486bc9b

    SHA256

    cb57527c13fae29a06f9c278537407f6be087a929c63592270d5035a2b5993e1

    SHA512

    f290146ac3150c3407ee5e5f45c33e7002db53dd1dea64b9036983996ef5b3e8f0b4522ea0ac7279ba9476e7137818bf4b7da05f328887c47e9d57a4ad80a8bd

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

    Filesize

    1KB

    MD5

    89b5e137d46fa7efbf09d1c259ac4a40

    SHA1

    7b68cc6a3a622e6e8f14b7ef64cf1a4ea3431569

    SHA256

    b3004be5ea1e2689a5a4ee72c38e37830796e9d3a399c7375f94a55fa7535858

    SHA512

    a7f37999e6b2f5bde3e77a5f322bf5fbd8ffad13827c6d0428c7144aabd8fd4c47e5faa9aa0003b63c8da3ef49abbc2059ae573140cd4f953839abc28acb1c9c

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

    Filesize

    1KB

    MD5

    a9885e99c860cea1bf6f924f3b96d0c1

    SHA1

    943c83be9248834ee3877c2e647bea9fc486bc9b

    SHA256

    cb57527c13fae29a06f9c278537407f6be087a929c63592270d5035a2b5993e1

    SHA512

    f290146ac3150c3407ee5e5f45c33e7002db53dd1dea64b9036983996ef5b3e8f0b4522ea0ac7279ba9476e7137818bf4b7da05f328887c47e9d57a4ad80a8bd

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

    Filesize

    1KB

    MD5

    89b5e137d46fa7efbf09d1c259ac4a40

    SHA1

    7b68cc6a3a622e6e8f14b7ef64cf1a4ea3431569

    SHA256

    b3004be5ea1e2689a5a4ee72c38e37830796e9d3a399c7375f94a55fa7535858

    SHA512

    a7f37999e6b2f5bde3e77a5f322bf5fbd8ffad13827c6d0428c7144aabd8fd4c47e5faa9aa0003b63c8da3ef49abbc2059ae573140cd4f953839abc28acb1c9c

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

    Filesize

    1KB

    MD5

    a9885e99c860cea1bf6f924f3b96d0c1

    SHA1

    943c83be9248834ee3877c2e647bea9fc486bc9b

    SHA256

    cb57527c13fae29a06f9c278537407f6be087a929c63592270d5035a2b5993e1

    SHA512

    f290146ac3150c3407ee5e5f45c33e7002db53dd1dea64b9036983996ef5b3e8f0b4522ea0ac7279ba9476e7137818bf4b7da05f328887c47e9d57a4ad80a8bd

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

    Filesize

    1KB

    MD5

    89b5e137d46fa7efbf09d1c259ac4a40

    SHA1

    7b68cc6a3a622e6e8f14b7ef64cf1a4ea3431569

    SHA256

    b3004be5ea1e2689a5a4ee72c38e37830796e9d3a399c7375f94a55fa7535858

    SHA512

    a7f37999e6b2f5bde3e77a5f322bf5fbd8ffad13827c6d0428c7144aabd8fd4c47e5faa9aa0003b63c8da3ef49abbc2059ae573140cd4f953839abc28acb1c9c

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

    MD5

    d41d8cd98f00b204e9800998ecf8427e

    SHA1

    da39a3ee5e6b4b0d3255bfef95601890afd80709

    SHA256

    e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

    SHA512

    cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

    Filesize

    1KB

    MD5

    89b5e137d46fa7efbf09d1c259ac4a40

    SHA1

    7b68cc6a3a622e6e8f14b7ef64cf1a4ea3431569

    SHA256

    b3004be5ea1e2689a5a4ee72c38e37830796e9d3a399c7375f94a55fa7535858

    SHA512

    a7f37999e6b2f5bde3e77a5f322bf5fbd8ffad13827c6d0428c7144aabd8fd4c47e5faa9aa0003b63c8da3ef49abbc2059ae573140cd4f953839abc28acb1c9c

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

    Filesize

    1KB

    MD5

    a9885e99c860cea1bf6f924f3b96d0c1

    SHA1

    943c83be9248834ee3877c2e647bea9fc486bc9b

    SHA256

    cb57527c13fae29a06f9c278537407f6be087a929c63592270d5035a2b5993e1

    SHA512

    f290146ac3150c3407ee5e5f45c33e7002db53dd1dea64b9036983996ef5b3e8f0b4522ea0ac7279ba9476e7137818bf4b7da05f328887c47e9d57a4ad80a8bd

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

    Filesize

    1KB

    MD5

    89b5e137d46fa7efbf09d1c259ac4a40

    SHA1

    7b68cc6a3a622e6e8f14b7ef64cf1a4ea3431569

    SHA256

    b3004be5ea1e2689a5a4ee72c38e37830796e9d3a399c7375f94a55fa7535858

    SHA512

    a7f37999e6b2f5bde3e77a5f322bf5fbd8ffad13827c6d0428c7144aabd8fd4c47e5faa9aa0003b63c8da3ef49abbc2059ae573140cd4f953839abc28acb1c9c

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

    Filesize

    1KB

    MD5

    a9885e99c860cea1bf6f924f3b96d0c1

    SHA1

    943c83be9248834ee3877c2e647bea9fc486bc9b

    SHA256

    cb57527c13fae29a06f9c278537407f6be087a929c63592270d5035a2b5993e1

    SHA512

    f290146ac3150c3407ee5e5f45c33e7002db53dd1dea64b9036983996ef5b3e8f0b4522ea0ac7279ba9476e7137818bf4b7da05f328887c47e9d57a4ad80a8bd

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\start.lnk

    Filesize

    1KB

    MD5

    89b5e137d46fa7efbf09d1c259ac4a40

    SHA1

    7b68cc6a3a622e6e8f14b7ef64cf1a4ea3431569

    SHA256

    b3004be5ea1e2689a5a4ee72c38e37830796e9d3a399c7375f94a55fa7535858

    SHA512

    a7f37999e6b2f5bde3e77a5f322bf5fbd8ffad13827c6d0428c7144aabd8fd4c47e5faa9aa0003b63c8da3ef49abbc2059ae573140cd4f953839abc28acb1c9c

  • memory/1268-224-0x00007FFBDCCD0000-0x00007FFBDCCE0000-memory.dmp

    Filesize

    64KB

  • memory/1268-134-0x00007FFBDCCD0000-0x00007FFBDCCE0000-memory.dmp

    Filesize

    64KB

  • memory/1268-221-0x00007FFBDCCD0000-0x00007FFBDCCE0000-memory.dmp

    Filesize

    64KB

  • memory/1268-222-0x00007FFBDCCD0000-0x00007FFBDCCE0000-memory.dmp

    Filesize

    64KB

  • memory/1268-223-0x00007FFBDCCD0000-0x00007FFBDCCE0000-memory.dmp

    Filesize

    64KB

  • memory/1268-138-0x00007FFBDA980000-0x00007FFBDA990000-memory.dmp

    Filesize

    64KB

  • memory/1268-137-0x00007FFBDA980000-0x00007FFBDA990000-memory.dmp

    Filesize

    64KB

  • memory/1268-132-0x00007FFBDCCD0000-0x00007FFBDCCE0000-memory.dmp

    Filesize

    64KB

  • memory/1268-133-0x00007FFBDCCD0000-0x00007FFBDCCE0000-memory.dmp

    Filesize

    64KB

  • memory/1268-135-0x00007FFBDCCD0000-0x00007FFBDCCE0000-memory.dmp

    Filesize

    64KB

  • memory/1268-136-0x00007FFBDCCD0000-0x00007FFBDCCE0000-memory.dmp

    Filesize

    64KB

  • memory/1324-145-0x0000000000000000-mapping.dmp

  • memory/1936-151-0x0000000000000000-mapping.dmp

  • memory/2796-153-0x0000000000000000-mapping.dmp

  • memory/3292-148-0x0000000000000000-mapping.dmp

  • memory/4384-139-0x0000000000000000-mapping.dmp

  • memory/4680-159-0x0000000000900000-0x0000000000F9A000-memory.dmp

    Filesize

    6.6MB

  • memory/4680-160-0x000000000091E792-mapping.dmp

  • memory/4680-161-0x0000000000900000-0x0000000000938000-memory.dmp

    Filesize

    224KB

  • memory/4680-162-0x0000000005B60000-0x0000000006104000-memory.dmp

    Filesize

    5.6MB

  • memory/4680-163-0x00000000055B0000-0x0000000005642000-memory.dmp

    Filesize

    584KB

  • memory/4680-164-0x00000000056F0000-0x000000000578C000-memory.dmp

    Filesize

    624KB

  • memory/4680-166-0x0000000005650000-0x000000000565A000-memory.dmp

    Filesize

    40KB

  • memory/4680-171-0x0000000006C10000-0x0000000006C76000-memory.dmp

    Filesize

    408KB

  • memory/4720-196-0x00000000069D0000-0x0000000006A20000-memory.dmp

    Filesize

    320KB

  • memory/4720-168-0x0000000000700000-0x0000000000CB2000-memory.dmp

    Filesize

    5.7MB

  • memory/4720-169-0x0000000000737C5E-mapping.dmp

  • memory/4720-170-0x0000000000700000-0x000000000073C000-memory.dmp

    Filesize

    240KB

  • memory/4936-142-0x0000000000000000-mapping.dmp