Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Resubmissions

20/04/2023, 18:50

230420-xg91tabg36 10

20/04/2023, 18:34

230420-w75y4sbf75 10

19/04/2023, 13:11

230419-qe8xeaaf68 10

12/01/2023, 04:39

230112-e91zhaba6w 10

12/01/2023, 02:36

230112-c3xx6aeh99 10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/01/2023, 02:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5eb8103fce78104972cfb45b1242d003f9e66d2da920c7aa5742e185822d3f4d.exe

  • Size

    321KB

  • MD5

    dfc9518f5e0b145f1fa786628670863d

  • SHA1

    a54e4137ccf90fd1326509874063bd58c20fd1ed

  • SHA256

    5eb8103fce78104972cfb45b1242d003f9e66d2da920c7aa5742e185822d3f4d

  • SHA512

    d67aaeccce8629b38c918e97c5ffbd09a6f9395a73cac88e9a7d795e36f0ba6b51a59a4d65e84836bea44568054f00b2f4bb74d4c8d591c01d254f127e110a8e

  • SSDEEP

    3072:xXOGnVaMz9JltM5JxSmp6jUO4QRLaSmKLs8FlguE1igK56n6dF8M/WhJshp2BTBp:VJr1tcxSmJMm6FlgLde6n6dO6Wyg

Score
10/10
amadeyauroradcratdjvusmokeloadervidar19backdoordiscoveryinfostealerpersistenceransomwareratspywarestealertrojan

Malware Config

Extracted

Family

djvu

C2

http://spaceris.com/lancer/get.php

Attributes
  • extension

    .zouu

  • offline_id

    7hl6KB3alcoZ6n4DhS2rApCezkIMzShntAiXWMt1

  • payload_url

    http://uaery.top/dl/build2.exe

    http://spaceris.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-N3pXlaPXFm Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0631JOsie

rsa_pubkey.plain

Extracted

Family

aurora

C2

82.115.223.77:8081

Extracted

Family

vidar

Version

2

Botnet

19

C2

https://t.me/tgdatapacks

https://steamcommunity.com/profiles/76561199469677637
Attributes
  • profile_id

    19

Extracted

Family

amadey

Version

3.66

C2

maximumpushtodaynotnowbut.com/Nmkn5d9Dn/index.php

motiontodaynotgogoodnowok.com/Nmkn5d9Dn/index.php

sogoodnowtodaynow.com/Nmkn5d9Dn/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Aurora

    Aurora is a crypto wallet stealer written in Golang.

    stealeraurora
  • DcRat 5 IoCs

    DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

    ratinfostealerdcrat
  • Detected Djvu ransomware 10 IoCs
  • Detects Smokeloader packer 3 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 19 IoCs
  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 3 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Uses the VBS compiler for execution 1 TTPs
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 36 IoCs
  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 25 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 30 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5eb8103fce78104972cfb45b1242d003f9e66d2da920c7aa5742e185822d3f4d.exe
    "C:\Users\Admin\AppData\Local\Temp\5eb8103fce78104972cfb45b1242d003f9e66d2da920c7aa5742e185822d3f4d.exe"
    1⤵
    • DcRat
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:4944
  • C:\Users\Admin\AppData\Local\Temp\D2B6.exe
    C:\Users\Admin\AppData\Local\Temp\D2B6.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1568
    • C:\Users\Admin\AppData\Local\Temp\D2B6.exe
      C:\Users\Admin\AppData\Local\Temp\D2B6.exe
      2⤵
      • DcRat
      • Executes dropped EXE
      • Checks computer location settings
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3472
      • C:\Windows\SysWOW64\icacls.exe
        icacls "C:\Users\Admin\AppData\Local\1495eff8-c5e1-402f-8f71-e567f8c37ca4" /deny *S-1-1-0:(OI)(CI)(DE,DC)
        3⤵
        • Modifies file permissions
        PID:2260
      • C:\Users\Admin\AppData\Local\Temp\D2B6.exe
        "C:\Users\Admin\AppData\Local\Temp\D2B6.exe" --Admin IsNotAutoStart IsNotTask
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1508
        • C:\Users\Admin\AppData\Local\Temp\D2B6.exe
          "C:\Users\Admin\AppData\Local\Temp\D2B6.exe" --Admin IsNotAutoStart IsNotTask
          4⤵
          • Executes dropped EXE
          • Checks computer location settings
          • Suspicious use of WriteProcessMemory
          PID:1540
          • C:\Users\Admin\AppData\Local\b6438725-72e7-400e-8aa7-e2660c06bcb2\build2.exe
            "C:\Users\Admin\AppData\Local\b6438725-72e7-400e-8aa7-e2660c06bcb2\build2.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            PID:1324
            • C:\Users\Admin\AppData\Local\b6438725-72e7-400e-8aa7-e2660c06bcb2\build2.exe
              "C:\Users\Admin\AppData\Local\b6438725-72e7-400e-8aa7-e2660c06bcb2\build2.exe"
              6⤵
              • Executes dropped EXE
              • Checks computer location settings
              • Loads dropped DLL
              • Checks processor information in registry
              PID:4252
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\b6438725-72e7-400e-8aa7-e2660c06bcb2\build2.exe" & exit
                7⤵
                  PID:548
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout /t 6
                    8⤵
                    • Delays execution with timeout.exe
                    PID:208
            • C:\Users\Admin\AppData\Local\b6438725-72e7-400e-8aa7-e2660c06bcb2\build3.exe
              "C:\Users\Admin\AppData\Local\b6438725-72e7-400e-8aa7-e2660c06bcb2\build3.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:4736
              • C:\Windows\SysWOW64\schtasks.exe
                /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                6⤵
                • DcRat
                • Creates scheduled task(s)
                PID:4116
    • C:\Users\Admin\AppData\Local\Temp\D651.exe
      C:\Users\Admin\AppData\Local\Temp\D651.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:3384
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4164
        • C:\Windows\SysWOW64\Wbem\wmic.exe
          wmic os get Caption
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1180
        • C:\Windows\SysWOW64\cmd.exe
          cmd /C "wmic path win32_VideoController get name"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1252
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            wmic path win32_VideoController get name
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3792
        • C:\Windows\SysWOW64\cmd.exe
          cmd /C "wmic cpu get name"
          3⤵
            PID:3964
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              wmic cpu get name
              4⤵
                PID:4596
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell "" "start-process C:\Users\Admin\AppData\Local\Temp\wTgyfS8RzX.exe"
              3⤵
                PID:5020
                • C:\Users\Admin\AppData\Local\Temp\wTgyfS8RzX.exe
                  "C:\Users\Admin\AppData\Local\Temp\wTgyfS8RzX.exe"
                  4⤵
                  • Executes dropped EXE
                  • Checks SCSI registry key(s)
                  • Suspicious behavior: MapViewOfSection
                  PID:1084
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3384 -s 248
              2⤵
              • Program crash
              PID:2508
          • C:\Users\Admin\AppData\Local\Temp\D950.exe
            C:\Users\Admin\AppData\Local\Temp\D950.exe
            1⤵
            • Executes dropped EXE
            PID:2976
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2976 -s 344
              2⤵
              • Program crash
              PID:1920
          • C:\Users\Admin\AppData\Local\Temp\DAF6.exe
            C:\Users\Admin\AppData\Local\Temp\DAF6.exe
            1⤵
            • Executes dropped EXE
            • Checks SCSI registry key(s)
            • Suspicious behavior: MapViewOfSection
            PID:3520
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2976 -ip 2976
            1⤵
              PID:4296
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3384 -ip 3384
              1⤵
                PID:4552
              • C:\Users\Admin\AppData\Local\Temp\613E.exe
                C:\Users\Admin\AppData\Local\Temp\613E.exe
                1⤵
                • Executes dropped EXE
                PID:4672
                • C:\Windows\SysWOW64\rundll32.exe
                  "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Qytyaworpiotpd.tmp",Edoqqdswdffqipe
                  2⤵
                  • Blocklisted process makes network request
                  • Loads dropped DLL
                  • Suspicious use of SetThreadContext
                  • Checks processor information in registry
                  PID:4348
                  • C:\Windows\system32\rundll32.exe
                    "C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 23789
                    3⤵
                    • Modifies registry class
                    • Suspicious use of FindShellTrayWindow
                    PID:4788
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 4672 -s 304
                  2⤵
                  • Program crash
                  PID:4720
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4672 -ip 4672
                1⤵
                  PID:176
                • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                  1⤵
                  • Executes dropped EXE
                  PID:2900
                  • C:\Windows\SysWOW64\schtasks.exe
                    /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                    2⤵
                    • DcRat
                    • Creates scheduled task(s)
                    PID:1884
                • C:\Users\Admin\AppData\Local\Temp\AE85.exe
                  C:\Users\Admin\AppData\Local\Temp\AE85.exe
                  1⤵
                  • Executes dropped EXE
                  PID:4656
                • C:\Users\Admin\AppData\Local\Temp\BEB2.exe
                  C:\Users\Admin\AppData\Local\Temp\BEB2.exe
                  1⤵
                  • Executes dropped EXE
                  PID:3780
                • C:\Users\Admin\AppData\Local\Temp\C328.exe
                  C:\Users\Admin\AppData\Local\Temp\C328.exe
                  1⤵
                  • Executes dropped EXE
                  PID:4468
                • C:\Users\Admin\AppData\Local\Temp\C972.exe
                  C:\Users\Admin\AppData\Local\Temp\C972.exe
                  1⤵
                  • Executes dropped EXE
                  • Checks computer location settings
                  PID:4552
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 1004
                    2⤵
                    • Program crash
                    PID:3464
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 1012
                    2⤵
                    • Program crash
                    PID:3964
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 1072
                    2⤵
                    • Program crash
                    PID:1872
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 1080
                    2⤵
                    • Program crash
                    PID:3704
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 1112
                    2⤵
                    • Program crash
                    PID:5096
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 1140
                    2⤵
                    • Program crash
                    PID:4584
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 1096
                    2⤵
                    • Program crash
                    PID:5092
                  • C:\Users\Admin\AppData\Local\Temp\727358c059\nbveek.exe
                    "C:\Users\Admin\AppData\Local\Temp\727358c059\nbveek.exe"
                    2⤵
                    • Executes dropped EXE
                    • Checks computer location settings
                    PID:3676
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 596
                      3⤵
                      • Program crash
                      PID:3900
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 740
                      3⤵
                      • Program crash
                      PID:2360
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 740
                      3⤵
                      • Program crash
                      PID:4816
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 964
                      3⤵
                      • Program crash
                      PID:4632
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 956
                      3⤵
                      • Program crash
                      PID:1556
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 956
                      3⤵
                      • Program crash
                      PID:4860
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 1036
                      3⤵
                      • Program crash
                      PID:4264
                    • C:\Windows\SysWOW64\schtasks.exe
                      "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN nbveek.exe /TR "C:\Users\Admin\AppData\Local\Temp\727358c059\nbveek.exe" /F
                      3⤵
                      • DcRat
                      • Creates scheduled task(s)
                      PID:3340
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 900
                      3⤵
                      • Program crash
                      PID:2868
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 832
                      3⤵
                      • Program crash
                      PID:4124
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "nbveek.exe" /P "Admin:N"&&CACLS "nbveek.exe" /P "Admin:R" /E&&echo Y|CACLS "..\727358c059" /P "Admin:N"&&CACLS "..\727358c059" /P "Admin:R" /E&&Exit
                      3⤵
                        PID:4300
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                          4⤵
                            PID:3908
                          • C:\Windows\SysWOW64\cacls.exe
                            CACLS "nbveek.exe" /P "Admin:N"
                            4⤵
                              PID:2056
                            • C:\Windows\SysWOW64\cacls.exe
                              CACLS "nbveek.exe" /P "Admin:R" /E
                              4⤵
                                PID:1244
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /S /D /c" echo Y"
                                4⤵
                                  PID:4716
                                • C:\Windows\SysWOW64\cacls.exe
                                  CACLS "..\727358c059" /P "Admin:N"
                                  4⤵
                                    PID:4588
                                  • C:\Windows\SysWOW64\cacls.exe
                                    CACLS "..\727358c059" /P "Admin:R" /E
                                    4⤵
                                      PID:4248
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 680
                                    3⤵
                                    • Program crash
                                    PID:2560
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 680
                                    3⤵
                                    • Program crash
                                    PID:4900
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 1176
                                    3⤵
                                    • Program crash
                                    PID:3960
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 1192
                                    3⤵
                                    • Program crash
                                    PID:1872
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 1200
                                    3⤵
                                    • Program crash
                                    PID:2200
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 676
                                    3⤵
                                    • Program crash
                                    PID:3696
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 1192
                                    3⤵
                                    • Program crash
                                    PID:1672
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 1364
                                    3⤵
                                    • Program crash
                                    PID:1760
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 1376
                                    3⤵
                                    • Program crash
                                    PID:4328
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 1560
                                    3⤵
                                    • Program crash
                                    PID:1084
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 1648
                                    3⤵
                                    • Program crash
                                    PID:3756
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 1668
                                    3⤵
                                    • Program crash
                                    PID:992
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 1032
                                    3⤵
                                    • Program crash
                                    PID:1536
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 1304
                                  2⤵
                                  • Program crash
                                  PID:4864
                              • C:\Windows\SysWOW64\explorer.exe
                                C:\Windows\SysWOW64\explorer.exe
                                1⤵
                                  PID:4992
                                • C:\Windows\explorer.exe
                                  C:\Windows\explorer.exe
                                  1⤵
                                    PID:3916
                                  • C:\Windows\SysWOW64\explorer.exe
                                    C:\Windows\SysWOW64\explorer.exe
                                    1⤵
                                      PID:928
                                    • C:\Windows\explorer.exe
                                      C:\Windows\explorer.exe
                                      1⤵
                                        PID:1436
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4552 -ip 4552
                                        1⤵
                                          PID:1180
                                        • C:\Windows\SysWOW64\explorer.exe
                                          C:\Windows\SysWOW64\explorer.exe
                                          1⤵
                                            PID:4444
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4552 -ip 4552
                                            1⤵
                                              PID:3984
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4552 -ip 4552
                                              1⤵
                                                PID:3288
                                              • C:\Windows\System32\rundll32.exe
                                                C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                1⤵
                                                  PID:3712
                                                • C:\Windows\SysWOW64\explorer.exe
                                                  C:\Windows\SysWOW64\explorer.exe
                                                  1⤵
                                                    PID:4484
                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4552 -ip 4552
                                                    1⤵
                                                      PID:3896
                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4552 -ip 4552
                                                      1⤵
                                                        PID:3512
                                                      • C:\Windows\SysWOW64\explorer.exe
                                                        C:\Windows\SysWOW64\explorer.exe
                                                        1⤵
                                                          PID:1700
                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4552 -ip 4552
                                                          1⤵
                                                            PID:1672
                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4552 -ip 4552
                                                            1⤵
                                                              PID:2328
                                                            • C:\Windows\explorer.exe
                                                              C:\Windows\explorer.exe
                                                              1⤵
                                                                PID:2512
                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4552 -ip 4552
                                                                1⤵
                                                                  PID:4440
                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                  C:\Windows\SysWOW64\explorer.exe
                                                                  1⤵
                                                                    PID:4568
                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3676 -ip 3676
                                                                    1⤵
                                                                      PID:4044
                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3676 -ip 3676
                                                                      1⤵
                                                                        PID:4720
                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3676 -ip 3676
                                                                        1⤵
                                                                          PID:1280
                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3676 -ip 3676
                                                                          1⤵
                                                                            PID:5024
                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3676 -ip 3676
                                                                            1⤵
                                                                              PID:1432
                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3676 -ip 3676
                                                                              1⤵
                                                                                PID:1560
                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3676 -ip 3676
                                                                                1⤵
                                                                                  PID:2260
                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3676 -ip 3676
                                                                                  1⤵
                                                                                    PID:1764
                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3676 -ip 3676
                                                                                    1⤵
                                                                                      PID:4268
                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3676 -ip 3676
                                                                                      1⤵
                                                                                        PID:1552
                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3676 -ip 3676
                                                                                        1⤵
                                                                                          PID:2224
                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3676 -ip 3676
                                                                                          1⤵
                                                                                            PID:1608
                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 3676 -ip 3676
                                                                                            1⤵
                                                                                              PID:936
                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3676 -ip 3676
                                                                                              1⤵
                                                                                                PID:748
                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 3676 -ip 3676
                                                                                                1⤵
                                                                                                  PID:1240
                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3676 -ip 3676
                                                                                                  1⤵
                                                                                                    PID:2492
                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3676 -ip 3676
                                                                                                    1⤵
                                                                                                      PID:4584
                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                      C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 3676 -ip 3676
                                                                                                      1⤵
                                                                                                        PID:208
                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                        C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3676 -ip 3676
                                                                                                        1⤵
                                                                                                          PID:3628
                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3676 -ip 3676
                                                                                                          1⤵
                                                                                                            PID:3060
                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 3676 -ip 3676
                                                                                                            1⤵
                                                                                                              PID:4044
                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3676 -ip 3676
                                                                                                              1⤵
                                                                                                                PID:4672
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\727358c059\nbveek.exe
                                                                                                                C:\Users\Admin\AppData\Local\Temp\727358c059\nbveek.exe
                                                                                                                1⤵
                                                                                                                • Executes dropped EXE
                                                                                                                PID:4540
                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 560
                                                                                                                  2⤵
                                                                                                                  • Program crash
                                                                                                                  PID:4332
                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 632
                                                                                                                  2⤵
                                                                                                                  • Program crash
                                                                                                                  PID:4172
                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4540 -s 652
                                                                                                                  2⤵
                                                                                                                  • Program crash
                                                                                                                  PID:3852
                                                                                                              • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 4540 -ip 4540
                                                                                                                1⤵
                                                                                                                  PID:5024
                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4540 -ip 4540
                                                                                                                  1⤵
                                                                                                                    PID:1668
                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 4540 -ip 4540
                                                                                                                    1⤵
                                                                                                                      PID:5032

                                                                                                                    Network

                                                                                                                    MITRE ATT&CK Enterprise v6

                                                                                                                    Replay Monitor

                                                                                                                    Loading Replay Monitor...

                                                                                                                    Downloads

                                                                                                                    • C:\ProgramData\mozglue.dll
                                                                                                                      Filesize

                                                                                                                      133KB

                                                                                                                      MD5

                                                                                                                      8f73c08a9660691143661bf7332c3c27

                                                                                                                      SHA1

                                                                                                                      37fa65dd737c50fda710fdbde89e51374d0c204a

                                                                                                                      SHA256

                                                                                                                      3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

                                                                                                                      SHA512

                                                                                                                      0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

                                                                                                                      Download Submit

                                                                                                                    • C:\ProgramData\nss3.dll
                                                                                                                      Filesize

                                                                                                                      1.2MB

                                                                                                                      MD5

                                                                                                                      bfac4e3c5908856ba17d41edcd455a51

                                                                                                                      SHA1

                                                                                                                      8eec7e888767aa9e4cca8ff246eb2aacb9170428

                                                                                                                      SHA256

                                                                                                                      e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

                                                                                                                      SHA512

                                                                                                                      2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
                                                                                                                      Filesize

                                                                                                                      2KB

                                                                                                                      MD5

                                                                                                                      61a9f01083346a0ee40dc68983932b14

                                                                                                                      SHA1

                                                                                                                      85737a00e510acc709a5ea03d04a666bf41eb912

                                                                                                                      SHA256

                                                                                                                      db745e7939f305e69baa8e6fda50687f545b5b9af3cffbd290f1223d7956c1e7

                                                                                                                      SHA512

                                                                                                                      80edf82ede77a5657e92ca9c6ec45fe28118f1f0372d33e377185f7043580ee136927922556795552b41b9bd03aaef9a0273758af375b56ad4470aa23ac88349

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                                                                                                                      Filesize

                                                                                                                      1KB

                                                                                                                      MD5

                                                                                                                      deb5907196e6e5e0e915c276f65a6924

                                                                                                                      SHA1

                                                                                                                      62802115ee04a17e66297fbfd5ab8d933040ffdb

                                                                                                                      SHA256

                                                                                                                      48c65c4f7dfbf070a4e8157cd0ec68e495eb3f963668f3d51ae6fedcff7fcda1

                                                                                                                      SHA512

                                                                                                                      4881fd5f46e1846f4e4dd3cb0295c5b48f62181bba01f8113520d97ee31b1489429281778d1ac0d58d02a3343ad97d24a96ce1d2bdbb1ddda2f77e5101f51c43

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
                                                                                                                      Filesize

                                                                                                                      488B

                                                                                                                      MD5

                                                                                                                      b71bcca76d4c95990bd6cf05be83defb

                                                                                                                      SHA1

                                                                                                                      61b22948f98af740408fe55242e4cc7cb7378edd

                                                                                                                      SHA256

                                                                                                                      6acb558ca9747152f1e4e45f9f7f873e1e3fb75b2d39c7bd34b8405ae2e31641

                                                                                                                      SHA512

                                                                                                                      62da59f9b24ff8fba96cca6cf23132cec0c95d5a7a03d08c99d0ee0f391991982f5158cba46f8f81548e05230676a742ef827660ae2af871d9666dd93aeac838

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
                                                                                                                      Filesize

                                                                                                                      482B

                                                                                                                      MD5

                                                                                                                      0b10fa06556c5eed1486a8d4982712e6

                                                                                                                      SHA1

                                                                                                                      718a9c0316975340e91a72ebe5e8cb0176b2e7c0

                                                                                                                      SHA256

                                                                                                                      14c43f40b3b206a4ba64348950be6f82b9bc2a72d2d8ebbfbd5c551ae324da34

                                                                                                                      SHA512

                                                                                                                      14ab55cb0497ff2c1bebe057e5a894e869eaf59493563d278c099608658250572c4fef8cfc3712977f26ced8f6a018a4bd5ecc9672fce76d912c2aad4e10fed4

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\1495eff8-c5e1-402f-8f71-e567f8c37ca4\D2B6.exe
                                                                                                                      Filesize

                                                                                                                      827KB

                                                                                                                      MD5

                                                                                                                      5d09682b08307cf7e7d4ee43b3b04791

                                                                                                                      SHA1

                                                                                                                      8668ef968def3d1e58bc5d3bb57088f0550a3b2d

                                                                                                                      SHA256

                                                                                                                      b0fe9334ec54815e8eda224488e34d41fcdaef253cad3c7cb751b273b3dc91e3

                                                                                                                      SHA512

                                                                                                                      a362e95e79b100178bce102b015e3d0107cd3df808980d84b63bc940ee7c90221f06cc2dc9f087b7e15e20ec994418483f5b913d954badf60d70f6c56b96f4d0

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\613E.exe
                                                                                                                      Filesize

                                                                                                                      1.1MB

                                                                                                                      MD5

                                                                                                                      b6786f0d9acc74fdc0f784ca1bfd4882

                                                                                                                      SHA1

                                                                                                                      9144e6576b2ec0053f6d20162a11632309da8c46

                                                                                                                      SHA256

                                                                                                                      67b4ba32ea235352c931e41a1aa26927225a9a9919649c56bde80b9ae251bdd4

                                                                                                                      SHA512

                                                                                                                      5e5f8c75371e085b840cb47400b51d91e22530b14851c102fc9ba2e27ef71aa0506c41dbbe2630bdf67e431e78950d18eb9da4babbc779ae4cbeffb24fef61e0

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\613E.exe
                                                                                                                      Filesize

                                                                                                                      1.1MB

                                                                                                                      MD5

                                                                                                                      b6786f0d9acc74fdc0f784ca1bfd4882

                                                                                                                      SHA1

                                                                                                                      9144e6576b2ec0053f6d20162a11632309da8c46

                                                                                                                      SHA256

                                                                                                                      67b4ba32ea235352c931e41a1aa26927225a9a9919649c56bde80b9ae251bdd4

                                                                                                                      SHA512

                                                                                                                      5e5f8c75371e085b840cb47400b51d91e22530b14851c102fc9ba2e27ef71aa0506c41dbbe2630bdf67e431e78950d18eb9da4babbc779ae4cbeffb24fef61e0

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\727358c059\nbveek.exe
                                                                                                                      Filesize

                                                                                                                      369KB

                                                                                                                      MD5

                                                                                                                      696b5dcd846abc35c85f77bc2636a254

                                                                                                                      SHA1

                                                                                                                      73955d9da5cf1e26aa26375e922e54b9b4968649

                                                                                                                      SHA256

                                                                                                                      4b489ff469086c2eba75c5b3752bcee295db567f328f3c28a3309edadc4f79da

                                                                                                                      SHA512

                                                                                                                      e5a782b8aa8ad8fc27e44b675ba527e7029920a57860dc7989a3b04ab93a6bef31de253d5329a6eb5eeed66b7af6211cb0c494257b088dc00d681d637854421d

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\727358c059\nbveek.exe
                                                                                                                      Filesize

                                                                                                                      369KB

                                                                                                                      MD5

                                                                                                                      696b5dcd846abc35c85f77bc2636a254

                                                                                                                      SHA1

                                                                                                                      73955d9da5cf1e26aa26375e922e54b9b4968649

                                                                                                                      SHA256

                                                                                                                      4b489ff469086c2eba75c5b3752bcee295db567f328f3c28a3309edadc4f79da

                                                                                                                      SHA512

                                                                                                                      e5a782b8aa8ad8fc27e44b675ba527e7029920a57860dc7989a3b04ab93a6bef31de253d5329a6eb5eeed66b7af6211cb0c494257b088dc00d681d637854421d

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\727358c059\nbveek.exe
                                                                                                                      Filesize

                                                                                                                      369KB

                                                                                                                      MD5

                                                                                                                      696b5dcd846abc35c85f77bc2636a254

                                                                                                                      SHA1

                                                                                                                      73955d9da5cf1e26aa26375e922e54b9b4968649

                                                                                                                      SHA256

                                                                                                                      4b489ff469086c2eba75c5b3752bcee295db567f328f3c28a3309edadc4f79da

                                                                                                                      SHA512

                                                                                                                      e5a782b8aa8ad8fc27e44b675ba527e7029920a57860dc7989a3b04ab93a6bef31de253d5329a6eb5eeed66b7af6211cb0c494257b088dc00d681d637854421d

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\AE85.exe
                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                      MD5

                                                                                                                      9748489855d9dd82ab09da5e3e55b19e

                                                                                                                      SHA1

                                                                                                                      6ed2bf6a1a53a59cd2137812cb43b5032817f6a1

                                                                                                                      SHA256

                                                                                                                      05bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b

                                                                                                                      SHA512

                                                                                                                      7eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\AE85.exe
                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                      MD5

                                                                                                                      9748489855d9dd82ab09da5e3e55b19e

                                                                                                                      SHA1

                                                                                                                      6ed2bf6a1a53a59cd2137812cb43b5032817f6a1

                                                                                                                      SHA256

                                                                                                                      05bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b

                                                                                                                      SHA512

                                                                                                                      7eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\BEB2.exe
                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                      MD5

                                                                                                                      9748489855d9dd82ab09da5e3e55b19e

                                                                                                                      SHA1

                                                                                                                      6ed2bf6a1a53a59cd2137812cb43b5032817f6a1

                                                                                                                      SHA256

                                                                                                                      05bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b

                                                                                                                      SHA512

                                                                                                                      7eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\BEB2.exe
                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                      MD5

                                                                                                                      9748489855d9dd82ab09da5e3e55b19e

                                                                                                                      SHA1

                                                                                                                      6ed2bf6a1a53a59cd2137812cb43b5032817f6a1

                                                                                                                      SHA256

                                                                                                                      05bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b

                                                                                                                      SHA512

                                                                                                                      7eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\C328.exe
                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                      MD5

                                                                                                                      9748489855d9dd82ab09da5e3e55b19e

                                                                                                                      SHA1

                                                                                                                      6ed2bf6a1a53a59cd2137812cb43b5032817f6a1

                                                                                                                      SHA256

                                                                                                                      05bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b

                                                                                                                      SHA512

                                                                                                                      7eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\C328.exe
                                                                                                                      Filesize

                                                                                                                      4KB

                                                                                                                      MD5

                                                                                                                      9748489855d9dd82ab09da5e3e55b19e

                                                                                                                      SHA1

                                                                                                                      6ed2bf6a1a53a59cd2137812cb43b5032817f6a1

                                                                                                                      SHA256

                                                                                                                      05bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b

                                                                                                                      SHA512

                                                                                                                      7eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\C972.exe
                                                                                                                      Filesize

                                                                                                                      369KB

                                                                                                                      MD5

                                                                                                                      696b5dcd846abc35c85f77bc2636a254

                                                                                                                      SHA1

                                                                                                                      73955d9da5cf1e26aa26375e922e54b9b4968649

                                                                                                                      SHA256

                                                                                                                      4b489ff469086c2eba75c5b3752bcee295db567f328f3c28a3309edadc4f79da

                                                                                                                      SHA512

                                                                                                                      e5a782b8aa8ad8fc27e44b675ba527e7029920a57860dc7989a3b04ab93a6bef31de253d5329a6eb5eeed66b7af6211cb0c494257b088dc00d681d637854421d

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\C972.exe
                                                                                                                      Filesize

                                                                                                                      369KB

                                                                                                                      MD5

                                                                                                                      696b5dcd846abc35c85f77bc2636a254

                                                                                                                      SHA1

                                                                                                                      73955d9da5cf1e26aa26375e922e54b9b4968649

                                                                                                                      SHA256

                                                                                                                      4b489ff469086c2eba75c5b3752bcee295db567f328f3c28a3309edadc4f79da

                                                                                                                      SHA512

                                                                                                                      e5a782b8aa8ad8fc27e44b675ba527e7029920a57860dc7989a3b04ab93a6bef31de253d5329a6eb5eeed66b7af6211cb0c494257b088dc00d681d637854421d

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\D2B6.exe
                                                                                                                      Filesize

                                                                                                                      827KB

                                                                                                                      MD5

                                                                                                                      5d09682b08307cf7e7d4ee43b3b04791

                                                                                                                      SHA1

                                                                                                                      8668ef968def3d1e58bc5d3bb57088f0550a3b2d

                                                                                                                      SHA256

                                                                                                                      b0fe9334ec54815e8eda224488e34d41fcdaef253cad3c7cb751b273b3dc91e3

                                                                                                                      SHA512

                                                                                                                      a362e95e79b100178bce102b015e3d0107cd3df808980d84b63bc940ee7c90221f06cc2dc9f087b7e15e20ec994418483f5b913d954badf60d70f6c56b96f4d0

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\D2B6.exe
                                                                                                                      Filesize

                                                                                                                      827KB

                                                                                                                      MD5

                                                                                                                      5d09682b08307cf7e7d4ee43b3b04791

                                                                                                                      SHA1

                                                                                                                      8668ef968def3d1e58bc5d3bb57088f0550a3b2d

                                                                                                                      SHA256

                                                                                                                      b0fe9334ec54815e8eda224488e34d41fcdaef253cad3c7cb751b273b3dc91e3

                                                                                                                      SHA512

                                                                                                                      a362e95e79b100178bce102b015e3d0107cd3df808980d84b63bc940ee7c90221f06cc2dc9f087b7e15e20ec994418483f5b913d954badf60d70f6c56b96f4d0

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\D2B6.exe
                                                                                                                      Filesize

                                                                                                                      827KB

                                                                                                                      MD5

                                                                                                                      5d09682b08307cf7e7d4ee43b3b04791

                                                                                                                      SHA1

                                                                                                                      8668ef968def3d1e58bc5d3bb57088f0550a3b2d

                                                                                                                      SHA256

                                                                                                                      b0fe9334ec54815e8eda224488e34d41fcdaef253cad3c7cb751b273b3dc91e3

                                                                                                                      SHA512

                                                                                                                      a362e95e79b100178bce102b015e3d0107cd3df808980d84b63bc940ee7c90221f06cc2dc9f087b7e15e20ec994418483f5b913d954badf60d70f6c56b96f4d0

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\D2B6.exe
                                                                                                                      Filesize

                                                                                                                      827KB

                                                                                                                      MD5

                                                                                                                      5d09682b08307cf7e7d4ee43b3b04791

                                                                                                                      SHA1

                                                                                                                      8668ef968def3d1e58bc5d3bb57088f0550a3b2d

                                                                                                                      SHA256

                                                                                                                      b0fe9334ec54815e8eda224488e34d41fcdaef253cad3c7cb751b273b3dc91e3

                                                                                                                      SHA512

                                                                                                                      a362e95e79b100178bce102b015e3d0107cd3df808980d84b63bc940ee7c90221f06cc2dc9f087b7e15e20ec994418483f5b913d954badf60d70f6c56b96f4d0

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\D2B6.exe
                                                                                                                      Filesize

                                                                                                                      827KB

                                                                                                                      MD5

                                                                                                                      5d09682b08307cf7e7d4ee43b3b04791

                                                                                                                      SHA1

                                                                                                                      8668ef968def3d1e58bc5d3bb57088f0550a3b2d

                                                                                                                      SHA256

                                                                                                                      b0fe9334ec54815e8eda224488e34d41fcdaef253cad3c7cb751b273b3dc91e3

                                                                                                                      SHA512

                                                                                                                      a362e95e79b100178bce102b015e3d0107cd3df808980d84b63bc940ee7c90221f06cc2dc9f087b7e15e20ec994418483f5b913d954badf60d70f6c56b96f4d0

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\D651.exe
                                                                                                                      Filesize

                                                                                                                      4.5MB

                                                                                                                      MD5

                                                                                                                      1a450a1a716cdb1bc3bd0b7467c2f157

                                                                                                                      SHA1

                                                                                                                      195d2f7052897360b07cf68a9f05794fcb41d88e

                                                                                                                      SHA256

                                                                                                                      88076120630d47c184b949cb272e69a1df48244300e1f10b09443ef3140d554b

                                                                                                                      SHA512

                                                                                                                      de0ba52dc6e62b2da6105c2149e1b3040762634617b6918378ad8c65ef4f59516adeaa6ba74e52369694ab0eeed3ed3a7dc78c275920c27936d467d5168b1188

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\D651.exe
                                                                                                                      Filesize

                                                                                                                      4.5MB

                                                                                                                      MD5

                                                                                                                      1a450a1a716cdb1bc3bd0b7467c2f157

                                                                                                                      SHA1

                                                                                                                      195d2f7052897360b07cf68a9f05794fcb41d88e

                                                                                                                      SHA256

                                                                                                                      88076120630d47c184b949cb272e69a1df48244300e1f10b09443ef3140d554b

                                                                                                                      SHA512

                                                                                                                      de0ba52dc6e62b2da6105c2149e1b3040762634617b6918378ad8c65ef4f59516adeaa6ba74e52369694ab0eeed3ed3a7dc78c275920c27936d467d5168b1188

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\D950.exe
                                                                                                                      Filesize

                                                                                                                      321KB

                                                                                                                      MD5

                                                                                                                      3a629beee6d3cc3eb184232e34fb2472

                                                                                                                      SHA1

                                                                                                                      2199ed0ba2080232f0c38db2d9b90af83b361414

                                                                                                                      SHA256

                                                                                                                      01bb80302b0bc9dd75fe89b3b6039eab7adb2bbd96b5e5cf0490665bcfa73b4a

                                                                                                                      SHA512

                                                                                                                      c6e97d3c894d652da94467a879df81fc16c11caf3ed39ab64d1a9aabe682a223e024547241d9431c720f01e448c08b85987dc12de6ed8078df51d2373601fd55

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\D950.exe
                                                                                                                      Filesize

                                                                                                                      321KB

                                                                                                                      MD5

                                                                                                                      3a629beee6d3cc3eb184232e34fb2472

                                                                                                                      SHA1

                                                                                                                      2199ed0ba2080232f0c38db2d9b90af83b361414

                                                                                                                      SHA256

                                                                                                                      01bb80302b0bc9dd75fe89b3b6039eab7adb2bbd96b5e5cf0490665bcfa73b4a

                                                                                                                      SHA512

                                                                                                                      c6e97d3c894d652da94467a879df81fc16c11caf3ed39ab64d1a9aabe682a223e024547241d9431c720f01e448c08b85987dc12de6ed8078df51d2373601fd55

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\DAF6.exe
                                                                                                                      Filesize

                                                                                                                      320KB

                                                                                                                      MD5

                                                                                                                      ab088adec027a227808f33d4007e4626

                                                                                                                      SHA1

                                                                                                                      53ec99c530366d22ebb889272d3e9ab04ba608ac

                                                                                                                      SHA256

                                                                                                                      95df5a1e6f0e456b2c68743474926c76a2897c54e971cbb0668efa19c2e24744

                                                                                                                      SHA512

                                                                                                                      045e887fe2173bbd87c486c31a28d12c41be045ad299032b1b166a958fe218db5fdaf88112124c54de1ce636bedc55eabb4dd761d22d20ce57b7412f99311587

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\DAF6.exe
                                                                                                                      Filesize

                                                                                                                      320KB

                                                                                                                      MD5

                                                                                                                      ab088adec027a227808f33d4007e4626

                                                                                                                      SHA1

                                                                                                                      53ec99c530366d22ebb889272d3e9ab04ba608ac

                                                                                                                      SHA256

                                                                                                                      95df5a1e6f0e456b2c68743474926c76a2897c54e971cbb0668efa19c2e24744

                                                                                                                      SHA512

                                                                                                                      045e887fe2173bbd87c486c31a28d12c41be045ad299032b1b166a958fe218db5fdaf88112124c54de1ce636bedc55eabb4dd761d22d20ce57b7412f99311587

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Qytyaworpiotpd.tmp
                                                                                                                      Filesize

                                                                                                                      752KB

                                                                                                                      MD5

                                                                                                                      710af73b2d7e92d33fac751318c08101

                                                                                                                      SHA1

                                                                                                                      2208c96a528b1d96e18ae47ab274f303e4099fff

                                                                                                                      SHA256

                                                                                                                      72021339c18f79141f9867c30616cbbdc517471e44d16bfe81063e5c7dba56c3

                                                                                                                      SHA512

                                                                                                                      1f19138b8412b871ccf33ec351d28157b6571bc02cb1d338fc4c06bd77e9518bbdb3392d63b9bcdde2bd94746c232f90b4796363f83cecfd49e0470b6495ac1a

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Qytyaworpiotpd.tmp
                                                                                                                      Filesize

                                                                                                                      752KB

                                                                                                                      MD5

                                                                                                                      710af73b2d7e92d33fac751318c08101

                                                                                                                      SHA1

                                                                                                                      2208c96a528b1d96e18ae47ab274f303e4099fff

                                                                                                                      SHA256

                                                                                                                      72021339c18f79141f9867c30616cbbdc517471e44d16bfe81063e5c7dba56c3

                                                                                                                      SHA512

                                                                                                                      1f19138b8412b871ccf33ec351d28157b6571bc02cb1d338fc4c06bd77e9518bbdb3392d63b9bcdde2bd94746c232f90b4796363f83cecfd49e0470b6495ac1a

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\hzAvuq.bin
                                                                                                                      Filesize

                                                                                                                      3B

                                                                                                                      MD5

                                                                                                                      844afd44ff5361df28129df1e3ef8915

                                                                                                                      SHA1

                                                                                                                      e925cc2bdc642a0866a7dd5a95f1f9d220b5856e

                                                                                                                      SHA256

                                                                                                                      24ba1e99dc06b19351323aae0d7370243d586475a634b7f6ff7927fbc72cfaed

                                                                                                                      SHA512

                                                                                                                      c6775d4704c041de26b0b56e2682f68fc63ce496bfdad155dcb794ade68183f2ff2da8ecf1e8c6c70f6bfab074e7a2c238decc9ce25c244d1127834cf7429d56

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\wTgyfS8RzX.exe
                                                                                                                      Filesize

                                                                                                                      214KB

                                                                                                                      MD5

                                                                                                                      c6917bc242058814f64360de5b4320be

                                                                                                                      SHA1

                                                                                                                      4c1959cc707acb43a1466d166e151c517164edc2

                                                                                                                      SHA256

                                                                                                                      732c3e3887c7e83b84fd96c6a8a2377235a29995c8656c1616dee40f8be81516

                                                                                                                      SHA512

                                                                                                                      2bf75a0ebcbd5ff7b65a47b9b8016081c272acb6b4fe1b487a6928e682dd93e5809cd2354f4d21acbef0703c4d1b6c87af4c0d731e2799be1a6197815ec1b6bb

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\wTgyfS8RzX.exe
                                                                                                                      Filesize

                                                                                                                      214KB

                                                                                                                      MD5

                                                                                                                      c6917bc242058814f64360de5b4320be

                                                                                                                      SHA1

                                                                                                                      4c1959cc707acb43a1466d166e151c517164edc2

                                                                                                                      SHA256

                                                                                                                      732c3e3887c7e83b84fd96c6a8a2377235a29995c8656c1616dee40f8be81516

                                                                                                                      SHA512

                                                                                                                      2bf75a0ebcbd5ff7b65a47b9b8016081c272acb6b4fe1b487a6928e682dd93e5809cd2354f4d21acbef0703c4d1b6c87af4c0d731e2799be1a6197815ec1b6bb

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\b6438725-72e7-400e-8aa7-e2660c06bcb2\build2.exe
                                                                                                                      Filesize

                                                                                                                      422KB

                                                                                                                      MD5

                                                                                                                      866933fee5234be619d89a6d6a60bd88

                                                                                                                      SHA1

                                                                                                                      fd279d026264dbb75ea46be965ea163d94d67f0c

                                                                                                                      SHA256

                                                                                                                      ab6396ad69a961a9f879e58725ed66fa01f7add478b61cbaf4db1f26a9e47185

                                                                                                                      SHA512

                                                                                                                      fab7b9cfa5c38cff35068334b8525fcc1c6a5ca694f379db3322fc1bd8df9bbfa3446504297fec4c42c55e805fee2be9f96a3eff8eed7db72816a080aff7933d

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\b6438725-72e7-400e-8aa7-e2660c06bcb2\build2.exe
                                                                                                                      Filesize

                                                                                                                      422KB

                                                                                                                      MD5

                                                                                                                      866933fee5234be619d89a6d6a60bd88

                                                                                                                      SHA1

                                                                                                                      fd279d026264dbb75ea46be965ea163d94d67f0c

                                                                                                                      SHA256

                                                                                                                      ab6396ad69a961a9f879e58725ed66fa01f7add478b61cbaf4db1f26a9e47185

                                                                                                                      SHA512

                                                                                                                      fab7b9cfa5c38cff35068334b8525fcc1c6a5ca694f379db3322fc1bd8df9bbfa3446504297fec4c42c55e805fee2be9f96a3eff8eed7db72816a080aff7933d

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\b6438725-72e7-400e-8aa7-e2660c06bcb2\build2.exe
                                                                                                                      Filesize

                                                                                                                      422KB

                                                                                                                      MD5

                                                                                                                      866933fee5234be619d89a6d6a60bd88

                                                                                                                      SHA1

                                                                                                                      fd279d026264dbb75ea46be965ea163d94d67f0c

                                                                                                                      SHA256

                                                                                                                      ab6396ad69a961a9f879e58725ed66fa01f7add478b61cbaf4db1f26a9e47185

                                                                                                                      SHA512

                                                                                                                      fab7b9cfa5c38cff35068334b8525fcc1c6a5ca694f379db3322fc1bd8df9bbfa3446504297fec4c42c55e805fee2be9f96a3eff8eed7db72816a080aff7933d

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\b6438725-72e7-400e-8aa7-e2660c06bcb2\build3.exe
                                                                                                                      Filesize

                                                                                                                      9KB

                                                                                                                      MD5

                                                                                                                      9ead10c08e72ae41921191f8db39bc16

                                                                                                                      SHA1

                                                                                                                      abe3bce01cd34afc88e2c838173f8c2bd0090ae1

                                                                                                                      SHA256

                                                                                                                      8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

                                                                                                                      SHA512

                                                                                                                      aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Local\b6438725-72e7-400e-8aa7-e2660c06bcb2\build3.exe
                                                                                                                      Filesize

                                                                                                                      9KB

                                                                                                                      MD5

                                                                                                                      9ead10c08e72ae41921191f8db39bc16

                                                                                                                      SHA1

                                                                                                                      abe3bce01cd34afc88e2c838173f8c2bd0090ae1

                                                                                                                      SHA256

                                                                                                                      8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

                                                                                                                      SHA512

                                                                                                                      aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                                      Filesize

                                                                                                                      9KB

                                                                                                                      MD5

                                                                                                                      9ead10c08e72ae41921191f8db39bc16

                                                                                                                      SHA1

                                                                                                                      abe3bce01cd34afc88e2c838173f8c2bd0090ae1

                                                                                                                      SHA256

                                                                                                                      8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

                                                                                                                      SHA512

                                                                                                                      aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

                                                                                                                      Download Submit

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                                                                                                                      Filesize

                                                                                                                      9KB

                                                                                                                      MD5

                                                                                                                      9ead10c08e72ae41921191f8db39bc16

                                                                                                                      SHA1

                                                                                                                      abe3bce01cd34afc88e2c838173f8c2bd0090ae1

                                                                                                                      SHA256

                                                                                                                      8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

                                                                                                                      SHA512

                                                                                                                      aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

                                                                                                                      Download Submit

                                                                                                                    • memory/928-296-0x0000000000700000-0x0000000000709000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      36KB

                                                                                                                      Download

                                                                                                                    • memory/928-295-0x0000000000710000-0x0000000000715000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      20KB

                                                                                                                      Download

                                                                                                                    • memory/1084-250-0x0000000002F39000-0x0000000002F49000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      64KB

                                                                                                                      Download

                                                                                                                    • memory/1084-256-0x0000000000400000-0x0000000002B9D000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      39.6MB

                                                                                                                      Download

                                                                                                                    • memory/1084-251-0x0000000004790000-0x0000000004799000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      36KB

                                                                                                                      Download

                                                                                                                    • memory/1084-252-0x0000000000400000-0x0000000002B9D000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      39.6MB

                                                                                                                      Download

                                                                                                                    • memory/1324-208-0x00000000020F0000-0x000000000213C000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      304KB

                                                                                                                      Download

                                                                                                                    • memory/1324-206-0x000000000051D000-0x000000000054A000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      180KB

                                                                                                                      Download

                                                                                                                    • memory/1436-310-0x0000000000B90000-0x0000000000B96000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      24KB

                                                                                                                      Download

                                                                                                                    • memory/1436-311-0x0000000000B80000-0x0000000000B8C000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      48KB

                                                                                                                      Download

                                                                                                                    • memory/1508-171-0x00000000005E5000-0x0000000000676000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      580KB

                                                                                                                      Download

                                                                                                                    • memory/1540-214-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.2MB

                                                                                                                      Download

                                                                                                                    • memory/1540-170-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.2MB

                                                                                                                      Download

                                                                                                                    • memory/1540-169-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.2MB

                                                                                                                      Download

                                                                                                                    • memory/1540-172-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.2MB

                                                                                                                      Download

                                                                                                                    • memory/1568-197-0x0000000002200000-0x000000000231B000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.1MB

                                                                                                                      Download

                                                                                                                    • memory/1568-152-0x000000000200A000-0x000000000209B000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      580KB

                                                                                                                      Download

                                                                                                                    • memory/1568-153-0x0000000002200000-0x000000000231B000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.1MB

                                                                                                                      Download

                                                                                                                    • memory/1700-319-0x0000000000DA0000-0x0000000000DA6000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      24KB

                                                                                                                      Download

                                                                                                                    • memory/2976-157-0x0000000000570000-0x0000000000579000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      36KB

                                                                                                                      Download

                                                                                                                    • memory/2976-156-0x000000000059D000-0x00000000005B3000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      88KB

                                                                                                                      Download

                                                                                                                    • memory/2976-160-0x0000000000400000-0x0000000000456000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      344KB

                                                                                                                      Download

                                                                                                                    • memory/3384-192-0x0000000000170000-0x00000000005EE000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4.5MB

                                                                                                                      Download

                                                                                                                    • memory/3472-149-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.2MB

                                                                                                                      Download

                                                                                                                    • memory/3472-155-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.2MB

                                                                                                                      Download

                                                                                                                    • memory/3472-151-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.2MB

                                                                                                                      Download

                                                                                                                    • memory/3472-165-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.2MB

                                                                                                                      Download

                                                                                                                    • memory/3472-154-0x0000000000400000-0x0000000000537000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.2MB

                                                                                                                      Download

                                                                                                                    • memory/3520-159-0x0000000000400000-0x0000000000456000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      344KB

                                                                                                                      Download

                                                                                                                    • memory/3520-158-0x00000000006DD000-0x00000000006F3000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      88KB

                                                                                                                      Download

                                                                                                                    • memory/3520-177-0x0000000000400000-0x0000000000456000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      344KB

                                                                                                                      Download

                                                                                                                    • memory/3780-279-0x00007FFBCD930000-0x00007FFBCE3F1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      10.8MB

                                                                                                                      Download

                                                                                                                    • memory/3916-292-0x00000000007B0000-0x00000000007BF000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      60KB

                                                                                                                      Download

                                                                                                                    • memory/3916-291-0x00000000007C0000-0x00000000007C9000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      36KB

                                                                                                                      Download

                                                                                                                    • memory/4164-182-0x0000000000400000-0x0000000000876000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4.5MB

                                                                                                                      Download

                                                                                                                    • memory/4164-191-0x0000000000400000-0x0000000000876000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      4.5MB

                                                                                                                      Download

                                                                                                                    • memory/4252-204-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      384KB

                                                                                                                      Download

                                                                                                                    • memory/4252-248-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      384KB

                                                                                                                      Download

                                                                                                                    • memory/4252-210-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      384KB

                                                                                                                      Download

                                                                                                                    • memory/4252-209-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      384KB

                                                                                                                      Download

                                                                                                                    • memory/4252-207-0x0000000000400000-0x0000000000460000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      384KB

                                                                                                                      Download

                                                                                                                    • memory/4252-226-0x00000000509B0000-0x0000000050A42000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      584KB

                                                                                                                      Download

                                                                                                                    • memory/4348-275-0x0000000004E90000-0x0000000004FD0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.2MB

                                                                                                                      Download

                                                                                                                    • memory/4348-274-0x0000000004E90000-0x0000000004FD0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.2MB

                                                                                                                      Download

                                                                                                                    • memory/4348-273-0x00000000069D0000-0x000000000752B000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      11.4MB

                                                                                                                      Download

                                                                                                                    • memory/4348-304-0x0000000004F09000-0x0000000004F0B000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      8KB

                                                                                                                      Download

                                                                                                                    • memory/4348-299-0x0000000004E90000-0x0000000004FD0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.2MB

                                                                                                                      Download

                                                                                                                    • memory/4348-271-0x00000000069D0000-0x000000000752B000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      11.4MB

                                                                                                                      Download

                                                                                                                    • memory/4348-298-0x0000000004E90000-0x0000000004FD0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.2MB

                                                                                                                      Download

                                                                                                                    • memory/4348-297-0x0000000004E90000-0x0000000004FD0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.2MB

                                                                                                                      Download

                                                                                                                    • memory/4348-294-0x0000000004E90000-0x0000000004FD0000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.2MB

                                                                                                                      Download

                                                                                                                    • memory/4444-315-0x0000000001370000-0x0000000001397000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      156KB

                                                                                                                      Download

                                                                                                                    • memory/4444-313-0x00000000013A0000-0x00000000013C2000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      136KB

                                                                                                                      Download

                                                                                                                    • memory/4468-283-0x00007FFBCD930000-0x00007FFBCE3F1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      10.8MB

                                                                                                                      Download

                                                                                                                    • memory/4484-317-0x0000000000C90000-0x0000000000C95000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      20KB

                                                                                                                      Download

                                                                                                                    • memory/4484-318-0x0000000000C80000-0x0000000000C89000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      36KB

                                                                                                                      Download

                                                                                                                    • memory/4552-307-0x0000000000400000-0x0000000000462000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      392KB

                                                                                                                      Download

                                                                                                                    • memory/4552-305-0x00000000006DD000-0x00000000006FD000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      128KB

                                                                                                                      Download

                                                                                                                    • memory/4552-306-0x00000000020D0000-0x000000000210F000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      252KB

                                                                                                                      Download

                                                                                                                    • memory/4656-270-0x00007FFBCD930000-0x00007FFBCE3F1000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      10.8MB

                                                                                                                      Download

                                                                                                                    • memory/4656-269-0x0000000000B80000-0x0000000000B88000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      32KB

                                                                                                                      Download

                                                                                                                    • memory/4672-260-0x000000000213F000-0x0000000002220000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      900KB

                                                                                                                      Download

                                                                                                                    • memory/4672-262-0x0000000000400000-0x0000000000523000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.1MB

                                                                                                                      Download

                                                                                                                    • memory/4672-261-0x0000000002330000-0x0000000002450000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.1MB

                                                                                                                      Download

                                                                                                                    • memory/4788-309-0x0000014BAF490000-0x0000014BAF74B000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      2.7MB

                                                                                                                      Download

                                                                                                                    • memory/4788-308-0x00000000000E0000-0x000000000038A000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      2.7MB

                                                                                                                      Download

                                                                                                                    • memory/4788-303-0x0000014BB0EF0000-0x0000014BB1030000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.2MB

                                                                                                                      Download

                                                                                                                    • memory/4788-302-0x0000014BB0EF0000-0x0000014BB1030000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      1.2MB

                                                                                                                      Download

                                                                                                                    • memory/4944-133-0x0000000002190000-0x0000000002199000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      36KB

                                                                                                                      Download

                                                                                                                    • memory/4944-135-0x0000000000400000-0x0000000000456000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      344KB

                                                                                                                      Download

                                                                                                                    • memory/4944-132-0x00000000004AE000-0x00000000004C4000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      88KB

                                                                                                                      Download

                                                                                                                    • memory/4944-134-0x0000000000400000-0x0000000000456000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      344KB

                                                                                                                      Download

                                                                                                                    • memory/4992-288-0x0000000000340000-0x0000000000347000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      28KB

                                                                                                                      Download

                                                                                                                    • memory/4992-289-0x0000000000330000-0x000000000033B000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      44KB

                                                                                                                      Download

                                                                                                                    • memory/5020-213-0x0000000005190000-0x00000000057B8000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      6.2MB

                                                                                                                      Download

                                                                                                                    • memory/5020-212-0x0000000002660000-0x0000000002696000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      216KB

                                                                                                                      Download

                                                                                                                    • memory/5020-219-0x0000000006F40000-0x0000000006FD6000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      600KB

                                                                                                                      Download

                                                                                                                    • memory/5020-217-0x0000000005930000-0x0000000005996000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      408KB

                                                                                                                      Download

                                                                                                                    • memory/5020-218-0x0000000005F90000-0x0000000005FAE000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      120KB

                                                                                                                      Download

                                                                                                                    • memory/5020-216-0x00000000058C0000-0x0000000005926000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      408KB

                                                                                                                      Download

                                                                                                                    • memory/5020-222-0x0000000007790000-0x0000000007D34000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      5.6MB

                                                                                                                      Download

                                                                                                                    • memory/5020-215-0x0000000004FE0000-0x0000000005002000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      136KB

                                                                                                                      Download

                                                                                                                    • memory/5020-221-0x00000000064D0000-0x00000000064F2000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      136KB

                                                                                                                      Download

                                                                                                                    • memory/5020-220-0x0000000006480000-0x000000000649A000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      104KB

                                                                                                                      Download