Overview

overview

10

Static

static

1

!@#Setup-P...24.rar

windows11-21h2-x64

10

Resubmissions

06-12-2023 22:51

231206-2ssccshfe2 10

06-12-2023 22:49

231206-2rqgdahfd3 3

Analysis

  • max time kernel
    341s
  • max time network
    310s
  • platform
    windows11-21h2_x64
  • resource
    win11-20231129-en
  • resource tags

    arch:x64arch:x86image:win11-20231129-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    06-12-2023 22:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    !@#Setup-Pa$$W0rd-2024/@#Setup-Pa$$W0rd-2024.rar

  • Size

    18.5MB

  • MD5

    0aeb13bb3dd0d2761e3966625faac892

  • SHA1

    a12b4adbb104ca945d248697753b4acbf054f157

  • SHA256

    0a52968fe93ad0cfde0d408dbc7e0a77c54ab01fbcc280dd4a1b3b3897c79fce

  • SHA512

    20de52f3c358735ffedcd068a1ea07d8bc66705e524362bd6c1dd1e81636b7f664b7e9d23239441d98dfcff8cbd48a2a6b0ff3bd0c5cede95acdcefdc407a34e

  • SSDEEP

    393216:ZvYV/q2OHdyVYb7VlVEH+odXdun4eSznP/TTzI+B8TaTw2bcuphXe:BYV6QVYbvVwNdun4Db38+B8eTwoz/O

Score
10/10
amadeylummaxmrigdiscoveryevasionminerspywarestealerthemidatrojan

Malware Config

Extracted

Family

amadey

Version

4.13

C2

http://185.172.128.125

Attributes
  • install_dir

    4fdb51ccdc

  • install_file

    Utsysc.exe

  • strings_key

    a70b05054314f381be1ab9a5cdc8b250

  • url_paths

    /u6vhSc3PPq/index.php

rc4.plain

Extracted

Family

lumma

C2

http://gatelistcoldyeisa.pw/api

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 14 IoCs
    evasion
  • XMRig Miner payload 3 IoCs
    miner
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 28 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 59 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 8 IoCs
    evasiontrojan
  • Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 25 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\!@#Setup-Pa$$W0rd-2024\@#Setup-Pa$$W0rd-2024.rar
    1⤵
    • Modifies registry class
    PID:2944
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1372
    • C:\Program Files\7-Zip\7zFM.exe
      "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\!@#Setup-Pa$$W0rd-2024\@#Setup-Pa$$W0rd-2024.rar"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1588
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO43643538\Readme.txt
        3⤵
        • Opens file in notepad (likely ransom note)
        PID:3248
  • C:\Users\Admin\Desktop\Pre-Activated-Setup.exe
    "C:\Users\Admin\Desktop\Pre-Activated-Setup.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4532
    • C:\Users\Admin\AppData\Local\Temp\tgtejjbuvj.exe
      "C:\Users\Admin\AppData\Local\Temp\tgtejjbuvj.exe"
      2⤵
      • Suspicious use of NtCreateUserProcessOtherParentProcess
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4960
    • C:\Users\Admin\AppData\Roaming\wshom\liveupdate.exe
      C:\Users\Admin\AppData\Roaming\wshom\liveupdate.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:3496
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\SysWOW64\cmd.exe
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:3684
        • C:\Windows\System32\certutil.exe
          C:\Windows\System32\certutil.exe
          4⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:5100
          • C:\Windows\explorer.exe
            explorer.exe
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2488
    • C:\Users\Admin\AppData\Local\Temp\vwiwmdednsiaq.exe
      "C:\Users\Admin\AppData\Local\Temp\vwiwmdednsiaq.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:792
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\sm0.0.bat" "
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3872
        • C:\Windows\SysWOW64\timeout.exe
          timeout 3
          4⤵
          • Delays execution with timeout.exe
          PID:4452
        • C:\ProgramData\pinterests\XRJNZC.exe
          "C:\ProgramData\pinterests\XRJNZC.exe"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:3564
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 1 /RL HIGHEST /tn "XRJNZC" /tr C:\ProgramData\pinterests\XRJNZC.exe /f
            5⤵
            • Creates scheduled task(s)
            PID:1400
    • C:\Users\Admin\AppData\Local\Temp\opfqwnhjfcqurgmq.exe
      "C:\Users\Admin\AppData\Local\Temp\opfqwnhjfcqurgmq.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Checks whether UAC is enabled
      PID:2424
      • C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe
        "C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3780
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe" /F
          4⤵
          • Creates scheduled task(s)
          PID:5020
  • C:\ProgramData\pinterests\XRJNZC.exe
    C:\ProgramData\pinterests\XRJNZC.exe
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Executes dropped EXE
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:4264
  • C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe
    C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    PID:1620
  • C:\Windows\system32\control.exe
    "C:\Windows\system32\control.exe" /name Microsoft.AdministrativeTools
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1960
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
    1⤵
      PID:444
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1292
      • C:\Windows\system32\taskmgr.exe
        "C:\Windows\system32\taskmgr.exe" /7
        2⤵
        • Checks SCSI registry key(s)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:1948
    • C:\Windows\system32\BackgroundTransferHost.exe
      "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
      1⤵
        PID:4980
      • C:\ProgramData\pinterests\XRJNZC.exe
        C:\ProgramData\pinterests\XRJNZC.exe
        1⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        PID:3116
      • C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe
        C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe
        1⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        PID:3044
      • C:\Windows\System32\rundll32.exe
        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
        1⤵
          PID:1712
        • C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe
          C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe
          1⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          PID:4784
        • C:\ProgramData\pinterests\XRJNZC.exe
          C:\ProgramData\pinterests\XRJNZC.exe
          1⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          PID:4576
        • C:\Windows\system32\BackgroundTransferHost.exe
          "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
          1⤵
          • Modifies registry class
          PID:2016
        • C:\Windows\system32\osk.exe
          "C:\Windows\system32\osk.exe"
          1⤵
          • Suspicious use of SetWindowsHookEx
          PID:1764
        • C:\ProgramData\pinterests\XRJNZC.exe
          C:\ProgramData\pinterests\XRJNZC.exe
          1⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          PID:3984
        • C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe
          C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe
          1⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          PID:2068
        • C:\Windows\system32\AUDIODG.EXE
          C:\Windows\system32\AUDIODG.EXE 0x00000000000004CC 0x00000000000004E8
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1476
        • C:\ProgramData\pinterests\XRJNZC.exe
          C:\ProgramData\pinterests\XRJNZC.exe
          1⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Checks whether UAC is enabled
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          PID:416
        • C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe
          C:\Users\Admin\AppData\Local\Temp\4fdb51ccdc\Utsysc.exe
          1⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          PID:768

        Network

        MITRE ATT&CK Matrix ATT&CK v13

        Initial Access

        Execution

        Scheduled Task/Job

        1
        T1053

        Persistence

        Scheduled Task/Job

        1
        T1053

        Privilege Escalation

        Scheduled Task/Job

        1
        T1053

        Defense Evasion

        Virtualization/Sandbox Evasion

        1
        T1497

        Modify Registry

        1
        T1112

        Credential Access

        Unsecured Credentials

        3
        T1552

        Credentials In Files

        3
        T1552.001

        Discovery

        Query Registry

        4
        T1012

        Virtualization/Sandbox Evasion

        1
        T1497

        System Information Discovery

        4
        T1082

        Peripheral Device Discovery

        1
        T1120

        Lateral Movement

        Collection

        Data from Local System

        3
        T1005

        Exfiltration

        Command and Control

        Impact

        Resource Development

        Reconnaissance

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\pinterests\XRJNZC.exe
          Filesize

          4.0MB

          MD5

          bc6a35107c6d2cc2ec746897799b9164

          SHA1

          4063a434ec504cc5f808e766b21d0d32d43f5715

          SHA256

          1a4fb00dd58138f058c1dce7f1e2d8e9a3682e21e314d2b5d2618c4ebad5a939

          SHA512

          4eeb67a8ac8452ffe6cfbab3e95355d5115158a8f46e04d10442bea349f1471cef8376dd2d41e4045fa1bf03240a3999f4da0d945f8e68deea7a7d3312e70809

          Download Submit
        • C:\ProgramData\pinterests\XRJNZC.exe
          Filesize

          4.0MB

          MD5

          bc6a35107c6d2cc2ec746897799b9164

          SHA1

          4063a434ec504cc5f808e766b21d0d32d43f5715

          SHA256

          1a4fb00dd58138f058c1dce7f1e2d8e9a3682e21e314d2b5d2618c4ebad5a939

          SHA512

          4eeb67a8ac8452ffe6cfbab3e95355d5115158a8f46e04d10442bea349f1471cef8376dd2d41e4045fa1bf03240a3999f4da0d945f8e68deea7a7d3312e70809

          Download Submit
        • C:\ProgramData\pinterests\XRJNZC.exe
          Filesize

          4.0MB

          MD5

          bc6a35107c6d2cc2ec746897799b9164

          SHA1

          4063a434ec504cc5f808e766b21d0d32d43f5715

          SHA256

          1a4fb00dd58138f058c1dce7f1e2d8e9a3682e21e314d2b5d2618c4ebad5a939

          SHA512

          4eeb67a8ac8452ffe6cfbab3e95355d5115158a8f46e04d10442bea349f1471cef8376dd2d41e4045fa1bf03240a3999f4da0d945f8e68deea7a7d3312e70809

          Download Submit
        • C:\ProgramData\pinterests\XRJNZC.exe
          Filesize

          4.0MB

          MD5

          bc6a35107c6d2cc2ec746897799b9164

          SHA1

          4063a434ec504cc5f808e766b21d0d32d43f5715

          SHA256

          1a4fb00dd58138f058c1dce7f1e2d8e9a3682e21e314d2b5d2618c4ebad5a939

          SHA512

          4eeb67a8ac8452ffe6cfbab3e95355d5115158a8f46e04d10442bea349f1471cef8376dd2d41e4045fa1bf03240a3999f4da0d945f8e68deea7a7d3312e70809

          Download Submit
        • C:\ProgramData\pinterests\XRJNZC.exe
          Filesize

          4.0MB

          MD5

          bc6a35107c6d2cc2ec746897799b9164

          SHA1

          4063a434ec504cc5f808e766b21d0d32d43f5715

          SHA256

          1a4fb00dd58138f058c1dce7f1e2d8e9a3682e21e314d2b5d2618c4ebad5a939

          SHA512

          4eeb67a8ac8452ffe6cfbab3e95355d5115158a8f46e04d10442bea349f1471cef8376dd2d41e4045fa1bf03240a3999f4da0d945f8e68deea7a7d3312e70809

          Download Submit
        • C:\ProgramData\pinterests\XRJNZC.exe
          Filesize

          4.0MB

          MD5

          bc6a35107c6d2cc2ec746897799b9164

          SHA1

          4063a434ec504cc5f808e766b21d0d32d43f5715

          SHA256

          1a4fb00dd58138f058c1dce7f1e2d8e9a3682e21e314d2b5d2618c4ebad5a939

          SHA512

          4eeb67a8ac8452ffe6cfbab3e95355d5115158a8f46e04d10442bea349f1471cef8376dd2d41e4045fa1bf03240a3999f4da0d945f8e68deea7a7d3312e70809

          Download Submit
        • C:\ProgramData\pinterests\XRJNZC.exe
          Filesize

          4.0MB

          MD5

          bc6a35107c6d2cc2ec746897799b9164

          SHA1

          4063a434ec504cc5f808e766b21d0d32d43f5715

          SHA256

          1a4fb00dd58138f058c1dce7f1e2d8e9a3682e21e314d2b5d2618c4ebad5a939

          SHA512

          4eeb67a8ac8452ffe6cfbab3e95355d5115158a8f46e04d10442bea349f1471cef8376dd2d41e4045fa1bf03240a3999f4da0d945f8e68deea7a7d3312e70809

          Download Submit
        • C:\ProgramData\pinterests\XRJNZC.exe
          Filesize

          4.0MB

          MD5

          bc6a35107c6d2cc2ec746897799b9164

          SHA1

          4063a434ec504cc5f808e766b21d0d32d43f5715

          SHA256

          1a4fb00dd58138f058c1dce7f1e2d8e9a3682e21e314d2b5d2618c4ebad5a939

          SHA512

          4eeb67a8ac8452ffe6cfbab3e95355d5115158a8f46e04d10442bea349f1471cef8376dd2d41e4045fa1bf03240a3999f4da0d945f8e68deea7a7d3312e70809

          Download Submit
        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
          Filesize

          14KB

          MD5

          e65e7ff6ba63da8b41a49e3d4906066a

          SHA1

          53ee0a22d55a7a488925736f39e018db85bd0510

          SHA256

          244435383e08928ab492d0c941bc91b255d91adb69ce74b4b9532f8c3503836e

          SHA512

          78d0efa6b7e8e416f46643b3a070ef36450cb2fb027c57956ce57b7fd189187e50d493aea79a05b8e8d62a117c1f1f29d01b00e109b9f0c6a0ecb50cbcff5049

          Download Submit
        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
          Filesize

          28KB

          MD5

          4630bad8d35746d5aea98d350848eb99

          SHA1

          f685a9a40883e789462491e07f2daaf5db1219df

          SHA256

          1e4130e0514ed3dec7407423ee2ae5c0fb2e6fa1f391cb57a14d34c676e65e4b

          SHA512

          2325640b20d98278e03d3b65f81bc1c98861f582e8e4161f8b2ea7d5e7f6ee17c7eaaa13495f910e8b1ddf8f9fb0a0bc3b859041c0c7f08490d2b9429034e854

          Download Submit
        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
          Filesize

          14KB

          MD5

          3cf2f0c869120d7163c6d036497213bf

          SHA1

          ac6cf14bdaedbb55506448bec8e7478f5624a568

          SHA256

          d872e517631e428eebe1c49bd1d3f5a6bbf8f55d7fbabe5ed37042de787143c1

          SHA512

          acd66e3cb66fd711262cf18495838412e4797196efd92302ccb84a10312f18bd06082d58bfa11ed2933fccd09d3d35e3a1c95c56ae1b6728752f7dd77e458179

          Download Submit
        • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\BackgroundTransferApi\828d4825-9e30-4137-8add-269b8b9e22d6.down_data
          Filesize

          555KB

          MD5

          5683c0028832cae4ef93ca39c8ac5029

          SHA1

          248755e4e1db552e0b6f8651b04ca6d1b31a86fb

          SHA256

          855abd360d8a8d6974eba92b70cbd09ce519bc8773439993f9ab37cb6847309e

          SHA512

          aba434bd29be191c823b02ea9b639beb10647bbe7759bbffdaa790dfb1ec2c58d74c525ef11aacda209e4effe322d1d3a07b115446c8914b07a3bce4d8a0e2c3

          Download Submit
        • C:\Users\Admin\AppData\Local\Temp\58e99d85
          Filesize

          7.5MB

          MD5

          8f7df2caa83cfcfa5d895539f1f37240

          SHA1

          0321048b46538ef61cac6d3f06e6203009b4678b

          SHA256

          20fae317a54871fe0dad70c86c1c55197cb369a3ab7e2af70a807232b29b8d5e

          SHA512

          68a9e19873ce86b441853d2b396a975c1f214542b89a7dad75a1d996b73dbb63c1afac9e99771ad961ca06e354aa32a0ac4c8ee2e43aae4018921ea90c1c62ae

          Download Submit
        • C:\Users\Admin\AppData\Local\Temp\7zO43643538\Readme.txt
          Filesize

          116B

          MD5

          aeaa412966cbe5d05a83d1ac60c5fc84

          SHA1

          c6b340a85fb59a156e57d1fa56ebeeb8d3e99cbb

          SHA256

          d5cdee14fed046a1bd4ac755861ca2391a7604a8ef0056ce5a97f83e0f653910

          SHA512

          cbd73c31cfce4d8015bf9028b3a950602c35777095dcedc571dffabc08a1f2ec16045a743f17b3db7b64bfa0e2e213765c3be6ceac258ee495d1baac3c556367

          Download Submit
        • C:\Users\Admin\AppData\Local\Temp\opfqwnhjfcqurgmq.exe
          Filesize

          3.3MB

          MD5

          1f912c12896eb6942bd3f067d47b9250

          SHA1

          8925008534a6149eaf6c47182cb7e1d89ed59471

          SHA256

          3de42e8dcad7071ee556ce2ac67ec15f829ee2aa25b93afdedbf4fe9ec56b90b

          SHA512

          682cd0638af81715232d6bc8fd7b1378d97d99595ef396d536f2b605e12d7ab162b50acfc09c94f039114e7307d8076f7cc5098a149e98e35b40f4dbeaffb5ce

          Download Submit
        • C:\Users\Admin\AppData\Local\Temp\sm0.0.bat
          Filesize

          174B

          MD5

          ea48ee25a6caa5b2b606e4d08c41f536

          SHA1

          cf5e6756fac08841c136db93817d216137279641

          SHA256

          e1e92ff2df302c0d72babe33e840ab36ee346ef9a51df5b44ba0e05bc3f259cc

          SHA512

          a58db6d7390db645941453ac9302b2040fa5efb1af53ca3d12f1b4109720a5647495d83860f262d43b4a139bbc238d58ae50a84e0c009baae3f8836dc42c309f

          Download Submit
        • C:\Users\Admin\AppData\Local\Temp\tgtejjbuvj.exe
          Filesize

          9.7MB

          MD5

          58d28558b5e2ffbb0238ed852b0fccf4

          SHA1

          88ce8d1c7a152d5b1095d0ace8815c597111454e

          SHA256

          ab636afce7424bcbdc93485835088b2594011df6a55346cde38fb6d3423eb820

          SHA512

          4607a9b40e0878bc06e5bc3c925e434b31ff3d70fa3257555b3a44b51bb011cd6e6aef9eae61cc472c33b3593a54f784c999ef8df71e452ae666b85d3e57b72b

          Download Submit
        • C:\Users\Admin\AppData\Local\Temp\tgtejjbuvj.exe
          Filesize

          9.7MB

          MD5

          58d28558b5e2ffbb0238ed852b0fccf4

          SHA1

          88ce8d1c7a152d5b1095d0ace8815c597111454e

          SHA256

          ab636afce7424bcbdc93485835088b2594011df6a55346cde38fb6d3423eb820

          SHA512

          4607a9b40e0878bc06e5bc3c925e434b31ff3d70fa3257555b3a44b51bb011cd6e6aef9eae61cc472c33b3593a54f784c999ef8df71e452ae666b85d3e57b72b

          Download Submit
        • C:\Users\Admin\AppData\Local\Temp\vwiwmdednsiaq.exe
          Filesize

          4.0MB

          MD5

          bc6a35107c6d2cc2ec746897799b9164

          SHA1

          4063a434ec504cc5f808e766b21d0d32d43f5715

          SHA256

          1a4fb00dd58138f058c1dce7f1e2d8e9a3682e21e314d2b5d2618c4ebad5a939

          SHA512

          4eeb67a8ac8452ffe6cfbab3e95355d5115158a8f46e04d10442bea349f1471cef8376dd2d41e4045fa1bf03240a3999f4da0d945f8e68deea7a7d3312e70809

          Download Submit
        • C:\Users\Admin\AppData\Local\Temp\vwiwmdednsiaq.exe
          Filesize

          4.0MB

          MD5

          bc6a35107c6d2cc2ec746897799b9164

          SHA1

          4063a434ec504cc5f808e766b21d0d32d43f5715

          SHA256

          1a4fb00dd58138f058c1dce7f1e2d8e9a3682e21e314d2b5d2618c4ebad5a939

          SHA512

          4eeb67a8ac8452ffe6cfbab3e95355d5115158a8f46e04d10442bea349f1471cef8376dd2d41e4045fa1bf03240a3999f4da0d945f8e68deea7a7d3312e70809

          Download Submit
        • C:\Users\Admin\AppData\Roaming\wshom\liveupdate.exe
          Filesize

          485KB

          MD5

          6bf3b86782b7911b76029737162ae206

          SHA1

          1b8009865c79b5674734ba4ce9a6905bed78182e

          SHA256

          535f67c47f811aa5b421904959dd6931396a52cdbb9ddb69bface741356dbbef

          SHA512

          385291ef2ba36b39fd6c7c5af08ad9127d60685e28d69e55152341f522b79f2f4ca3c1aa9e13575dbce0699d976b34dbb5985d08495ca22dc20ed323b7d80ba1

          Download Submit
        • C:\Users\Admin\AppData\Roaming\wshom\liveupdate.exe
          Filesize

          485KB

          MD5

          6bf3b86782b7911b76029737162ae206

          SHA1

          1b8009865c79b5674734ba4ce9a6905bed78182e

          SHA256

          535f67c47f811aa5b421904959dd6931396a52cdbb9ddb69bface741356dbbef

          SHA512

          385291ef2ba36b39fd6c7c5af08ad9127d60685e28d69e55152341f522b79f2f4ca3c1aa9e13575dbce0699d976b34dbb5985d08495ca22dc20ed323b7d80ba1

          Download Submit
        • C:\Users\Admin\AppData\Roaming\wshom\log.dll
          Filesize

          101KB

          MD5

          2fa3b395d39fb17762d35042153e9abf

          SHA1

          a1972168b08a1fa8d6fe75dd493f30119c03514e

          SHA256

          c12c8759549c64ef3002c0d0c5ce421632e98edb4e99175a2673af2bdcbd966f

          SHA512

          47566fd4192e93e8cdce2444298a29c37aad09e72ec0393f44549e8b481be135b01a6a6c1caf71f92a54edb9cf72ab3d449a7fe51fd8bb60e9ec2d3710569549

          Download Submit
        • C:\Users\Admin\AppData\Roaming\wshom\log.dll
          Filesize

          101KB

          MD5

          2fa3b395d39fb17762d35042153e9abf

          SHA1

          a1972168b08a1fa8d6fe75dd493f30119c03514e

          SHA256

          c12c8759549c64ef3002c0d0c5ce421632e98edb4e99175a2673af2bdcbd966f

          SHA512

          47566fd4192e93e8cdce2444298a29c37aad09e72ec0393f44549e8b481be135b01a6a6c1caf71f92a54edb9cf72ab3d449a7fe51fd8bb60e9ec2d3710569549

          Download Submit
        • C:\Users\Admin\AppData\Roaming\wshom\xeroderma.wav
          Filesize

          7.3MB

          MD5

          14e77d438d09d660687208291c5af2f4

          SHA1

          8ac0a010650253e967688eb73a406b40ca9b2570

          SHA256

          5ab63c89abee93f6c1e7c93acc51c9419781cc063586ff8312bb9595555447e4

          SHA512

          f34de0932bc2072de334f801f53abc4c603887e24d8d1eef25550afc1d2ee30a0200bc6d0295a1804cb07c312bdd782e89db19f6c9f51006e11ced359e71c1cd

          Download Submit
        • C:\Users\Admin\Desktop\Pre-Activated-Setup.exe
          Filesize

          782.7MB

          MD5

          510ba4196536f9a9324ffc7e0fea1780

          SHA1

          e00e081d1d1f158c1260c46902b3fb315097343a

          SHA256

          aec98b350ff94f35932676e6d45d727544b3708829189b2312673b31828ccfb0

          SHA512

          83214f8cdca64757e6f05ef9b9826a6f497494e334072eb5382ccb30590dddc61c7780ee1d3465fd004e9c5e7c6a9bc7e6f30b4e2f5c5b3084ae40ed8bad2c0a

          Download Submit
        • C:\Users\Admin\Desktop\Pre-Activated-Setup.exe
          Filesize

          782.7MB

          MD5

          510ba4196536f9a9324ffc7e0fea1780

          SHA1

          e00e081d1d1f158c1260c46902b3fb315097343a

          SHA256

          aec98b350ff94f35932676e6d45d727544b3708829189b2312673b31828ccfb0

          SHA512

          83214f8cdca64757e6f05ef9b9826a6f497494e334072eb5382ccb30590dddc61c7780ee1d3465fd004e9c5e7c6a9bc7e6f30b4e2f5c5b3084ae40ed8bad2c0a

          Download Submit
        • memory/792-53-0x0000000077906000-0x0000000077908000-memory.dmp
          Filesize

          8KB

          Download
        • memory/792-50-0x00000000004E0000-0x0000000000EF7000-memory.dmp
          Filesize

          10.1MB

          Download
        • memory/792-55-0x00000000004E0000-0x0000000000EF7000-memory.dmp
          Filesize

          10.1MB

          Download
        • memory/792-56-0x00000000004E0000-0x0000000000EF7000-memory.dmp
          Filesize

          10.1MB

          Download
        • memory/792-57-0x00000000004E0000-0x0000000000EF7000-memory.dmp
          Filesize

          10.1MB

          Download
        • memory/792-58-0x00000000004E0000-0x0000000000EF7000-memory.dmp
          Filesize

          10.1MB

          Download
        • memory/792-64-0x00000000004E0000-0x0000000000EF7000-memory.dmp
          Filesize

          10.1MB

          Download
        • memory/792-52-0x0000000076110000-0x0000000076200000-memory.dmp
          Filesize

          960KB

          Download
        • memory/792-66-0x0000000076110000-0x0000000076200000-memory.dmp
          Filesize

          960KB

          Download
        • memory/792-51-0x0000000076110000-0x0000000076200000-memory.dmp
          Filesize

          960KB

          Download
        • memory/792-54-0x00000000004E0000-0x0000000000EF7000-memory.dmp
          Filesize

          10.1MB

          Download
        • memory/1620-135-0x0000000076110000-0x0000000076200000-memory.dmp
          Filesize

          960KB

          Download
        • memory/1620-125-0x0000000000730000-0x0000000001039000-memory.dmp
          Filesize

          9.0MB

          Download
        • memory/1620-114-0x0000000000730000-0x0000000001039000-memory.dmp
          Filesize

          9.0MB

          Download
        • memory/1620-116-0x0000000076110000-0x0000000076200000-memory.dmp
          Filesize

          960KB

          Download
        • memory/1620-117-0x0000000076110000-0x0000000076200000-memory.dmp
          Filesize

          960KB

          Download
        • memory/1620-134-0x0000000000730000-0x0000000001039000-memory.dmp
          Filesize

          9.0MB

          Download
        • memory/1620-119-0x0000000076110000-0x0000000076200000-memory.dmp
          Filesize

          960KB

          Download
        • memory/1620-131-0x0000000000730000-0x0000000001039000-memory.dmp
          Filesize

          9.0MB

          Download
        • memory/1620-130-0x0000000000730000-0x0000000001039000-memory.dmp
          Filesize

          9.0MB

          Download
        • memory/1620-124-0x0000000000730000-0x0000000001039000-memory.dmp
          Filesize

          9.0MB

          Download
        • memory/1620-129-0x0000000000730000-0x0000000001039000-memory.dmp
          Filesize

          9.0MB

          Download
        • memory/1620-128-0x0000000000730000-0x0000000001039000-memory.dmp
          Filesize

          9.0MB

          Download
        • memory/1620-126-0x0000000000730000-0x0000000001039000-memory.dmp
          Filesize

          9.0MB

          Download
        • memory/2068-278-0x0000000076110000-0x0000000076200000-memory.dmp
          Filesize

          960KB

          Download
        • memory/2068-276-0x0000000076110000-0x0000000076200000-memory.dmp
          Filesize

          960KB

          Download
        • memory/2068-273-0x0000000076110000-0x0000000076200000-memory.dmp
          Filesize

          960KB

          Download
        • memory/2068-271-0x0000000000730000-0x0000000001039000-memory.dmp
          Filesize

          9.0MB

          Download
        • memory/2068-293-0x0000000000730000-0x0000000001039000-memory.dmp
          Filesize

          9.0MB

          Download
        • memory/2424-71-0x00000000008C0000-0x00000000011C9000-memory.dmp
          Filesize

          9.0MB

          Download
        • memory/2424-70-0x00000000008C0000-0x00000000011C9000-memory.dmp
          Filesize

          9.0MB

          Download
        • memory/2488-151-0x0000000140000000-0x0000000140840000-memory.dmp
          Filesize

          8.2MB

          Download
        • memory/2488-153-0x0000000140000000-0x0000000140840000-memory.dmp
          Filesize

          8.2MB

          Download
        • memory/2488-149-0x0000000140000000-0x0000000140840000-memory.dmp
          Filesize

          8.2MB

          Download
        • memory/2488-168-0x00000000020D0000-0x00000000020F0000-memory.dmp
          Filesize

          128KB

          Download
        • memory/2488-152-0x0000000140000000-0x0000000140840000-memory.dmp
          Filesize

          8.2MB

          Download
        • memory/3044-213-0x0000000076110000-0x0000000076200000-memory.dmp
          Filesize

          960KB

          Download
        • memory/3044-197-0x0000000076110000-0x0000000076200000-memory.dmp
          Filesize

          960KB

          Download
        • memory/3044-195-0x0000000076110000-0x0000000076200000-memory.dmp
          Filesize

          960KB

          Download
        • memory/3044-191-0x0000000000730000-0x0000000001039000-memory.dmp
          Filesize

          9.0MB

          Download
        • memory/3044-211-0x0000000000730000-0x0000000001039000-memory.dmp
          Filesize

          9.0MB

          Download
        • memory/3116-215-0x0000000076110000-0x0000000076200000-memory.dmp
          Filesize

          960KB

          Download
        • memory/3116-214-0x0000000000F90000-0x00000000019A7000-memory.dmp
          Filesize

          10.1MB

          Download
        • memory/3116-196-0x0000000076110000-0x0000000076200000-memory.dmp
          Filesize

          960KB

          Download
        • memory/3116-194-0x0000000076110000-0x0000000076200000-memory.dmp
          Filesize

          960KB

          Download
        • memory/3496-42-0x0000000000A60000-0x0000000000AE0000-memory.dmp
          Filesize

          512KB

          Download
        • memory/3496-45-0x0000000074D90000-0x0000000074F0D000-memory.dmp
          Filesize

          1.5MB

          Download
        • memory/3496-43-0x0000000074D90000-0x0000000074F0D000-memory.dmp
          Filesize

          1.5MB

          Download
        • memory/3496-98-0x0000000074D90000-0x0000000074F0D000-memory.dmp
          Filesize

          1.5MB

          Download
        • memory/3496-44-0x00007FFFA8E60000-0x00007FFFA9069000-memory.dmp
          Filesize

          2.0MB

          Download
        • memory/3564-92-0x0000000000F90000-0x00000000019A7000-memory.dmp
          Filesize

          10.1MB

          Download
        • memory/3564-83-0x0000000000F90000-0x00000000019A7000-memory.dmp
          Filesize

          10.1MB

          Download
        • memory/3564-94-0x0000000000F90000-0x00000000019A7000-memory.dmp
          Filesize

          10.1MB

          Download
        • memory/3564-88-0x0000000076110000-0x0000000076200000-memory.dmp
          Filesize

          960KB

          Download
        • memory/3564-111-0x0000000076110000-0x0000000076200000-memory.dmp
          Filesize

          960KB

          Download
        • memory/3564-110-0x0000000076110000-0x0000000076200000-memory.dmp
          Filesize

          960KB

          Download
        • memory/3564-108-0x0000000076110000-0x0000000076200000-memory.dmp
          Filesize

          960KB

          Download
        • memory/3564-79-0x0000000076110000-0x0000000076200000-memory.dmp
          Filesize

          960KB

          Download
        • memory/3564-82-0x0000000000F90000-0x00000000019A7000-memory.dmp
          Filesize

          10.1MB

          Download
        • memory/3564-91-0x0000000076110000-0x0000000076200000-memory.dmp
          Filesize

          960KB

          Download
        • memory/3564-89-0x0000000000F90000-0x00000000019A7000-memory.dmp
          Filesize

          10.1MB

          Download
        • memory/3564-85-0x0000000000F90000-0x00000000019A7000-memory.dmp
          Filesize

          10.1MB

          Download
        • memory/3564-96-0x0000000000F90000-0x00000000019A7000-memory.dmp
          Filesize

          10.1MB

          Download
        • memory/3684-139-0x0000000074D90000-0x0000000074F0D000-memory.dmp
          Filesize

          1.5MB

          Download
        • memory/3684-100-0x0000000074D90000-0x0000000074F0D000-memory.dmp
          Filesize

          1.5MB

          Download
        • memory/3684-102-0x00007FFFA8E60000-0x00007FFFA9069000-memory.dmp
          Filesize

          2.0MB

          Download
        • memory/3684-142-0x0000000074D90000-0x0000000074F0D000-memory.dmp
          Filesize

          1.5MB

          Download
        • memory/3684-140-0x0000000074D90000-0x0000000074F0D000-memory.dmp
          Filesize

          1.5MB

          Download
        • memory/3780-90-0x0000000000730000-0x0000000001039000-memory.dmp
          Filesize

          9.0MB

          Download
        • memory/3780-106-0x0000000076110000-0x0000000076200000-memory.dmp
          Filesize

          960KB

          Download
        • memory/3780-77-0x0000000076110000-0x0000000076200000-memory.dmp
          Filesize

          960KB

          Download
        • memory/3780-84-0x0000000000730000-0x0000000001039000-memory.dmp
          Filesize

          9.0MB

          Download
        • memory/3780-109-0x0000000076110000-0x0000000076200000-memory.dmp
          Filesize

          960KB

          Download
        • memory/3780-72-0x0000000000730000-0x0000000001039000-memory.dmp
          Filesize

          9.0MB

          Download
        • memory/3780-81-0x0000000000730000-0x0000000001039000-memory.dmp
          Filesize

          9.0MB

          Download
        • memory/3780-80-0x0000000000730000-0x0000000001039000-memory.dmp
          Filesize

          9.0MB

          Download
        • memory/3780-95-0x0000000000730000-0x0000000001039000-memory.dmp
          Filesize

          9.0MB

          Download
        • memory/3780-87-0x0000000000730000-0x0000000001039000-memory.dmp
          Filesize

          9.0MB

          Download
        • memory/3780-86-0x0000000076110000-0x0000000076200000-memory.dmp
          Filesize

          960KB

          Download
        • memory/3780-76-0x0000000076110000-0x0000000076200000-memory.dmp
          Filesize

          960KB

          Download
        • memory/3780-78-0x0000000000730000-0x0000000001039000-memory.dmp
          Filesize

          9.0MB

          Download
        • memory/3780-93-0x0000000000730000-0x0000000001039000-memory.dmp
          Filesize

          9.0MB

          Download
        • memory/3780-107-0x0000000076110000-0x0000000076200000-memory.dmp
          Filesize

          960KB

          Download
        • memory/3984-275-0x0000000076110000-0x0000000076200000-memory.dmp
          Filesize

          960KB

          Download
        • memory/3984-277-0x0000000076110000-0x0000000076200000-memory.dmp
          Filesize

          960KB

          Download
        • memory/3984-279-0x0000000076110000-0x0000000076200000-memory.dmp
          Filesize

          960KB

          Download
        • memory/4264-127-0x0000000000F90000-0x00000000019A7000-memory.dmp
          Filesize

          10.1MB

          Download
        • memory/4264-132-0x0000000000F90000-0x00000000019A7000-memory.dmp
          Filesize

          10.1MB

          Download
        • memory/4264-120-0x0000000076110000-0x0000000076200000-memory.dmp
          Filesize

          960KB

          Download
        • memory/4264-113-0x0000000000F90000-0x00000000019A7000-memory.dmp
          Filesize

          10.1MB

          Download
        • memory/4264-121-0x0000000076110000-0x0000000076200000-memory.dmp
          Filesize

          960KB

          Download
        • memory/4264-122-0x0000000000F90000-0x00000000019A7000-memory.dmp
          Filesize

          10.1MB

          Download
        • memory/4264-123-0x0000000000F90000-0x00000000019A7000-memory.dmp
          Filesize

          10.1MB

          Download
        • memory/4264-118-0x0000000076110000-0x0000000076200000-memory.dmp
          Filesize

          960KB

          Download
        • memory/4264-136-0x0000000000F90000-0x00000000019A7000-memory.dmp
          Filesize

          10.1MB

          Download
        • memory/4264-137-0x0000000076110000-0x0000000076200000-memory.dmp
          Filesize

          960KB

          Download
        • memory/4264-133-0x0000000000F90000-0x00000000019A7000-memory.dmp
          Filesize

          10.1MB

          Download
        • memory/4532-19-0x00000000000C0000-0x00000000004FB000-memory.dmp
          Filesize

          4.2MB

          Download
        • memory/4576-251-0x0000000000F90000-0x00000000019A7000-memory.dmp
          Filesize

          10.1MB

          Download
        • memory/4576-233-0x0000000076110000-0x0000000076200000-memory.dmp
          Filesize

          960KB

          Download
        • memory/4576-234-0x0000000076110000-0x0000000076200000-memory.dmp
          Filesize

          960KB

          Download
        • memory/4576-252-0x0000000076110000-0x0000000076200000-memory.dmp
          Filesize

          960KB

          Download
        • memory/4784-249-0x0000000076110000-0x0000000076200000-memory.dmp
          Filesize

          960KB

          Download
        • memory/4784-248-0x0000000000730000-0x0000000001039000-memory.dmp
          Filesize

          9.0MB

          Download
        • memory/4784-232-0x0000000076110000-0x0000000076200000-memory.dmp
          Filesize

          960KB

          Download
        • memory/4784-231-0x0000000076110000-0x0000000076200000-memory.dmp
          Filesize

          960KB

          Download
        • memory/4784-229-0x0000000076110000-0x0000000076200000-memory.dmp
          Filesize

          960KB

          Download
        • memory/4960-39-0x0000000074D90000-0x0000000074F0D000-memory.dmp
          Filesize

          1.5MB

          Download
        • memory/4960-30-0x0000000074D90000-0x0000000074F0D000-memory.dmp
          Filesize

          1.5MB

          Download
        • memory/4960-28-0x00007FFFA8E60000-0x00007FFFA9069000-memory.dmp
          Filesize

          2.0MB

          Download
        • memory/4960-27-0x0000000074D90000-0x0000000074F0D000-memory.dmp
          Filesize

          1.5MB

          Download
        • memory/4960-97-0x0000000074D90000-0x0000000074F0D000-memory.dmp
          Filesize

          1.5MB

          Download
        • memory/4960-26-0x0000000000190000-0x0000000000A1E000-memory.dmp
          Filesize

          8.6MB

          Download
        • memory/5100-145-0x00007FF7D6CC0000-0x00007FF7D73A2000-memory.dmp
          Filesize

          6.9MB

          Download
        • memory/5100-150-0x00007FF7AF130000-0x00007FF7AF2B2000-memory.dmp
          Filesize

          1.5MB

          Download