Analysis

  • max time kernel
    142s
  • max time network
    144s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    31/01/2023, 12:05

General

  • Target

    eb3b0c091e4ba48c28181e99e4e03daa4d69ef14aaa7375f718a17990afc3ce9.exe

  • Size

    294KB

  • MD5

    8fb01de2c5bf7c12bd6524ef482c871e

  • SHA1

    10286e9349a1151288bc31d1cf49b8b99f7b71b9

  • SHA256

    eb3b0c091e4ba48c28181e99e4e03daa4d69ef14aaa7375f718a17990afc3ce9

  • SHA512

    9d3df74263ba70b29946c18c0b00ca2954b278f5336b93c998a52b6df83859510b719676f7f6108906cced757d12d67f16a4b8d28010928c863f0041d052e6bd

  • SSDEEP

    3072:5muqy0K9LVkoRoiMOSng62vLsggO8aaJJgDVPMkABX9l7f43H7BFaRCRCq:bV0K9LiF/PSsgx8/gD4b7f4V06

Malware Config

Extracted

Family

djvu

C2

http://drampik.com/lancer/get.php

Attributes
  • extension

    .mzop

  • offline_id

    ex4uvTKsM2vEkIcr3MjXi2C6v27h1mS682iUXGt1

  • payload_url

    http://uaery.top/dl/build2.exe

    http://drampik.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-uZxWxoKbU5 Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0637JOsie

rsa_pubkey.plain

Extracted

Family

vidar

Version

2.3

Botnet

19

C2

https://t.me/mantarlars

https://steamcommunity.com/profiles/76561199474840123

Attributes
  • profile_id

    19

Signatures

  • Detected Djvu ransomware 6 IoCs
  • Detects Smokeloader packer 3 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Process spawned unexpected child process 2 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Downloads MZ/PE file
  • Executes dropped EXE 22 IoCs
  • VMProtect packed file 4 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 9 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 16 IoCs
  • Modifies registry class 26 IoCs
  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:372
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Themes
    1⤵
      PID:1264
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s SENS
      1⤵
        PID:1468
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
        1⤵
          PID:2736
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s WpnService
          1⤵
            PID:2752
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s Browser
            1⤵
            • Suspicious use of SetThreadContext
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            PID:2684
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k WspService
              2⤵
              • Drops file in System32 directory
              • Checks processor information in registry
              • Modifies data under HKEY_USERS
              • Modifies registry class
              PID:1600
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2548
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2540
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
            1⤵
              PID:1900
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s UserManager
              1⤵
                PID:1384
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                1⤵
                  PID:1196
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                  1⤵
                  • Drops file in System32 directory
                  PID:1068
                  • C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe
                    C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe
                    2⤵
                    • Executes dropped EXE
                    PID:1460
                  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
                    2⤵
                    • Executes dropped EXE
                    PID:3112
                    • C:\Windows\SysWOW64\schtasks.exe
                      /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                      3⤵
                      • Creates scheduled task(s)
                      PID:4884
                • C:\Users\Admin\AppData\Local\Temp\eb3b0c091e4ba48c28181e99e4e03daa4d69ef14aaa7375f718a17990afc3ce9.exe
                  "C:\Users\Admin\AppData\Local\Temp\eb3b0c091e4ba48c28181e99e4e03daa4d69ef14aaa7375f718a17990afc3ce9.exe"
                  1⤵
                  • Checks SCSI registry key(s)
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: MapViewOfSection
                  PID:3500
                • C:\Users\Admin\AppData\Local\Temp\DD16.exe
                  C:\Users\Admin\AppData\Local\Temp\DD16.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:1992
                  • C:\Windows\SysWOW64\schtasks.exe
                    "C:\Windows\System32\schtasks.exe" /create /tn "svcupdater" /tr "C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f
                    2⤵
                    • Creates scheduled task(s)
                    PID:1684
                • C:\Users\Admin\AppData\Local\Temp\E209.exe
                  C:\Users\Admin\AppData\Local\Temp\E209.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of WriteProcessMemory
                  PID:4844
                  • C:\Users\Admin\AppData\Local\Temp\E209.exe
                    C:\Users\Admin\AppData\Local\Temp\E209.exe
                    2⤵
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Suspicious use of WriteProcessMemory
                    PID:4492
                    • C:\Windows\SysWOW64\icacls.exe
                      icacls "C:\Users\Admin\AppData\Local\4fa9a780-7659-479b-ae92-f8e2cdbac418" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                      3⤵
                      • Modifies file permissions
                      PID:492
                    • C:\Users\Admin\AppData\Local\Temp\E209.exe
                      "C:\Users\Admin\AppData\Local\Temp\E209.exe" --Admin IsNotAutoStart IsNotTask
                      3⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      PID:2976
                      • C:\Users\Admin\AppData\Local\Temp\E209.exe
                        "C:\Users\Admin\AppData\Local\Temp\E209.exe" --Admin IsNotAutoStart IsNotTask
                        4⤵
                        • Executes dropped EXE
                        PID:4400
                        • C:\Users\Admin\AppData\Local\ba303d9a-ad76-49fd-bcbd-1dfb320a5759\build2.exe
                          "C:\Users\Admin\AppData\Local\ba303d9a-ad76-49fd-bcbd-1dfb320a5759\build2.exe"
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          PID:4664
                          • C:\Users\Admin\AppData\Local\ba303d9a-ad76-49fd-bcbd-1dfb320a5759\build2.exe
                            "C:\Users\Admin\AppData\Local\ba303d9a-ad76-49fd-bcbd-1dfb320a5759\build2.exe"
                            6⤵
                            • Executes dropped EXE
                            PID:392
                        • C:\Users\Admin\AppData\Local\ba303d9a-ad76-49fd-bcbd-1dfb320a5759\build3.exe
                          "C:\Users\Admin\AppData\Local\ba303d9a-ad76-49fd-bcbd-1dfb320a5759\build3.exe"
                          5⤵
                          • Executes dropped EXE
                          PID:3268
                          • C:\Windows\SysWOW64\schtasks.exe
                            /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                            6⤵
                            • Creates scheduled task(s)
                            PID:1344
                • C:\Users\Admin\AppData\Local\Temp\EF87.exe
                  C:\Users\Admin\AppData\Local\Temp\EF87.exe
                  1⤵
                  • Executes dropped EXE
                  • Checks SCSI registry key(s)
                  • Suspicious behavior: MapViewOfSection
                  PID:344
                • C:\Users\Admin\AppData\Local\Temp\F2C4.exe
                  C:\Users\Admin\AppData\Local\Temp\F2C4.exe
                  1⤵
                  • Executes dropped EXE
                  PID:2244
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 476
                    2⤵
                    • Program crash
                    PID:4300
                • C:\Users\Admin\AppData\Local\Temp\FE3F.exe
                  C:\Users\Admin\AppData\Local\Temp\FE3F.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:4240
                  • C:\Users\Admin\AppData\Local\Temp\llpb1133.exe
                    "C:\Users\Admin\AppData\Local\Temp\llpb1133.exe"
                    2⤵
                    • Executes dropped EXE
                    PID:744
                  • C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe
                    "C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe"
                    2⤵
                    • Executes dropped EXE
                    • Checks SCSI registry key(s)
                    • Suspicious behavior: MapViewOfSection
                    PID:2764
                  • C:\Users\Admin\AppData\Local\Temp\liuyuzhen.exe
                    "C:\Users\Admin\AppData\Local\Temp\liuyuzhen.exe"
                    2⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:3320
                    • C:\Users\Admin\AppData\Local\Temp\liuyuzhen.exe
                      "C:\Users\Admin\AppData\Local\Temp\liuyuzhen.exe" -h
                      3⤵
                      • Executes dropped EXE
                      PID:3728
                • C:\Users\Admin\AppData\Local\Temp\7A6.exe
                  C:\Users\Admin\AppData\Local\Temp\7A6.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:1344
                  • C:\Users\Admin\AppData\Local\Temp\llpb1133.exe
                    "C:\Users\Admin\AppData\Local\Temp\llpb1133.exe"
                    2⤵
                    • Executes dropped EXE
                    PID:2356
                  • C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe
                    "C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe"
                    2⤵
                    • Executes dropped EXE
                    PID:2708
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 448
                      3⤵
                      • Program crash
                      PID:4744
                  • C:\Users\Admin\AppData\Local\Temp\liuyuzhen.exe
                    "C:\Users\Admin\AppData\Local\Temp\liuyuzhen.exe"
                    2⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:4164
                    • C:\Users\Admin\AppData\Local\Temp\liuyuzhen.exe
                      "C:\Users\Admin\AppData\Local\Temp\liuyuzhen.exe" -h
                      3⤵
                      • Executes dropped EXE
                      PID:4332
                • C:\Windows\system32\rundll32.exe
                  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
                  1⤵
                  • Process spawned unexpected child process
                  • Suspicious use of WriteProcessMemory
                  PID:1144
                  • C:\Windows\SysWOW64\rundll32.exe
                    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
                    2⤵
                    • Loads dropped DLL
                    • Modifies registry class
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4304
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
                  1⤵
                  • Loads dropped DLL
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  PID:3456
                • C:\Windows\system32\rundll32.exe
                  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\db.dll",open
                  1⤵
                  • Process spawned unexpected child process
                  • Suspicious use of WriteProcessMemory
                  PID:4872

                Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

                  Filesize

                  2KB

                  MD5

                  c2ed2c633828a1bcf603a04772f6bc6f

                  SHA1

                  a2d3abb39d5551c5b594d30d0dcdd05fa5a50085

                  SHA256

                  7e8561e47f6e0af457bca0ff0ea2fa11f64942e80e2d20e5a9611a9915049808

                  SHA512

                  5ab5dc3bfbf196b4eeaa40ee06e94c452f271046c7e0b656cf944ab1cdc109130f40d18388adcc4b5eb15de08f996f8650f136f1fa53e2ae8efe1bb0715ea83a

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

                  Filesize

                  1KB

                  MD5

                  9bf10855213d2d2b26123cd2a04220b8

                  SHA1

                  231d2ed3b9098617f196e89cee3c2a82b38b5d40

                  SHA256

                  a508e5bc0086119681076c2b05889d6f70047f971342d65792776ab7b53ca1e9

                  SHA512

                  df78a9f4ed0296f9a16d17672758411306e1b3664e9c6aece1ec738da350e2ee703f5c4f30167c4d5b54de8d154a7a4dc7250420c024e26063c8521a333e3dfd

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

                  Filesize

                  488B

                  MD5

                  0b8ae313e750e6fa29d3a08fa6ee02a4

                  SHA1

                  443eac19767c9f24a93716ee1737b2172858c577

                  SHA256

                  7332a39d6fcab055432ee21db25b6def52154aaabf038f9fd2f237ee6b103eca

                  SHA512

                  7038b1077527b47c3f320a8bdf260e597e1f75295bd4751ee64f536d8ad9bc00ad6f2f9d5a4a4976a2a3461c60d1c3e80fab87d40e748f6e9b280a4cdf885f40

                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

                  Filesize

                  482B

                  MD5

                  f2971eb4372e27094ff29e973e9d0d0c

                  SHA1

                  c568d10251c59d9a8921aa565a4b6e35c54b09b4

                  SHA256

                  b17e8f8cef305519f782b7c114b7d77d9d788b0ee7a495941781aab5c6684e2c

                  SHA512

                  ccdf1c13d0b3ea5afbe9e6a1b448256c5724671f933453da0977a1dd1bdec75cdc699ab7e214b636750b0ec131b07c2e0b878c79ae1b44697e302bb9ce2b9774

                • C:\Users\Admin\AppData\Local\4fa9a780-7659-479b-ae92-f8e2cdbac418\E209.exe

                  Filesize

                  706KB

                  MD5

                  127d310938ca405f4107f27fd974b878

                  SHA1

                  7142ab0b97589ca351215902434637171a4e14f7

                  SHA256

                  bf0751f80191b3912661d9518dbc7e5c60f542c5f25afcb4ad2bc486c61eb326

                  SHA512

                  541fca9f3a1622e75d578a4a6297e945291eff7351a8cb028dac14efd7480113741fc9de832c86238d523ff3d1fecbec7d0002c050c1455acb8d3885bdb70dca

                • C:\Users\Admin\AppData\Local\Temp\7A6.exe

                  Filesize

                  3.9MB

                  MD5

                  4a8cfa190273206fdc808b410706f734

                  SHA1

                  b3bc435109a9c10c22fc1ece42ea67383315f478

                  SHA256

                  e3821fb308eecf48c36679380663aa25afc7dd368f37de6304da43a599aed828

                  SHA512

                  44d5990009573682f6bc8e09b3917ffff2a94ab401b805ba3375735c0a16b7a1d4a7c42ce2c0d6431069b17f51a3c5bbf2e35726a73591ffe3ccf53b82a4b27e

                • C:\Users\Admin\AppData\Local\Temp\7A6.exe

                  Filesize

                  3.9MB

                  MD5

                  4a8cfa190273206fdc808b410706f734

                  SHA1

                  b3bc435109a9c10c22fc1ece42ea67383315f478

                  SHA256

                  e3821fb308eecf48c36679380663aa25afc7dd368f37de6304da43a599aed828

                  SHA512

                  44d5990009573682f6bc8e09b3917ffff2a94ab401b805ba3375735c0a16b7a1d4a7c42ce2c0d6431069b17f51a3c5bbf2e35726a73591ffe3ccf53b82a4b27e

                • C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe

                  Filesize

                  298KB

                  MD5

                  1bf0113ca9ff16b5d8f3a7280286f37a

                  SHA1

                  c8cbb862ced7c01f45ed2ef7413c8d2eaefa6d3a

                  SHA256

                  6164128b4834ad44cc9f6cd3f5f50c38a97e07d43fc07c260f733d85abac233b

                  SHA512

                  af0561404765fef8151afb054c3fc44c2484e82af018e3e7898c2a8887552113e8f25bb772ab10163916603340b18aeb6d5085899ad810ea06a589856a6f61a6

                • C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe

                  Filesize

                  298KB

                  MD5

                  1bf0113ca9ff16b5d8f3a7280286f37a

                  SHA1

                  c8cbb862ced7c01f45ed2ef7413c8d2eaefa6d3a

                  SHA256

                  6164128b4834ad44cc9f6cd3f5f50c38a97e07d43fc07c260f733d85abac233b

                  SHA512

                  af0561404765fef8151afb054c3fc44c2484e82af018e3e7898c2a8887552113e8f25bb772ab10163916603340b18aeb6d5085899ad810ea06a589856a6f61a6

                • C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe

                  Filesize

                  298KB

                  MD5

                  1bf0113ca9ff16b5d8f3a7280286f37a

                  SHA1

                  c8cbb862ced7c01f45ed2ef7413c8d2eaefa6d3a

                  SHA256

                  6164128b4834ad44cc9f6cd3f5f50c38a97e07d43fc07c260f733d85abac233b

                  SHA512

                  af0561404765fef8151afb054c3fc44c2484e82af018e3e7898c2a8887552113e8f25bb772ab10163916603340b18aeb6d5085899ad810ea06a589856a6f61a6

                • C:\Users\Admin\AppData\Local\Temp\ChromeSetup.exe

                  Filesize

                  298KB

                  MD5

                  1bf0113ca9ff16b5d8f3a7280286f37a

                  SHA1

                  c8cbb862ced7c01f45ed2ef7413c8d2eaefa6d3a

                  SHA256

                  6164128b4834ad44cc9f6cd3f5f50c38a97e07d43fc07c260f733d85abac233b

                  SHA512

                  af0561404765fef8151afb054c3fc44c2484e82af018e3e7898c2a8887552113e8f25bb772ab10163916603340b18aeb6d5085899ad810ea06a589856a6f61a6

                • C:\Users\Admin\AppData\Local\Temp\DD16.exe

                  Filesize

                  378KB

                  MD5

                  b141bc58618c537917cc1da179cbe8ab

                  SHA1

                  c76d3f5eeae9493e41a272a974b5dfec5f4e4724

                  SHA256

                  fd999e4a07d8b3d95f9d9231fd496b0125b56094f1b03ddca7a7b074c1d8c03e

                  SHA512

                  5c72f63124a394602a36a4f985e33a41e8159f54653f431c270b8f0fa8e13131517c31b497a936d5f5d3d27397f40fc7909efc4bfd04c01bcca7f306860c3114

                • C:\Users\Admin\AppData\Local\Temp\DD16.exe

                  Filesize

                  378KB

                  MD5

                  b141bc58618c537917cc1da179cbe8ab

                  SHA1

                  c76d3f5eeae9493e41a272a974b5dfec5f4e4724

                  SHA256

                  fd999e4a07d8b3d95f9d9231fd496b0125b56094f1b03ddca7a7b074c1d8c03e

                  SHA512

                  5c72f63124a394602a36a4f985e33a41e8159f54653f431c270b8f0fa8e13131517c31b497a936d5f5d3d27397f40fc7909efc4bfd04c01bcca7f306860c3114

                • C:\Users\Admin\AppData\Local\Temp\E209.exe

                  Filesize

                  706KB

                  MD5

                  127d310938ca405f4107f27fd974b878

                  SHA1

                  7142ab0b97589ca351215902434637171a4e14f7

                  SHA256

                  bf0751f80191b3912661d9518dbc7e5c60f542c5f25afcb4ad2bc486c61eb326

                  SHA512

                  541fca9f3a1622e75d578a4a6297e945291eff7351a8cb028dac14efd7480113741fc9de832c86238d523ff3d1fecbec7d0002c050c1455acb8d3885bdb70dca

                • C:\Users\Admin\AppData\Local\Temp\E209.exe

                  Filesize

                  706KB

                  MD5

                  127d310938ca405f4107f27fd974b878

                  SHA1

                  7142ab0b97589ca351215902434637171a4e14f7

                  SHA256

                  bf0751f80191b3912661d9518dbc7e5c60f542c5f25afcb4ad2bc486c61eb326

                  SHA512

                  541fca9f3a1622e75d578a4a6297e945291eff7351a8cb028dac14efd7480113741fc9de832c86238d523ff3d1fecbec7d0002c050c1455acb8d3885bdb70dca

                • C:\Users\Admin\AppData\Local\Temp\E209.exe

                  Filesize

                  706KB

                  MD5

                  127d310938ca405f4107f27fd974b878

                  SHA1

                  7142ab0b97589ca351215902434637171a4e14f7

                  SHA256

                  bf0751f80191b3912661d9518dbc7e5c60f542c5f25afcb4ad2bc486c61eb326

                  SHA512

                  541fca9f3a1622e75d578a4a6297e945291eff7351a8cb028dac14efd7480113741fc9de832c86238d523ff3d1fecbec7d0002c050c1455acb8d3885bdb70dca

                • C:\Users\Admin\AppData\Local\Temp\E209.exe

                  Filesize

                  706KB

                  MD5

                  127d310938ca405f4107f27fd974b878

                  SHA1

                  7142ab0b97589ca351215902434637171a4e14f7

                  SHA256

                  bf0751f80191b3912661d9518dbc7e5c60f542c5f25afcb4ad2bc486c61eb326

                  SHA512

                  541fca9f3a1622e75d578a4a6297e945291eff7351a8cb028dac14efd7480113741fc9de832c86238d523ff3d1fecbec7d0002c050c1455acb8d3885bdb70dca

                • C:\Users\Admin\AppData\Local\Temp\E209.exe

                  Filesize

                  706KB

                  MD5

                  127d310938ca405f4107f27fd974b878

                  SHA1

                  7142ab0b97589ca351215902434637171a4e14f7

                  SHA256

                  bf0751f80191b3912661d9518dbc7e5c60f542c5f25afcb4ad2bc486c61eb326

                  SHA512

                  541fca9f3a1622e75d578a4a6297e945291eff7351a8cb028dac14efd7480113741fc9de832c86238d523ff3d1fecbec7d0002c050c1455acb8d3885bdb70dca

                • C:\Users\Admin\AppData\Local\Temp\EF87.exe

                  Filesize

                  296KB

                  MD5

                  61397bb509be70f09f00e75cf3f3442d

                  SHA1

                  521008b9f31b90958f7452b935f107c8720cbdcb

                  SHA256

                  dca3a9df853214afe0eb8daa036dd53c2c990efa8d5c928fd2159beda8b160ee

                  SHA512

                  1646e9ffca9b1fe50d29a172cf5882839d3a0a3c27d615cc6dcce03a4446396e00c2a85c438fd4d139191528404adf886a670be421978d7201a7daa3e80c066f

                • C:\Users\Admin\AppData\Local\Temp\EF87.exe

                  Filesize

                  296KB

                  MD5

                  61397bb509be70f09f00e75cf3f3442d

                  SHA1

                  521008b9f31b90958f7452b935f107c8720cbdcb

                  SHA256

                  dca3a9df853214afe0eb8daa036dd53c2c990efa8d5c928fd2159beda8b160ee

                  SHA512

                  1646e9ffca9b1fe50d29a172cf5882839d3a0a3c27d615cc6dcce03a4446396e00c2a85c438fd4d139191528404adf886a670be421978d7201a7daa3e80c066f

                • C:\Users\Admin\AppData\Local\Temp\F2C4.exe

                  Filesize

                  186KB

                  MD5

                  4562f86bf4c302021a4c959b74fb9fea

                  SHA1

                  305dba91270285c00eefd28cb4f4ed8a7140e1a3

                  SHA256

                  60513db3d8b78e05b1effcab2282173c648c49717b464f426c2cb6fa95987ed6

                  SHA512

                  d0ed87780a9f100df4198646fd1a68d66b26612ce8b5c3aa1a7ddc4eb726d770a8f76dcf2b04052b89bd8e6e8d5a50481bf55a4a175b9a9f8708cb6404746cf1

                • C:\Users\Admin\AppData\Local\Temp\F2C4.exe

                  Filesize

                  186KB

                  MD5

                  4562f86bf4c302021a4c959b74fb9fea

                  SHA1

                  305dba91270285c00eefd28cb4f4ed8a7140e1a3

                  SHA256

                  60513db3d8b78e05b1effcab2282173c648c49717b464f426c2cb6fa95987ed6

                  SHA512

                  d0ed87780a9f100df4198646fd1a68d66b26612ce8b5c3aa1a7ddc4eb726d770a8f76dcf2b04052b89bd8e6e8d5a50481bf55a4a175b9a9f8708cb6404746cf1

                • C:\Users\Admin\AppData\Local\Temp\FE3F.exe

                  Filesize

                  3.9MB

                  MD5

                  4a8cfa190273206fdc808b410706f734

                  SHA1

                  b3bc435109a9c10c22fc1ece42ea67383315f478

                  SHA256

                  e3821fb308eecf48c36679380663aa25afc7dd368f37de6304da43a599aed828

                  SHA512

                  44d5990009573682f6bc8e09b3917ffff2a94ab401b805ba3375735c0a16b7a1d4a7c42ce2c0d6431069b17f51a3c5bbf2e35726a73591ffe3ccf53b82a4b27e

                • C:\Users\Admin\AppData\Local\Temp\FE3F.exe

                  Filesize

                  3.9MB

                  MD5

                  4a8cfa190273206fdc808b410706f734

                  SHA1

                  b3bc435109a9c10c22fc1ece42ea67383315f478

                  SHA256

                  e3821fb308eecf48c36679380663aa25afc7dd368f37de6304da43a599aed828

                  SHA512

                  44d5990009573682f6bc8e09b3917ffff2a94ab401b805ba3375735c0a16b7a1d4a7c42ce2c0d6431069b17f51a3c5bbf2e35726a73591ffe3ccf53b82a4b27e

                • C:\Users\Admin\AppData\Local\Temp\db.dat

                  Filesize

                  557KB

                  MD5

                  30d5f615722d12fdda4f378048221909

                  SHA1

                  e94e3e3a6fae8b29f0f80128761ad1b69304a7eb

                  SHA256

                  b7cb464cd0c61026ec38d89c0a041393bc9369e217303677551eec65a09d2628

                  SHA512

                  a561a224d7228ec531a966c7dbd6bc88138e2f4a1c8112e5950644f69bf3a43b1e87e03bc1b4fd5e9ca071b5a9353b18697573404602ccd51f2946faf95144c2

                • C:\Users\Admin\AppData\Local\Temp\db.dat

                  Filesize

                  557KB

                  MD5

                  30d5f615722d12fdda4f378048221909

                  SHA1

                  e94e3e3a6fae8b29f0f80128761ad1b69304a7eb

                  SHA256

                  b7cb464cd0c61026ec38d89c0a041393bc9369e217303677551eec65a09d2628

                  SHA512

                  a561a224d7228ec531a966c7dbd6bc88138e2f4a1c8112e5950644f69bf3a43b1e87e03bc1b4fd5e9ca071b5a9353b18697573404602ccd51f2946faf95144c2

                • C:\Users\Admin\AppData\Local\Temp\db.dll

                  Filesize

                  52KB

                  MD5

                  1b20e998d058e813dfc515867d31124f

                  SHA1

                  c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f

                  SHA256

                  24a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00

                  SHA512

                  79849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6

                • C:\Users\Admin\AppData\Local\Temp\db.dll

                  Filesize

                  52KB

                  MD5

                  1b20e998d058e813dfc515867d31124f

                  SHA1

                  c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f

                  SHA256

                  24a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00

                  SHA512

                  79849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6

                • C:\Users\Admin\AppData\Local\Temp\liuyuzhen.exe

                  Filesize

                  160KB

                  MD5

                  b9363486500e209c05f97330226bbf8a

                  SHA1

                  bfe2d0072d09b30ec66dee072dde4e7af26e4633

                  SHA256

                  01138f2318e59e1fe59f1eb7de3859af815ebf9a59aae1084c1a97a99319ee35

                  SHA512

                  6d06e5baeab962d85b306c72f39a82e40e22eb889867c11c406a069011155cb8901bf021f48efc98fd95340be7e9609fc11f4e24fc322dbf721e610120771534

                • C:\Users\Admin\AppData\Local\Temp\liuyuzhen.exe

                  Filesize

                  160KB

                  MD5

                  b9363486500e209c05f97330226bbf8a

                  SHA1

                  bfe2d0072d09b30ec66dee072dde4e7af26e4633

                  SHA256

                  01138f2318e59e1fe59f1eb7de3859af815ebf9a59aae1084c1a97a99319ee35

                  SHA512

                  6d06e5baeab962d85b306c72f39a82e40e22eb889867c11c406a069011155cb8901bf021f48efc98fd95340be7e9609fc11f4e24fc322dbf721e610120771534

                • C:\Users\Admin\AppData\Local\Temp\liuyuzhen.exe

                  Filesize

                  160KB

                  MD5

                  b9363486500e209c05f97330226bbf8a

                  SHA1

                  bfe2d0072d09b30ec66dee072dde4e7af26e4633

                  SHA256

                  01138f2318e59e1fe59f1eb7de3859af815ebf9a59aae1084c1a97a99319ee35

                  SHA512

                  6d06e5baeab962d85b306c72f39a82e40e22eb889867c11c406a069011155cb8901bf021f48efc98fd95340be7e9609fc11f4e24fc322dbf721e610120771534

                • C:\Users\Admin\AppData\Local\Temp\liuyuzhen.exe

                  Filesize

                  160KB

                  MD5

                  b9363486500e209c05f97330226bbf8a

                  SHA1

                  bfe2d0072d09b30ec66dee072dde4e7af26e4633

                  SHA256

                  01138f2318e59e1fe59f1eb7de3859af815ebf9a59aae1084c1a97a99319ee35

                  SHA512

                  6d06e5baeab962d85b306c72f39a82e40e22eb889867c11c406a069011155cb8901bf021f48efc98fd95340be7e9609fc11f4e24fc322dbf721e610120771534

                • C:\Users\Admin\AppData\Local\Temp\liuyuzhen.exe

                  Filesize

                  160KB

                  MD5

                  b9363486500e209c05f97330226bbf8a

                  SHA1

                  bfe2d0072d09b30ec66dee072dde4e7af26e4633

                  SHA256

                  01138f2318e59e1fe59f1eb7de3859af815ebf9a59aae1084c1a97a99319ee35

                  SHA512

                  6d06e5baeab962d85b306c72f39a82e40e22eb889867c11c406a069011155cb8901bf021f48efc98fd95340be7e9609fc11f4e24fc322dbf721e610120771534

                • C:\Users\Admin\AppData\Local\Temp\liuyuzhen.exe

                  Filesize

                  160KB

                  MD5

                  b9363486500e209c05f97330226bbf8a

                  SHA1

                  bfe2d0072d09b30ec66dee072dde4e7af26e4633

                  SHA256

                  01138f2318e59e1fe59f1eb7de3859af815ebf9a59aae1084c1a97a99319ee35

                  SHA512

                  6d06e5baeab962d85b306c72f39a82e40e22eb889867c11c406a069011155cb8901bf021f48efc98fd95340be7e9609fc11f4e24fc322dbf721e610120771534

                • C:\Users\Admin\AppData\Local\Temp\llpb1133.exe

                  Filesize

                  3.5MB

                  MD5

                  3dcc72414d99aa5ceabda8a5b40fe399

                  SHA1

                  13440890588d96a8368f38a3a3c7443fe0fd469e

                  SHA256

                  2ff76bc4da9995c9d30edd3b54e838fa5f3c55f5a12a8509d82b2e4837b55510

                  SHA512

                  437bd7033cffc68b9002c2d4004007680940195b6c56199083e925300f6ace30d4eb3763fff88b475e90dfc01f298c41bfc1f649b3b33d91826c2ce9af1d0215

                • C:\Users\Admin\AppData\Local\Temp\llpb1133.exe

                  Filesize

                  3.5MB

                  MD5

                  3dcc72414d99aa5ceabda8a5b40fe399

                  SHA1

                  13440890588d96a8368f38a3a3c7443fe0fd469e

                  SHA256

                  2ff76bc4da9995c9d30edd3b54e838fa5f3c55f5a12a8509d82b2e4837b55510

                  SHA512

                  437bd7033cffc68b9002c2d4004007680940195b6c56199083e925300f6ace30d4eb3763fff88b475e90dfc01f298c41bfc1f649b3b33d91826c2ce9af1d0215

                • C:\Users\Admin\AppData\Local\Temp\llpb1133.exe

                  Filesize

                  3.5MB

                  MD5

                  3dcc72414d99aa5ceabda8a5b40fe399

                  SHA1

                  13440890588d96a8368f38a3a3c7443fe0fd469e

                  SHA256

                  2ff76bc4da9995c9d30edd3b54e838fa5f3c55f5a12a8509d82b2e4837b55510

                  SHA512

                  437bd7033cffc68b9002c2d4004007680940195b6c56199083e925300f6ace30d4eb3763fff88b475e90dfc01f298c41bfc1f649b3b33d91826c2ce9af1d0215

                • C:\Users\Admin\AppData\Local\Temp\llpb1133.exe

                  Filesize

                  3.5MB

                  MD5

                  3dcc72414d99aa5ceabda8a5b40fe399

                  SHA1

                  13440890588d96a8368f38a3a3c7443fe0fd469e

                  SHA256

                  2ff76bc4da9995c9d30edd3b54e838fa5f3c55f5a12a8509d82b2e4837b55510

                  SHA512

                  437bd7033cffc68b9002c2d4004007680940195b6c56199083e925300f6ace30d4eb3763fff88b475e90dfc01f298c41bfc1f649b3b33d91826c2ce9af1d0215

                • C:\Users\Admin\AppData\Local\ba303d9a-ad76-49fd-bcbd-1dfb320a5759\build2.exe

                  Filesize

                  299KB

                  MD5

                  cacd37281c5470cfc13e6db90942d371

                  SHA1

                  af9e1477a51858376bd113f8247b4f6ff1b94445

                  SHA256

                  fe8dd23da7d898858d6a280cd58d4ca332f958a4f9562bf8f364dc4340f9c34c

                  SHA512

                  cfe21519f4c55583c3c68592812dbfa1170279de5e20b3da6d49f66957e373288650bd8c1a6afcd6d70255356674579b40c1b75a7c154fcc705cc89056ff8d67

                • C:\Users\Admin\AppData\Local\ba303d9a-ad76-49fd-bcbd-1dfb320a5759\build2.exe

                  Filesize

                  299KB

                  MD5

                  cacd37281c5470cfc13e6db90942d371

                  SHA1

                  af9e1477a51858376bd113f8247b4f6ff1b94445

                  SHA256

                  fe8dd23da7d898858d6a280cd58d4ca332f958a4f9562bf8f364dc4340f9c34c

                  SHA512

                  cfe21519f4c55583c3c68592812dbfa1170279de5e20b3da6d49f66957e373288650bd8c1a6afcd6d70255356674579b40c1b75a7c154fcc705cc89056ff8d67

                • C:\Users\Admin\AppData\Local\ba303d9a-ad76-49fd-bcbd-1dfb320a5759\build2.exe

                  Filesize

                  299KB

                  MD5

                  cacd37281c5470cfc13e6db90942d371

                  SHA1

                  af9e1477a51858376bd113f8247b4f6ff1b94445

                  SHA256

                  fe8dd23da7d898858d6a280cd58d4ca332f958a4f9562bf8f364dc4340f9c34c

                  SHA512

                  cfe21519f4c55583c3c68592812dbfa1170279de5e20b3da6d49f66957e373288650bd8c1a6afcd6d70255356674579b40c1b75a7c154fcc705cc89056ff8d67

                • C:\Users\Admin\AppData\Local\ba303d9a-ad76-49fd-bcbd-1dfb320a5759\build3.exe

                  Filesize

                  9KB

                  MD5

                  9ead10c08e72ae41921191f8db39bc16

                  SHA1

                  abe3bce01cd34afc88e2c838173f8c2bd0090ae1

                  SHA256

                  8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

                  SHA512

                  aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

                • C:\Users\Admin\AppData\Local\ba303d9a-ad76-49fd-bcbd-1dfb320a5759\build3.exe

                  Filesize

                  9KB

                  MD5

                  9ead10c08e72ae41921191f8db39bc16

                  SHA1

                  abe3bce01cd34afc88e2c838173f8c2bd0090ae1

                  SHA256

                  8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

                  SHA512

                  aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

                • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

                  Filesize

                  9KB

                  MD5

                  9ead10c08e72ae41921191f8db39bc16

                  SHA1

                  abe3bce01cd34afc88e2c838173f8c2bd0090ae1

                  SHA256

                  8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

                  SHA512

                  aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

                • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

                  Filesize

                  9KB

                  MD5

                  9ead10c08e72ae41921191f8db39bc16

                  SHA1

                  abe3bce01cd34afc88e2c838173f8c2bd0090ae1

                  SHA256

                  8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

                  SHA512

                  aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

                • C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe

                  Filesize

                  531.6MB

                  MD5

                  4c766f587903e2941715149724aed336

                  SHA1

                  c34fad887f66288375fd6bb3ba09038db29550fd

                  SHA256

                  236cd42db5921eda234890f9cd7f9ba81c0a8f4eb5bca0820bdb8d396f3f0082

                  SHA512

                  262f8c86ff6cca5b45788496580ffd882b5a8a9bed7b255cfd299aad3cdfaaf0c7140c8e1bedbfc8f43d577ee4a15d83185556cb49397f6f6cc702263f7e2ab8

                • C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe

                  Filesize

                  530.9MB

                  MD5

                  93f9d9744381aad6630dce3ad1474cb0

                  SHA1

                  c5fd57fde4ebd422e64eb3eafdf46318a2952e8a

                  SHA256

                  421ec0c9f8181daf135cde5203265af127d1ed6b70ace233fa40326e6c4928a7

                  SHA512

                  643c9baf7b5b109fb85d3edf443237fb0d6e08e78c4b5416745374241e604f5a203a477a0cf794b635f585fd10253189e7a26c5bcdd60bee9cbfa95526f146b5

                • \Users\Admin\AppData\Local\Temp\db.dll

                  Filesize

                  52KB

                  MD5

                  1b20e998d058e813dfc515867d31124f

                  SHA1

                  c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f

                  SHA256

                  24a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00

                  SHA512

                  79849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6

                • \Users\Admin\AppData\Local\Temp\db.dll

                  Filesize

                  52KB

                  MD5

                  1b20e998d058e813dfc515867d31124f

                  SHA1

                  c9dc9c42a748af18ae1a8c882b90a2b9e3313e6f

                  SHA256

                  24a53033a2e89acf65f6a5e60d35cb223585817032635e81bf31264eb7dabd00

                  SHA512

                  79849fbdb9a9e7f7684b570d14662448b093b8aa2b23dfd95856db3a78faf75a95d95c51b8aa8506c4fbecffebcc57cd153dda38c830c05b8cd38629fae673c6

                • memory/344-385-0x0000000000400000-0x0000000000463000-memory.dmp

                  Filesize

                  396KB

                • memory/344-379-0x00000000006E6000-0x00000000006FC000-memory.dmp

                  Filesize

                  88KB

                • memory/344-589-0x0000000000400000-0x0000000000463000-memory.dmp

                  Filesize

                  396KB

                • memory/344-383-0x0000000000470000-0x00000000005BA000-memory.dmp

                  Filesize

                  1.3MB

                • memory/344-585-0x00000000006E6000-0x00000000006FC000-memory.dmp

                  Filesize

                  88KB

                • memory/372-1015-0x000002B788140000-0x000002B7881B2000-memory.dmp

                  Filesize

                  456KB

                • memory/372-1017-0x000002B7881C0000-0x000002B788232000-memory.dmp

                  Filesize

                  456KB

                • memory/1068-1058-0x0000022E5FA60000-0x0000022E5FAD2000-memory.dmp

                  Filesize

                  456KB

                • memory/1068-1062-0x0000022E60200000-0x0000022E60272000-memory.dmp

                  Filesize

                  456KB

                • memory/1196-1054-0x0000022660BE0000-0x0000022660C52000-memory.dmp

                  Filesize

                  456KB

                • memory/1196-1051-0x0000022660480000-0x00000226604F2000-memory.dmp

                  Filesize

                  456KB

                • memory/1264-1073-0x0000020CF1B60000-0x0000020CF1BD2000-memory.dmp

                  Filesize

                  456KB

                • memory/1264-1075-0x0000020CF20B0000-0x0000020CF2122000-memory.dmp

                  Filesize

                  456KB

                • memory/1384-1077-0x000001A962EE0000-0x000001A962F52000-memory.dmp

                  Filesize

                  456KB

                • memory/1384-1080-0x000001A962F60000-0x000001A962FD2000-memory.dmp

                  Filesize

                  456KB

                • memory/1468-1064-0x000001CA4E240000-0x000001CA4E2B2000-memory.dmp

                  Filesize

                  456KB

                • memory/1468-1067-0x000001CA4E4C0000-0x000001CA4E532000-memory.dmp

                  Filesize

                  456KB

                • memory/1600-1018-0x0000025B236D0000-0x0000025B23742000-memory.dmp

                  Filesize

                  456KB

                • memory/1900-1072-0x000001A1A0EA0000-0x000001A1A0F12000-memory.dmp

                  Filesize

                  456KB

                • memory/1900-1069-0x000001A1A0DB0000-0x000001A1A0E22000-memory.dmp

                  Filesize

                  456KB

                • memory/1992-165-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/1992-158-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/1992-159-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/1992-253-0x00000000005B0000-0x00000000006FA000-memory.dmp

                  Filesize

                  1.3MB

                • memory/1992-256-0x00000000005B0000-0x00000000006FA000-memory.dmp

                  Filesize

                  1.3MB

                • memory/1992-168-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/1992-171-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/1992-160-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/1992-161-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/1992-163-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/1992-164-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/1992-167-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/1992-156-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/1992-329-0x0000000000400000-0x000000000047A000-memory.dmp

                  Filesize

                  488KB

                • memory/1992-157-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/1992-479-0x0000000000400000-0x000000000047A000-memory.dmp

                  Filesize

                  488KB

                • memory/1992-155-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/1992-173-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/1992-175-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/2244-786-0x0000000000400000-0x0000000002B98000-memory.dmp

                  Filesize

                  39.6MB

                • memory/2244-490-0x0000000002C80000-0x0000000002C89000-memory.dmp

                  Filesize

                  36KB

                • memory/2244-534-0x0000000000400000-0x0000000002B98000-memory.dmp

                  Filesize

                  39.6MB

                • memory/2244-816-0x0000000002CB0000-0x0000000002DFA000-memory.dmp

                  Filesize

                  1.3MB

                • memory/2244-486-0x0000000002CB0000-0x0000000002DFA000-memory.dmp

                  Filesize

                  1.3MB

                • memory/2540-1021-0x0000027261250000-0x00000272612C2000-memory.dmp

                  Filesize

                  456KB

                • memory/2540-1023-0x00000272617A0000-0x0000027261812000-memory.dmp

                  Filesize

                  456KB

                • memory/2548-1026-0x000002C4EAB40000-0x000002C4EABB2000-memory.dmp

                  Filesize

                  456KB

                • memory/2548-1025-0x000002C4EA540000-0x000002C4EA5B2000-memory.dmp

                  Filesize

                  456KB

                • memory/2684-1009-0x000002BB3C170000-0x000002BB3C1E2000-memory.dmp

                  Filesize

                  456KB

                • memory/2684-1013-0x000002BB3C5A0000-0x000002BB3C612000-memory.dmp

                  Filesize

                  456KB

                • memory/2684-1007-0x000002BB3BFB0000-0x000002BB3BFFD000-memory.dmp

                  Filesize

                  308KB

                • memory/2708-736-0x00000000004C0000-0x00000000004C9000-memory.dmp

                  Filesize

                  36KB

                • memory/2708-733-0x0000000000520000-0x000000000066A000-memory.dmp

                  Filesize

                  1.3MB

                • memory/2708-1049-0x0000000000520000-0x000000000066A000-memory.dmp

                  Filesize

                  1.3MB

                • memory/2708-779-0x0000000000400000-0x0000000000466000-memory.dmp

                  Filesize

                  408KB

                • memory/2736-1083-0x0000025E7C800000-0x0000025E7C872000-memory.dmp

                  Filesize

                  456KB

                • memory/2736-1082-0x0000025E7BD30000-0x0000025E7BDA2000-memory.dmp

                  Filesize

                  456KB

                • memory/2752-1086-0x0000023A9E560000-0x0000023A9E5D2000-memory.dmp

                  Filesize

                  456KB

                • memory/2752-1088-0x0000023A9E800000-0x0000023A9E872000-memory.dmp

                  Filesize

                  456KB

                • memory/2764-882-0x0000000000400000-0x0000000000466000-memory.dmp

                  Filesize

                  408KB

                • memory/2764-725-0x0000000000470000-0x000000000051E000-memory.dmp

                  Filesize

                  696KB

                • memory/2764-721-0x0000000000530000-0x000000000067A000-memory.dmp

                  Filesize

                  1.3MB

                • memory/2764-729-0x0000000000400000-0x0000000000466000-memory.dmp

                  Filesize

                  408KB

                • memory/3456-977-0x0000000004440000-0x000000000454F000-memory.dmp

                  Filesize

                  1.1MB

                • memory/3456-1061-0x00000000045D0000-0x000000000462E000-memory.dmp

                  Filesize

                  376KB

                • memory/3456-1005-0x00000000045D0000-0x000000000462E000-memory.dmp

                  Filesize

                  376KB

                • memory/3500-143-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/3500-130-0x0000000000516000-0x000000000052B000-memory.dmp

                  Filesize

                  84KB

                • memory/3500-116-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/3500-117-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/3500-118-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/3500-119-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/3500-120-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/3500-121-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/3500-142-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/3500-122-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/3500-152-0x0000000000400000-0x0000000000463000-memory.dmp

                  Filesize

                  396KB

                • memory/3500-123-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/3500-124-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/3500-151-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/3500-150-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/3500-149-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/3500-125-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/3500-126-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/3500-148-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/3500-115-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/3500-127-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/3500-128-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/3500-129-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/3500-131-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/3500-147-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/3500-140-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/3500-132-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/3500-145-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/3500-133-0x0000000000470000-0x000000000051E000-memory.dmp

                  Filesize

                  696KB

                • memory/3500-135-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/3500-134-0x00000000001E0000-0x00000000001E9000-memory.dmp

                  Filesize

                  36KB

                • memory/3500-136-0x0000000000400000-0x0000000000463000-memory.dmp

                  Filesize

                  396KB

                • memory/3500-144-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/3500-137-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/3500-138-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/3500-139-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/3500-146-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/3500-141-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/4240-344-0x0000000000E20000-0x0000000001216000-memory.dmp

                  Filesize

                  4.0MB

                • memory/4304-1070-0x0000000004D00000-0x0000000004D5E000-memory.dmp

                  Filesize

                  376KB

                • memory/4304-1011-0x0000000004D00000-0x0000000004D5E000-memory.dmp

                  Filesize

                  376KB

                • memory/4304-980-0x0000000004EA0000-0x0000000004FA2000-memory.dmp

                  Filesize

                  1.0MB

                • memory/4492-883-0x0000000000400000-0x0000000000537000-memory.dmp

                  Filesize

                  1.2MB

                • memory/4492-483-0x0000000000400000-0x0000000000537000-memory.dmp

                  Filesize

                  1.2MB

                • memory/4492-814-0x0000000000400000-0x0000000000537000-memory.dmp

                  Filesize

                  1.2MB

                • memory/4844-187-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/4844-179-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/4844-183-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/4844-182-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/4844-174-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/4844-302-0x0000000004890000-0x0000000004930000-memory.dmp

                  Filesize

                  640KB

                • memory/4844-180-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/4844-305-0x0000000004970000-0x0000000004A8B000-memory.dmp

                  Filesize

                  1.1MB

                • memory/4844-184-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/4844-189-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/4844-177-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/4844-186-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/4844-185-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/4844-172-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/4844-188-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/4844-170-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB

                • memory/4844-178-0x00000000776C0000-0x000000007784E000-memory.dmp

                  Filesize

                  1.6MB