amadey | 47d11b74ec643cf70ab8897d755a6b14191c5445c30f6dc1f78ba1c0cd8aad53

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
16-09-2023 10:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

47d11b74ec643cf70ab8897d755a6b14191c5445c30f6dc1f78ba1c0cd8aad53.exe
Size

277KB
MD5

2c222a27daf35f0dde1d94f57927dcd5
SHA1

071f050e0bebeaf6b51de6b00a798eb877080dc2
SHA256

47d11b74ec643cf70ab8897d755a6b14191c5445c30f6dc1f78ba1c0cd8aad53
SHA512

1a5ce8c1cbae7f891f407c972f3598f35c7d585e3beab8f98a3b9d809662632209de406cf59db1491e839beae8efb8cf4914c88ff42ea9bf1e0a0e809464e7e6
SSDEEP

3072:sqAskPVK76BwcjPZdq0fetytYzWN7uphEXZcFECdKGW:LEPVKeXbFWy7upipE

Score

10^/10

amadey djvu lgoogloader redline smokeloader lux3 pub1 backdoor discovery downloader infostealer persistence ransomware spyware stealer trojan

Malware Config

Extracted

Family

smokeloader

Version

2022

http://potunulit.org/

http://hutnilior.net/

http://bulimu55t.net/

http://soryytlic4.net/

http://novanosa5org.org/

http://nuljjjnuli.org/

http://tolilolihul.net/

http://somatoka51hub.net/

http://hujukui3.net/

http://bukubuka1.net/

http://golilopaster.org/

http://newzelannd66.org/

http://otriluyttn.org/

rc4.i32

Extracted

Family

djvu

http://zexeq.com/raud/get.php

http://zexeq.com/lancer/get.php

Attributes

extension
.ooza
offline_id
dhL6XvokZotUzL67Na5WfNIBufODsob7eYc3mzt1
payload_url
http://colisumy.com/dl/build2.exe

http://zexeq.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-XA1LckrLRP Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0785Okhu

rsa_pubkey.plain

Extracted

Family

redline

Botnet

lux3

176.123.9.142:14845

Attributes

auth_value
e94dff9a76da90d6b000642c4a52574b

Extracted

Family

amadey

Version

3.87

http://79.137.192.18/9bDc8sQ/index.php

Attributes

install_dir
577f58beff
install_file
yiueea.exe
strings_key
a5085075a537f09dec81cc154ec0af4d

rc4.plain

Extracted

Family

smokeloader

Botnet

pub1

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Detected Djvu ransomware 22 IoCs

resource	yara_rule
behavioral1/memory/2248-34-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2248-37-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2248-43-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2248-29-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3328-25-0x00000000024B0000-0x00000000025CB000-memory.dmp	family_djvu
behavioral1/memory/4800-63-0x0000000002460000-0x000000000257B000-memory.dmp	family_djvu
behavioral1/memory/3992-75-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3992-78-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3992-69-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3992-83-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3992-109-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2248-106-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3204-151-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3656-149-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4732-144-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4732-136-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4732-161-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3204-160-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3656-165-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3204-171-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3656-173-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4732-214-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Detects LgoogLoader payload 1 IoCs

resource	yara_rule
behavioral1/memory/4220-169-0x0000000000E80000-0x0000000000E8D000-memory.dmp	family_lgoogloader

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
LgoogLoader
A downloader capable of dropping and executing other malware families.
downloader lgoogloader
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation	48A2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation	yiueea.exe
Key value queried	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation	E86F.exe
Key value queried	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation	DA43.exe
Key value queried	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\Control Panel\International\Geo\Nation	DE9A.exe

Executes dropped EXE 21 IoCs

pid	Process
3328	DA43.exe
3192	DC19.exe
2248	DA43.exe
4800	DE9A.exe
3992	DE9A.exe
4092	E86F.exe
2936	DA43.exe
3432	EB2F.exe
728	DE9A.exe
4176	48A2.exe
4732	E86F.exe
3656	DE9A.exe
3204	DA43.exe
2308	yiueea.exe
4292	5F96.exe
4788	698B.exe
832	E86F.exe
3356	E86F.exe
728	yiueea.exe
4220	D601.exe
4104	yiueea.exe

Loads dropped DLL 1 IoCs

pid	Process
2960	regsvr32.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2820	icacls.exe
2536	icacls.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\a63c53b4-6761-4487-8a71-a582293d5485\\DE9A.exe\" --AutoStart"	DE9A.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\8c83ee06-ed8b-4035-9d65-199a393ded51\\DA43.exe\" --AutoStart"	DA43.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
43	api.2ip.ua
44	api.2ip.ua
49	api.2ip.ua
62	api.2ip.ua

Suspicious use of SetThreadContext 9 IoCs

description	pid	Process	procid_target
PID 3328 set thread context of 2248	3328	DA43.exe	87
PID 4800 set thread context of 3992	4800	DE9A.exe	91
PID 4092 set thread context of 4732	4092	E86F.exe	101
PID 3432 set thread context of 4220	3432	EB2F.exe	103
PID 728 set thread context of 3656	728	DE9A.exe	102
PID 2936 set thread context of 3204	2936	DA43.exe	107
PID 832 set thread context of 3356	832	E86F.exe	121
PID 4788 set thread context of 4296	4788	698B.exe	130
PID 4220 set thread context of 532	4220	D601.exe	137

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4384	3204	WerFault.exe	107
2712	3656	WerFault.exe	102
2980	3356	WerFault.exe	121

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	5F96.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	5F96.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	47d11b74ec643cf70ab8897d755a6b14191c5445c30f6dc1f78ba1c0cd8aad53.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	47d11b74ec643cf70ab8897d755a6b14191c5445c30f6dc1f78ba1c0cd8aad53.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	47d11b74ec643cf70ab8897d755a6b14191c5445c30f6dc1f78ba1c0cd8aad53.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	5F96.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4760	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4312	47d11b74ec643cf70ab8897d755a6b14191c5445c30f6dc1f78ba1c0cd8aad53.exe
4312	47d11b74ec643cf70ab8897d755a6b14191c5445c30f6dc1f78ba1c0cd8aad53.exe
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found
3216	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3216	Process not Found

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
4312	47d11b74ec643cf70ab8897d755a6b14191c5445c30f6dc1f78ba1c0cd8aad53.exe
4292	5F96.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeDebugPrivilege	3192	DC19.exe
Token: SeDebugPrivilege	4296	AppLaunch.exe
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeDebugPrivilege	4220	D601.exe
Token: SeShutdownPrivilege	3216	Process not Found
Token: SeCreatePagefilePrivilege	3216	Process not Found
Token: SeShutdownPrivilege	3216	Process not Found

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3216	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 3328	3216	Process not Found	86
PID 3216 wrote to memory of 3328	3216	Process not Found	86
PID 3216 wrote to memory of 3328	3216	Process not Found	86
PID 3328 wrote to memory of 2248	3328	DA43.exe	87
PID 3328 wrote to memory of 2248	3328	DA43.exe	87
PID 3328 wrote to memory of 2248	3328	DA43.exe	87
PID 3328 wrote to memory of 2248	3328	DA43.exe	87
PID 3328 wrote to memory of 2248	3328	DA43.exe	87
PID 3328 wrote to memory of 2248	3328	DA43.exe	87
PID 3328 wrote to memory of 2248	3328	DA43.exe	87
PID 3328 wrote to memory of 2248	3328	DA43.exe	87
PID 3328 wrote to memory of 2248	3328	DA43.exe	87
PID 3328 wrote to memory of 2248	3328	DA43.exe	87
PID 3216 wrote to memory of 3192	3216	Process not Found	88
PID 3216 wrote to memory of 3192	3216	Process not Found	88
PID 3216 wrote to memory of 3192	3216	Process not Found	88
PID 3216 wrote to memory of 4800	3216	Process not Found	90
PID 3216 wrote to memory of 4800	3216	Process not Found	90
PID 3216 wrote to memory of 4800	3216	Process not Found	90
PID 4800 wrote to memory of 3992	4800	DE9A.exe	91
PID 4800 wrote to memory of 3992	4800	DE9A.exe	91
PID 4800 wrote to memory of 3992	4800	DE9A.exe	91
PID 4800 wrote to memory of 3992	4800	DE9A.exe	91
PID 4800 wrote to memory of 3992	4800	DE9A.exe	91
PID 4800 wrote to memory of 3992	4800	DE9A.exe	91
PID 4800 wrote to memory of 3992	4800	DE9A.exe	91
PID 4800 wrote to memory of 3992	4800	DE9A.exe	91
PID 4800 wrote to memory of 3992	4800	DE9A.exe	91
PID 4800 wrote to memory of 3992	4800	DE9A.exe	91
PID 3992 wrote to memory of 2536	3992	DE9A.exe	93
PID 3992 wrote to memory of 2536	3992	DE9A.exe	93
PID 3992 wrote to memory of 2536	3992	DE9A.exe	93
PID 2248 wrote to memory of 2820	2248	DA43.exe	92
PID 2248 wrote to memory of 2820	2248	DA43.exe	92
PID 2248 wrote to memory of 2820	2248	DA43.exe	92
PID 3216 wrote to memory of 4092	3216	Process not Found	94
PID 3216 wrote to memory of 4092	3216	Process not Found	94
PID 3216 wrote to memory of 4092	3216	Process not Found	94
PID 2248 wrote to memory of 2936	2248	DA43.exe	97
PID 2248 wrote to memory of 2936	2248	DA43.exe	97
PID 2248 wrote to memory of 2936	2248	DA43.exe	97
PID 3992 wrote to memory of 728	3992	DE9A.exe	96
PID 3992 wrote to memory of 728	3992	DE9A.exe	96
PID 3992 wrote to memory of 728	3992	DE9A.exe	96
PID 3216 wrote to memory of 3432	3216	Process not Found	98
PID 3216 wrote to memory of 3432	3216	Process not Found	98
PID 3216 wrote to memory of 4176	3216	Process not Found	99
PID 3216 wrote to memory of 4176	3216	Process not Found	99
PID 3216 wrote to memory of 4176	3216	Process not Found	99
PID 4092 wrote to memory of 4732	4092	E86F.exe	101
PID 4092 wrote to memory of 4732	4092	E86F.exe	101
PID 4092 wrote to memory of 4732	4092	E86F.exe	101
PID 3432 wrote to memory of 4220	3432	EB2F.exe	103
PID 3432 wrote to memory of 4220	3432	EB2F.exe	103
PID 3432 wrote to memory of 4220	3432	EB2F.exe	103
PID 4092 wrote to memory of 4732	4092	E86F.exe	101
PID 4092 wrote to memory of 4732	4092	E86F.exe	101
PID 4092 wrote to memory of 4732	4092	E86F.exe	101
PID 4092 wrote to memory of 4732	4092	E86F.exe	101
PID 4092 wrote to memory of 4732	4092	E86F.exe	101
PID 4092 wrote to memory of 4732	4092	E86F.exe	101
PID 4092 wrote to memory of 4732	4092	E86F.exe	101
PID 3432 wrote to memory of 4220	3432	EB2F.exe	103
PID 3432 wrote to memory of 4220	3432	EB2F.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\47d11b74ec643cf70ab8897d755a6b14191c5445c30f6dc1f78ba1c0cd8aad53.exe
"C:\Users\Admin\AppData\Local\Temp\47d11b74ec643cf70ab8897d755a6b14191c5445c30f6dc1f78ba1c0cd8aad53.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4312

C:\Users\Admin\AppData\Local\Temp\DA43.exe
C:\Users\Admin\AppData\Local\Temp\DA43.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Users\Admin\AppData\Local\Temp\DA43.exe
  C:\Users\Admin\AppData\Local\Temp\DA43.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\8c83ee06-ed8b-4035-9d65-199a393ded51" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:2820
- - C:\Users\Admin\AppData\Local\Temp\DA43.exe
    "C:\Users\Admin\AppData\Local\Temp\DA43.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:2936
  - - C:\Users\Admin\AppData\Local\Temp\DA43.exe
      "C:\Users\Admin\AppData\Local\Temp\DA43.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Executes dropped EXE
      PID:3204
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3204 -s 568
        5⤵
        Program crash
        
        PID:4384

C:\Users\Admin\AppData\Local\Temp\DC19.exe
C:\Users\Admin\AppData\Local\Temp\DC19.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3192

C:\Users\Admin\AppData\Local\Temp\DE9A.exe
C:\Users\Admin\AppData\Local\Temp\DE9A.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Users\Admin\AppData\Local\Temp\DE9A.exe
  C:\Users\Admin\AppData\Local\Temp\DE9A.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3992
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\a63c53b4-6761-4487-8a71-a582293d5485" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:2536
- - C:\Users\Admin\AppData\Local\Temp\DE9A.exe
    "C:\Users\Admin\AppData\Local\Temp\DE9A.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:728
  - - C:\Users\Admin\AppData\Local\Temp\DE9A.exe
      "C:\Users\Admin\AppData\Local\Temp\DE9A.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Executes dropped EXE
      PID:3656
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3656 -s 568
        5⤵
        Program crash
        
        PID:2712

C:\Users\Admin\AppData\Local\Temp\E86F.exe
C:\Users\Admin\AppData\Local\Temp\E86F.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Users\Admin\AppData\Local\Temp\E86F.exe
  C:\Users\Admin\AppData\Local\Temp\E86F.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4732
- - C:\Users\Admin\AppData\Local\Temp\E86F.exe
    "C:\Users\Admin\AppData\Local\Temp\E86F.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:832
  - - C:\Users\Admin\AppData\Local\Temp\E86F.exe
      "C:\Users\Admin\AppData\Local\Temp\E86F.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Executes dropped EXE
      PID:3356
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3356 -s 568
        5⤵
        Program crash
        
        PID:2980

C:\Users\Admin\AppData\Local\Temp\EB2F.exe
C:\Users\Admin\AppData\Local\Temp\EB2F.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3432
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:4220

C:\Users\Admin\AppData\Local\Temp\48A2.exe
C:\Users\Admin\AppData\Local\Temp\48A2.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:4176
- C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe
  "C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:2308
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN yiueea.exe /TR "C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe" /F
    3⤵
    - Creates scheduled task(s)
    PID:4760
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /k echo Y|CACLS "yiueea.exe" /P "Admin:N"&&CACLS "yiueea.exe" /P "Admin:R" /E&&echo Y|CACLS "..\577f58beff" /P "Admin:N"&&CACLS "..\577f58beff" /P "Admin:R" /E&&Exit
    3⤵
    PID:4100
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:364
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "yiueea.exe" /P "Admin:N"
      4⤵
      PID:2436
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "yiueea.exe" /P "Admin:R" /E
      4⤵
      PID:2760
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo Y"
      4⤵
      PID:1352
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\577f58beff" /P "Admin:N"
      4⤵
      PID:4072
  - - C:\Windows\SysWOW64\cacls.exe
      CACLS "..\577f58beff" /P "Admin:R" /E
      4⤵
      PID:1580

C:\Users\Admin\AppData\Local\Temp\5F96.exe
C:\Users\Admin\AppData\Local\Temp\5F96.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3656 -ip 3656
1⤵
PID:2064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3204 -ip 3204
1⤵
PID:3396

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\6842.dll
1⤵
PID:4156
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\6842.dll
  2⤵
  - Loads dropped DLL
  PID:2960

C:\Users\Admin\AppData\Local\Temp\698B.exe
C:\Users\Admin\AppData\Local\Temp\698B.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4788
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:2480
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 3356 -ip 3356
1⤵
PID:1944

C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe
C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe
1⤵
- Executes dropped EXE
PID:728

C:\Users\Admin\AppData\Local\Temp\D601.exe
C:\Users\Admin\AppData\Local\Temp\D601.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:4220
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:532
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
    3⤵
    PID:4188
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:3460

C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe
C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe
1⤵
- Executes dropped EXE
PID:4104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
2KB

MD5
bcf9c82a8e06cd4dbc7c6f8166b03d62

SHA1
aa072fd0adc30bc7d45952443a137972eaea0499

SHA256
32b64ccb43add6147056e3f68bd46c762c8b38dea72735355fc422160a0f417d

SHA512
7a26e9797da034f01a08a1b62e4e7e39de67526257d015a0ef7590968af690fecb1852a0f3ee05f64bbf571344eb74ef4d404d2f145f7e7dd36f6a21816ba4a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
2KB

MD5
bcf9c82a8e06cd4dbc7c6f8166b03d62

SHA1
aa072fd0adc30bc7d45952443a137972eaea0499

SHA256
32b64ccb43add6147056e3f68bd46c762c8b38dea72735355fc422160a0f417d

SHA512
7a26e9797da034f01a08a1b62e4e7e39de67526257d015a0ef7590968af690fecb1852a0f3ee05f64bbf571344eb74ef4d404d2f145f7e7dd36f6a21816ba4a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
1KB

MD5
fa4ae5fcb44bfaf845b845961180d250

SHA1
8257ee68bdd2bc3ea2723eda7aeba404195d46bf

SHA256
574c66c19561773196a88f115168cf5d73b71fd26f9034606fe38a5535d4df96

SHA512
ad1de0c1d0f5a4a7e3615b48537f75250779368b388520b001d96367d5aa19fa88a9f471d1212e679ab9eaae854374445807877891bf1b803fa6c7886877d253

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
488B

MD5
dfbf306c1285d7130a3bc15b3c8f33d1

SHA1
994dfdb9d738a01a7491ee3e77d041f73a9c813b

SHA256
7329269b53033f7b308637dabe9e45e9feb3d59df97197fe2ca1df9cfb814ef8

SHA512
cbeef6bbe32271ad6357c360a081a00fd79c4d6cf71b8896728e7b079bcf0c1d11cca2324eb02c74a0ce0ee5a6888f1f99131815ebfc0ca7e2b59a778360e87e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
488B

MD5
e0dfde1b42625d8169860c69704e3de9

SHA1
aabdabe85b6452512da3f2f2e967b34d4b3dd743

SHA256
3a05a01bbea98a2ee336cd4619e5424bd60a2a2ebb6169858230171b99b232cf

SHA512
6224d2de22ce8ff6ef7ade3d9b8f9e085cc161fd844dd379de25f6305f69e39b1e1a1a0a770bf218b47a3aede9d2cecf5f80f37651cd8784bb1bc61ace7d0f3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
482B

MD5
bd79816cbda0a1e1cea7b915e84d704d

SHA1
a65a48995a55f438bbca3a29aec847c449a68a58

SHA256
02d60fef50b88f1762943973f239e30dd8ce01dc7149b7519201282088c52892

SHA512
30d21129937ef3022935a6629debf9ab1893483128ac77cb62fcfabfb5856fb2c3b021523d41feeb5965d7e481b33718108602119139710b38ffae03d940fafe

Download Submit
C:\Users\Admin\AppData\Local\8c83ee06-ed8b-4035-9d65-199a393ded51\DA43.exe

Filesize
785KB

MD5
f92f2eec85513885dd5862254be5f494

SHA1
20da4d8089afec4873cedf763007a222df721572

SHA256
6249c6dfd60d61b7e10ddbe52f4be48a8cd6c26da6cf71611ba7fc64617ac424

SHA512
0ca3146843808daa5a7fb8f243c7540c4e4b5cdf5463f903bc6b531a2fbc8fb2734ef8b102015a89a99e94b8f4e5f144ce2f527e377c5bde31605117723e3bea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log

Filesize
2KB

MD5
9b756bc85e5324eb8f87a69e3f9959ab

SHA1
1778b2e2d6a00c421578a284db1e743931611d66

SHA256
e347a39e49ca8c835cc47d3f039230969e7c4156089f2e83e8a0aed1df88016e

SHA512
c897af3307e3c3163762021f49934ac5fbeab27f123e814bc390bdf1f0ed46671afeadcc87a8a4b18ddf13f4abd0d8ef00343af91ff999d7d447c96505d866d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\48A2.exe

Filesize
307KB

MD5
55f845c433e637594aaf872e41fda207

SHA1
1188348ca7e52f075e7d1d0031918c2cea93362e

SHA256
f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39

SHA512
5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\48A2.exe

Filesize
307KB

MD5
55f845c433e637594aaf872e41fda207

SHA1
1188348ca7e52f075e7d1d0031918c2cea93362e

SHA256
f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39

SHA512
5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe

Filesize
307KB

MD5
55f845c433e637594aaf872e41fda207

SHA1
1188348ca7e52f075e7d1d0031918c2cea93362e

SHA256
f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39

SHA512
5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe

Filesize
307KB

MD5
55f845c433e637594aaf872e41fda207

SHA1
1188348ca7e52f075e7d1d0031918c2cea93362e

SHA256
f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39

SHA512
5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe

Filesize
307KB

MD5
55f845c433e637594aaf872e41fda207

SHA1
1188348ca7e52f075e7d1d0031918c2cea93362e

SHA256
f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39

SHA512
5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe

Filesize
307KB

MD5
55f845c433e637594aaf872e41fda207

SHA1
1188348ca7e52f075e7d1d0031918c2cea93362e

SHA256
f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39

SHA512
5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\577f58beff\yiueea.exe

Filesize
307KB

MD5
55f845c433e637594aaf872e41fda207

SHA1
1188348ca7e52f075e7d1d0031918c2cea93362e

SHA256
f9f9b154f928549c7a4b484909f41352048ce8148c678f4ec32c807c1d173a39

SHA512
5a9b5e83b41041259060e3a29163cdd5ed271c5d476fa455b40ec9bc32bf4bcddaf3aa1ba23faacc2669be420acb905677ec4fcfb3d69e7b9f7908ae5cbd18a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\5F96.exe

Filesize
277KB

MD5
9b89b59b5dc629bde04527f5c1331629

SHA1
3b35e33d321cf91b33043c4dfc7d83b377cbb409

SHA256
b1efe538135cdbab650382ac32ae97fb64600147a80b246c2e2d6e0c8da2eb69

SHA512
8195ca3da1fe59247b2bab1076bdf1ed8ac78ee3b5b22d7d4fa77108226a3b4b29a3800132097d87b03e8ee6c255386a609f61a24352e5fe8d729ce2515e1c15

Download Submit
C:\Users\Admin\AppData\Local\Temp\5F96.exe

Filesize
277KB

MD5
9b89b59b5dc629bde04527f5c1331629

SHA1
3b35e33d321cf91b33043c4dfc7d83b377cbb409

SHA256
b1efe538135cdbab650382ac32ae97fb64600147a80b246c2e2d6e0c8da2eb69

SHA512
8195ca3da1fe59247b2bab1076bdf1ed8ac78ee3b5b22d7d4fa77108226a3b4b29a3800132097d87b03e8ee6c255386a609f61a24352e5fe8d729ce2515e1c15

Download Submit
C:\Users\Admin\AppData\Local\Temp\6842.dll

Filesize
2.7MB

MD5
d7bc2923dc1072484904a48b0441ad27

SHA1
94045c24ca38394bdd8a03d9b375599d03c7999a

SHA256
1905aadfc6ecfb37b7dd9170642e35b1b8d8cc9ffd04d194b166d6c2b03004e0

SHA512
e4241239fff67bbf6724c4865c969cd9674788a5519e41e3dba1d068d247b9b474e3eba414150b7665cf32736d5ef9bf5385c46073832d9b05675d20e2a8fe71

Download Submit
C:\Users\Admin\AppData\Local\Temp\6842.dll

Filesize
2.7MB

MD5
d7bc2923dc1072484904a48b0441ad27

SHA1
94045c24ca38394bdd8a03d9b375599d03c7999a

SHA256
1905aadfc6ecfb37b7dd9170642e35b1b8d8cc9ffd04d194b166d6c2b03004e0

SHA512
e4241239fff67bbf6724c4865c969cd9674788a5519e41e3dba1d068d247b9b474e3eba414150b7665cf32736d5ef9bf5385c46073832d9b05675d20e2a8fe71

Download Submit
C:\Users\Admin\AppData\Local\Temp\698B.exe

Filesize
392KB

MD5
9b8f98a82c25b45bd760c346bab24bae

SHA1
dc3f1171835599109ecf4d30acbe6bb987defa25

SHA256
69324d05eecba291e456afdabe4c9030bc2aa54049ead553bb57664dd6fed0fd

SHA512
5557e3b237c03165caa9dccba7aecc2029263b5736f33027e07fbff95cee4b93c508e12388398acd7b750637108ee63cbcb4a794ba6f6c9f88af9c850dd4c69b

Download Submit
C:\Users\Admin\AppData\Local\Temp\698B.exe

Filesize
392KB

MD5
9b8f98a82c25b45bd760c346bab24bae

SHA1
dc3f1171835599109ecf4d30acbe6bb987defa25

SHA256
69324d05eecba291e456afdabe4c9030bc2aa54049ead553bb57664dd6fed0fd

SHA512
5557e3b237c03165caa9dccba7aecc2029263b5736f33027e07fbff95cee4b93c508e12388398acd7b750637108ee63cbcb4a794ba6f6c9f88af9c850dd4c69b

Download Submit
C:\Users\Admin\AppData\Local\Temp\D601.exe

Filesize
505KB

MD5
3082e7832f7a31397990d4d3ae4c75c9

SHA1
769b150e219c7e8d7221f7a0f0ba6ef617fd036d

SHA256
716f6379cc32afb03ef2639b14e32b4df5538b99b84dafe355b39f8934e7c740

SHA512
8e371f4b075070daf8efb449ab87d923eb4d3cad74d7c9c3d3cef76f43f268c0e4aabe6fa1f801e20ac49e25f9bac70338044fbe9bd408883429ca34fb98ade4

Download Submit
C:\Users\Admin\AppData\Local\Temp\D601.exe

Filesize
505KB

MD5
3082e7832f7a31397990d4d3ae4c75c9

SHA1
769b150e219c7e8d7221f7a0f0ba6ef617fd036d

SHA256
716f6379cc32afb03ef2639b14e32b4df5538b99b84dafe355b39f8934e7c740

SHA512
8e371f4b075070daf8efb449ab87d923eb4d3cad74d7c9c3d3cef76f43f268c0e4aabe6fa1f801e20ac49e25f9bac70338044fbe9bd408883429ca34fb98ade4

Download Submit
C:\Users\Admin\AppData\Local\Temp\DA43.exe

Filesize
785KB

MD5
f92f2eec85513885dd5862254be5f494

SHA1
20da4d8089afec4873cedf763007a222df721572

SHA256
6249c6dfd60d61b7e10ddbe52f4be48a8cd6c26da6cf71611ba7fc64617ac424

SHA512
0ca3146843808daa5a7fb8f243c7540c4e4b5cdf5463f903bc6b531a2fbc8fb2734ef8b102015a89a99e94b8f4e5f144ce2f527e377c5bde31605117723e3bea

Download Submit
C:\Users\Admin\AppData\Local\Temp\DA43.exe

Filesize
785KB

MD5
f92f2eec85513885dd5862254be5f494

SHA1
20da4d8089afec4873cedf763007a222df721572

SHA256
6249c6dfd60d61b7e10ddbe52f4be48a8cd6c26da6cf71611ba7fc64617ac424

SHA512
0ca3146843808daa5a7fb8f243c7540c4e4b5cdf5463f903bc6b531a2fbc8fb2734ef8b102015a89a99e94b8f4e5f144ce2f527e377c5bde31605117723e3bea

Download Submit
C:\Users\Admin\AppData\Local\Temp\DA43.exe

Filesize
785KB

MD5
f92f2eec85513885dd5862254be5f494

SHA1
20da4d8089afec4873cedf763007a222df721572

SHA256
6249c6dfd60d61b7e10ddbe52f4be48a8cd6c26da6cf71611ba7fc64617ac424

SHA512
0ca3146843808daa5a7fb8f243c7540c4e4b5cdf5463f903bc6b531a2fbc8fb2734ef8b102015a89a99e94b8f4e5f144ce2f527e377c5bde31605117723e3bea

Download Submit
C:\Users\Admin\AppData\Local\Temp\DA43.exe

Filesize
785KB

MD5
f92f2eec85513885dd5862254be5f494

SHA1
20da4d8089afec4873cedf763007a222df721572

SHA256
6249c6dfd60d61b7e10ddbe52f4be48a8cd6c26da6cf71611ba7fc64617ac424

SHA512
0ca3146843808daa5a7fb8f243c7540c4e4b5cdf5463f903bc6b531a2fbc8fb2734ef8b102015a89a99e94b8f4e5f144ce2f527e377c5bde31605117723e3bea

Download Submit
C:\Users\Admin\AppData\Local\Temp\DA43.exe

Filesize
785KB

MD5
f92f2eec85513885dd5862254be5f494

SHA1
20da4d8089afec4873cedf763007a222df721572

SHA256
6249c6dfd60d61b7e10ddbe52f4be48a8cd6c26da6cf71611ba7fc64617ac424

SHA512
0ca3146843808daa5a7fb8f243c7540c4e4b5cdf5463f903bc6b531a2fbc8fb2734ef8b102015a89a99e94b8f4e5f144ce2f527e377c5bde31605117723e3bea

Download Submit
C:\Users\Admin\AppData\Local\Temp\DC19.exe

Filesize
261KB

MD5
eda1b6f6e01f038267413b3ae9d3eb23

SHA1
6e71d68c3496b513ba4f1b924fd46ddfdfb2c305

SHA256
7c34d3d22db889dfe3f1ab7e5810a04436330824da5a8fdecc03a987876d66da

SHA512
420b4cda1ab0ce3293a4954283cb12c53882f50b5aa5f0921b1bd915257694508d79420cb680ba36ef88636bc479e98e054549ca67d17f0e63d8f38d384b0c30

Download Submit
C:\Users\Admin\AppData\Local\Temp\DC19.exe

Filesize
261KB

MD5
eda1b6f6e01f038267413b3ae9d3eb23

SHA1
6e71d68c3496b513ba4f1b924fd46ddfdfb2c305

SHA256
7c34d3d22db889dfe3f1ab7e5810a04436330824da5a8fdecc03a987876d66da

SHA512
420b4cda1ab0ce3293a4954283cb12c53882f50b5aa5f0921b1bd915257694508d79420cb680ba36ef88636bc479e98e054549ca67d17f0e63d8f38d384b0c30

Download Submit
C:\Users\Admin\AppData\Local\Temp\DE9A.exe

Filesize
806KB

MD5
d27125ae65af3a6ce086eeae8fa41521

SHA1
70209d54e90908fc10f99af3cb38620bd744f93b

SHA256
4745aee336bf0a92efae4475d6a541fbd9cc91b65532a26a1810b49ad5f8dbea

SHA512
93f941a68d8eaea98d146520f786773e688bf5673ab37110efe065e05f9af6f81c43e050e90b20348b92888abc519e2094bcce37e22ab9a4a0e439c8dd88b68e

Download Submit
C:\Users\Admin\AppData\Local\Temp\DE9A.exe

Filesize
806KB

MD5
d27125ae65af3a6ce086eeae8fa41521

SHA1
70209d54e90908fc10f99af3cb38620bd744f93b

SHA256
4745aee336bf0a92efae4475d6a541fbd9cc91b65532a26a1810b49ad5f8dbea

SHA512
93f941a68d8eaea98d146520f786773e688bf5673ab37110efe065e05f9af6f81c43e050e90b20348b92888abc519e2094bcce37e22ab9a4a0e439c8dd88b68e

Download Submit
C:\Users\Admin\AppData\Local\Temp\DE9A.exe

Filesize
806KB

MD5
d27125ae65af3a6ce086eeae8fa41521

SHA1
70209d54e90908fc10f99af3cb38620bd744f93b

SHA256
4745aee336bf0a92efae4475d6a541fbd9cc91b65532a26a1810b49ad5f8dbea

SHA512
93f941a68d8eaea98d146520f786773e688bf5673ab37110efe065e05f9af6f81c43e050e90b20348b92888abc519e2094bcce37e22ab9a4a0e439c8dd88b68e

Download Submit
C:\Users\Admin\AppData\Local\Temp\DE9A.exe

Filesize
806KB

MD5
d27125ae65af3a6ce086eeae8fa41521

SHA1
70209d54e90908fc10f99af3cb38620bd744f93b

SHA256
4745aee336bf0a92efae4475d6a541fbd9cc91b65532a26a1810b49ad5f8dbea

SHA512
93f941a68d8eaea98d146520f786773e688bf5673ab37110efe065e05f9af6f81c43e050e90b20348b92888abc519e2094bcce37e22ab9a4a0e439c8dd88b68e

Download Submit
C:\Users\Admin\AppData\Local\Temp\DE9A.exe

Filesize
806KB

MD5
d27125ae65af3a6ce086eeae8fa41521

SHA1
70209d54e90908fc10f99af3cb38620bd744f93b

SHA256
4745aee336bf0a92efae4475d6a541fbd9cc91b65532a26a1810b49ad5f8dbea

SHA512
93f941a68d8eaea98d146520f786773e688bf5673ab37110efe065e05f9af6f81c43e050e90b20348b92888abc519e2094bcce37e22ab9a4a0e439c8dd88b68e

Download Submit
C:\Users\Admin\AppData\Local\Temp\E86F.exe

Filesize
785KB

MD5
f92f2eec85513885dd5862254be5f494

SHA1
20da4d8089afec4873cedf763007a222df721572

SHA256
6249c6dfd60d61b7e10ddbe52f4be48a8cd6c26da6cf71611ba7fc64617ac424

SHA512
0ca3146843808daa5a7fb8f243c7540c4e4b5cdf5463f903bc6b531a2fbc8fb2734ef8b102015a89a99e94b8f4e5f144ce2f527e377c5bde31605117723e3bea

Download Submit
C:\Users\Admin\AppData\Local\Temp\E86F.exe

Filesize
785KB

MD5
f92f2eec85513885dd5862254be5f494

SHA1
20da4d8089afec4873cedf763007a222df721572

SHA256
6249c6dfd60d61b7e10ddbe52f4be48a8cd6c26da6cf71611ba7fc64617ac424

SHA512
0ca3146843808daa5a7fb8f243c7540c4e4b5cdf5463f903bc6b531a2fbc8fb2734ef8b102015a89a99e94b8f4e5f144ce2f527e377c5bde31605117723e3bea

Download Submit
C:\Users\Admin\AppData\Local\Temp\E86F.exe

Filesize
785KB

MD5
f92f2eec85513885dd5862254be5f494

SHA1
20da4d8089afec4873cedf763007a222df721572

SHA256
6249c6dfd60d61b7e10ddbe52f4be48a8cd6c26da6cf71611ba7fc64617ac424

SHA512
0ca3146843808daa5a7fb8f243c7540c4e4b5cdf5463f903bc6b531a2fbc8fb2734ef8b102015a89a99e94b8f4e5f144ce2f527e377c5bde31605117723e3bea

Download Submit
C:\Users\Admin\AppData\Local\Temp\E86F.exe

Filesize
785KB

MD5
f92f2eec85513885dd5862254be5f494

SHA1
20da4d8089afec4873cedf763007a222df721572

SHA256
6249c6dfd60d61b7e10ddbe52f4be48a8cd6c26da6cf71611ba7fc64617ac424

SHA512
0ca3146843808daa5a7fb8f243c7540c4e4b5cdf5463f903bc6b531a2fbc8fb2734ef8b102015a89a99e94b8f4e5f144ce2f527e377c5bde31605117723e3bea

Download Submit
C:\Users\Admin\AppData\Local\Temp\E86F.exe

Filesize
785KB

MD5
f92f2eec85513885dd5862254be5f494

SHA1
20da4d8089afec4873cedf763007a222df721572

SHA256
6249c6dfd60d61b7e10ddbe52f4be48a8cd6c26da6cf71611ba7fc64617ac424

SHA512
0ca3146843808daa5a7fb8f243c7540c4e4b5cdf5463f903bc6b531a2fbc8fb2734ef8b102015a89a99e94b8f4e5f144ce2f527e377c5bde31605117723e3bea

Download Submit
C:\Users\Admin\AppData\Local\Temp\E86F.exe

Filesize
785KB

MD5
f92f2eec85513885dd5862254be5f494

SHA1
20da4d8089afec4873cedf763007a222df721572

SHA256
6249c6dfd60d61b7e10ddbe52f4be48a8cd6c26da6cf71611ba7fc64617ac424

SHA512
0ca3146843808daa5a7fb8f243c7540c4e4b5cdf5463f903bc6b531a2fbc8fb2734ef8b102015a89a99e94b8f4e5f144ce2f527e377c5bde31605117723e3bea

Download Submit
C:\Users\Admin\AppData\Local\Temp\EB2F.exe

Filesize
2.0MB

MD5
ff7712b5d2dcafd6b9c775eecc8266a1

SHA1
a11c9bd80f1c80f057517fc555fcf9b53c327302

SHA256
51d0be1366d229621051abb5df81316256c997c46265be8c9fb6b6b01fd1ccb1

SHA512
a8dbf46d54d80dd206c61007c668bd93a00a4d8b35937cfdf1b723d69484bc6230763a0cd73b602e58392a0b6814c8143877b479709fd6ab03ea98eda61c0edf

Download Submit
C:\Users\Admin\AppData\Local\Temp\EB2F.exe

Filesize
2.0MB

MD5
ff7712b5d2dcafd6b9c775eecc8266a1

SHA1
a11c9bd80f1c80f057517fc555fcf9b53c327302

SHA256
51d0be1366d229621051abb5df81316256c997c46265be8c9fb6b6b01fd1ccb1

SHA512
a8dbf46d54d80dd206c61007c668bd93a00a4d8b35937cfdf1b723d69484bc6230763a0cd73b602e58392a0b6814c8143877b479709fd6ab03ea98eda61c0edf

Download Submit
C:\Users\Admin\AppData\Local\a63c53b4-6761-4487-8a71-a582293d5485\DE9A.exe

Filesize
806KB

MD5
d27125ae65af3a6ce086eeae8fa41521

SHA1
70209d54e90908fc10f99af3cb38620bd744f93b

SHA256
4745aee336bf0a92efae4475d6a541fbd9cc91b65532a26a1810b49ad5f8dbea

SHA512
93f941a68d8eaea98d146520f786773e688bf5673ab37110efe065e05f9af6f81c43e050e90b20348b92888abc519e2094bcce37e22ab9a4a0e439c8dd88b68e

Download Submit
C:\Users\Admin\AppData\Roaming\fgsvssr

Filesize
277KB

MD5
9b89b59b5dc629bde04527f5c1331629

SHA1
3b35e33d321cf91b33043c4dfc7d83b377cbb409

SHA256
b1efe538135cdbab650382ac32ae97fb64600147a80b246c2e2d6e0c8da2eb69

SHA512
8195ca3da1fe59247b2bab1076bdf1ed8ac78ee3b5b22d7d4fa77108226a3b4b29a3800132097d87b03e8ee6c255386a609f61a24352e5fe8d729ce2515e1c15

Download Submit
memory/728-158-0x0000000002469000-0x00000000024FB000-memory.dmp

Filesize
584KB

Download
memory/832-215-0x0000000002460000-0x00000000024FA000-memory.dmp

Filesize
616KB

Download
memory/2248-29-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2248-34-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2248-37-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2248-106-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2248-43-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2936-159-0x000000000240D000-0x000000000249E000-memory.dmp

Filesize
580KB

Download
memory/2960-208-0x0000000000AA0000-0x0000000000AA6000-memory.dmp

Filesize
24KB

Download
memory/3192-118-0x0000000005280000-0x00000000052BC000-memory.dmp

Filesize
240KB

Download
memory/3192-77-0x0000000000400000-0x0000000000445000-memory.dmp

Filesize
276KB

Download
memory/3192-126-0x0000000005440000-0x000000000548C000-memory.dmp

Filesize
304KB

Download
memory/3192-80-0x0000000004980000-0x0000000004986000-memory.dmp

Filesize
24KB

Download
memory/3192-65-0x0000000000980000-0x00000000009B0000-memory.dmp

Filesize
192KB

Download
memory/3192-226-0x0000000004A40000-0x0000000004A50000-memory.dmp

Filesize
64KB

Download
memory/3192-202-0x0000000073960000-0x0000000074110000-memory.dmp

Filesize
7.7MB

Download
memory/3192-79-0x0000000073960000-0x0000000074110000-memory.dmp

Filesize
7.7MB

Download
memory/3192-105-0x0000000004A00000-0x0000000004A12000-memory.dmp

Filesize
72KB

Download
memory/3192-104-0x0000000005170000-0x000000000527A000-memory.dmp

Filesize
1.0MB

Download
memory/3192-103-0x0000000004B50000-0x0000000005168000-memory.dmp

Filesize
6.1MB

Download
memory/3204-171-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3204-160-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3204-151-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3216-146-0x0000000003470000-0x0000000003480000-memory.dmp

Filesize
64KB

Download
memory/3216-66-0x0000000003470000-0x0000000003480000-memory.dmp

Filesize
64KB

Download
memory/3216-35-0x00000000027B0000-0x00000000027C0000-memory.dmp

Filesize
64KB

Download
memory/3216-31-0x0000000003470000-0x0000000003480000-memory.dmp

Filesize
64KB

Download
memory/3216-4-0x0000000002780000-0x0000000002796000-memory.dmp

Filesize
88KB

Download
memory/3216-27-0x0000000003470000-0x0000000003480000-memory.dmp

Filesize
64KB

Download
memory/3216-53-0x0000000003470000-0x0000000003480000-memory.dmp

Filesize
64KB

Download
memory/3216-48-0x0000000003470000-0x0000000003480000-memory.dmp

Filesize
64KB

Download
memory/3216-57-0x0000000003470000-0x0000000003480000-memory.dmp

Filesize
64KB

Download
memory/3216-50-0x0000000003470000-0x0000000003480000-memory.dmp

Filesize
64KB

Download
memory/3216-46-0x0000000003470000-0x0000000003480000-memory.dmp

Filesize
64KB

Download
memory/3216-128-0x0000000003470000-0x0000000003480000-memory.dmp

Filesize
64KB

Download
memory/3216-62-0x0000000003470000-0x0000000003480000-memory.dmp

Filesize
64KB

Download
memory/3216-127-0x0000000003470000-0x0000000003480000-memory.dmp

Filesize
64KB

Download
memory/3216-64-0x0000000003470000-0x0000000003480000-memory.dmp

Filesize
64KB

Download
memory/3216-24-0x0000000003470000-0x0000000003480000-memory.dmp

Filesize
64KB

Download
memory/3216-15-0x0000000003470000-0x0000000003480000-memory.dmp

Filesize
64KB

Download
memory/3216-139-0x00000000027B0000-0x00000000027C0000-memory.dmp

Filesize
64KB

Download
memory/3216-227-0x0000000002F60000-0x0000000002F70000-memory.dmp

Filesize
64KB

Download
memory/3216-152-0x00000000027B0000-0x00000000027C0000-memory.dmp

Filesize
64KB

Download
memory/3216-44-0x0000000003470000-0x0000000003480000-memory.dmp

Filesize
64KB

Download
memory/3216-41-0x0000000003470000-0x0000000003480000-memory.dmp

Filesize
64KB

Download
memory/3216-68-0x0000000003480000-0x0000000003490000-memory.dmp

Filesize
64KB

Download
memory/3216-40-0x00000000027B0000-0x00000000027C0000-memory.dmp

Filesize
64KB

Download
memory/3216-23-0x0000000003470000-0x0000000003480000-memory.dmp

Filesize
64KB

Download
memory/3216-38-0x0000000003470000-0x0000000003480000-memory.dmp

Filesize
64KB

Download
memory/3216-17-0x0000000003470000-0x0000000003480000-memory.dmp

Filesize
64KB

Download
memory/3216-60-0x0000000003470000-0x0000000003480000-memory.dmp

Filesize
64KB

Download
memory/3216-192-0x0000000000E50000-0x0000000000E60000-memory.dmp

Filesize
64KB

Download
memory/3216-16-0x0000000003470000-0x0000000003480000-memory.dmp

Filesize
64KB

Download
memory/3216-18-0x0000000003480000-0x0000000003490000-memory.dmp

Filesize
64KB

Download
memory/3216-71-0x00000000027B0000-0x00000000027B1000-memory.dmp

Filesize
4KB

Download
memory/3216-132-0x0000000003470000-0x0000000003480000-memory.dmp

Filesize
64KB

Download
memory/3216-61-0x0000000003470000-0x0000000003480000-memory.dmp

Filesize
64KB

Download
memory/3216-205-0x0000000003470000-0x0000000003480000-memory.dmp

Filesize
64KB

Download
memory/3216-19-0x0000000003470000-0x0000000003480000-memory.dmp

Filesize
64KB

Download
memory/3216-157-0x0000000003470000-0x0000000003480000-memory.dmp

Filesize
64KB

Download
memory/3216-36-0x0000000003470000-0x0000000003480000-memory.dmp

Filesize
64KB

Download
memory/3216-168-0x0000000003470000-0x0000000003480000-memory.dmp

Filesize
64KB

Download
memory/3216-204-0x0000000003470000-0x0000000003480000-memory.dmp

Filesize
64KB

Download
memory/3216-21-0x0000000003470000-0x0000000003480000-memory.dmp

Filesize
64KB

Download
memory/3216-20-0x0000000003470000-0x0000000003480000-memory.dmp

Filesize
64KB

Download
memory/3216-73-0x0000000003470000-0x0000000003480000-memory.dmp

Filesize
64KB

Download
memory/3216-197-0x00000000027B0000-0x00000000027B1000-memory.dmp

Filesize
4KB

Download
memory/3216-39-0x0000000003470000-0x0000000003480000-memory.dmp

Filesize
64KB

Download
memory/3216-193-0x0000000003470000-0x0000000003480000-memory.dmp

Filesize
64KB

Download
memory/3216-177-0x0000000003470000-0x0000000003480000-memory.dmp

Filesize
64KB

Download
memory/3216-176-0x0000000003470000-0x0000000003480000-memory.dmp

Filesize
64KB

Download
memory/3216-175-0x0000000003470000-0x0000000003480000-memory.dmp

Filesize
64KB

Download
memory/3216-190-0x0000000003470000-0x0000000003480000-memory.dmp

Filesize
64KB

Download
memory/3216-174-0x0000000003470000-0x0000000003480000-memory.dmp

Filesize
64KB

Download
memory/3216-172-0x0000000002F60000-0x0000000002F70000-memory.dmp

Filesize
64KB

Download
memory/3216-180-0x0000000002F60000-0x0000000002F70000-memory.dmp

Filesize
64KB

Download
memory/3216-185-0x0000000003470000-0x0000000003480000-memory.dmp

Filesize
64KB

Download
memory/3216-179-0x0000000003470000-0x0000000003480000-memory.dmp

Filesize
64KB

Download
memory/3216-181-0x0000000003470000-0x0000000003480000-memory.dmp

Filesize
64KB

Download
memory/3216-184-0x0000000003470000-0x0000000003480000-memory.dmp

Filesize
64KB

Download
memory/3216-183-0x0000000000E50000-0x0000000000E60000-memory.dmp

Filesize
64KB

Download
memory/3328-26-0x0000000002410000-0x00000000024A6000-memory.dmp

Filesize
600KB

Download
memory/3328-25-0x00000000024B0000-0x00000000025CB000-memory.dmp

Filesize
1.1MB

Download
memory/3656-165-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3656-149-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3656-173-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3992-75-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3992-109-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3992-78-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3992-83-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3992-69-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4092-141-0x000000000247E000-0x000000000250F000-memory.dmp

Filesize
580KB

Download
memory/4220-169-0x0000000000E80000-0x0000000000E8D000-memory.dmp

Filesize
52KB

Download
memory/4220-131-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4220-140-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4220-164-0x0000000000E60000-0x0000000000E69000-memory.dmp

Filesize
36KB

Download
memory/4220-147-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4292-186-0x0000000000A80000-0x0000000000B80000-memory.dmp

Filesize
1024KB

Download
memory/4292-188-0x0000000000400000-0x0000000000713000-memory.dmp

Filesize
3.1MB

Download
memory/4292-182-0x0000000000870000-0x0000000000879000-memory.dmp

Filesize
36KB

Download
memory/4312-1-0x0000000000890000-0x0000000000990000-memory.dmp

Filesize
1024KB

Download
memory/4312-5-0x0000000000400000-0x0000000000713000-memory.dmp

Filesize
3.1MB

Download
memory/4312-3-0x0000000000400000-0x0000000000713000-memory.dmp

Filesize
3.1MB

Download
memory/4312-2-0x00000000007A0000-0x00000000007A9000-memory.dmp

Filesize
36KB

Download
memory/4732-214-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4732-144-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4732-136-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4732-161-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4800-63-0x0000000002460000-0x000000000257B000-memory.dmp

Filesize
1.1MB

Download
memory/4800-76-0x00000000008E9000-0x000000000097B000-memory.dmp

Filesize
584KB

Download