Resubmissions

22-02-2024 01:08

240222-bhbzhsab77 10

Analysis

  • max time kernel
    135s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-02-2024 01:08

General

  • Target

    1334bbd7e0d0d3bb073194939f7dada8.exe

  • Size

    135KB

  • MD5

    1334bbd7e0d0d3bb073194939f7dada8

  • SHA1

    1b94edaf8a275a4c2e2ec6550a4567fd2048dcf4

  • SHA256

    c89ac5cb4dbb4116ed1d3b9630aac5a927066938e5b4a24649cf09116882a146

  • SHA512

    e960d3ea5bda9f39afb449fed300e9863dbbc7ee1c216cd8fa4b681316f78515316bb1fb1f7b4743d689b6a5896f2d4b6bb4a52052d2a298af210888cacf8336

  • SSDEEP

    1536:KjHKFCXmbMDnue3MtblERG2rnWQ19hfEgDld5kvG8tZC3PHpJLs/QEGAI7yn+ovO:kHKCXmW3VV1VDldmvGu6Q/wAI7y7+Vg

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://selebration17io.io/index.php

http://vacantion18ffeu.cc/index.php

http://valarioulinity1.net/index.php

http://buriatiarutuhuob.net/index.php

http://cassiosssionunu.me/index.php

http://sulugilioiu19.net/index.php

http://goodfooggooftool.net/index.php

rc4.i32
rc4.i32

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

stealc

C2

http://185.172.128.145

Attributes
  • url_path

    /3cd2b41cbde8fc9c.php

Extracted

Family

lumma

C2

https://resergvearyinitiani.shop/api

https://technologyenterdo.shop/api

https://detectordiscusser.shop/api

https://turkeyunlikelyofw.shop/api

https://associationokeo.shop/api

Signatures

  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

  • Glupteba payload 3 IoCs
  • Lumma Stealer

    An infostealer written in C++ first seen in August 2022.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Stealc

    Stealc is an infostealer written in C++.

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Executes dropped EXE 21 IoCs
  • Loads dropped DLL 8 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 30 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\1334bbd7e0d0d3bb073194939f7dada8.exe
    "C:\Users\Admin\AppData\Local\Temp\1334bbd7e0d0d3bb073194939f7dada8.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:4060
  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\9BE2.dll
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3744
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\9BE2.dll
      2⤵
      • Loads dropped DLL
      PID:4948
  • C:\Users\Admin\AppData\Local\Temp\A2F8.exe
    C:\Users\Admin\AppData\Local\Temp\A2F8.exe
    1⤵
    • Executes dropped EXE
    • Writes to the Master Boot Record (MBR)
    PID:3208
  • C:\Users\Admin\AppData\Local\Temp\6212.exe
    C:\Users\Admin\AppData\Local\Temp\6212.exe
    1⤵
    • Executes dropped EXE
    PID:2428
  • C:\Users\Admin\AppData\Local\Temp\ABA0.exe
    C:\Users\Admin\AppData\Local\Temp\ABA0.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:2288
    • C:\Users\Admin\AppData\Local\Temp\is-N1PU6.tmp\ABA0.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-N1PU6.tmp\ABA0.tmp" /SL5="$1501BA,3536428,54272,C:\Users\Admin\AppData\Local\Temp\ABA0.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2508
      • C:\Users\Admin\AppData\Local\DVD32 Plug-in\dvd32plugin.exe
        "C:\Users\Admin\AppData\Local\DVD32 Plug-in\dvd32plugin.exe" -i
        3⤵
        • Executes dropped EXE
        PID:2452
      • C:\Users\Admin\AppData\Local\DVD32 Plug-in\dvd32plugin.exe
        "C:\Users\Admin\AppData\Local\DVD32 Plug-in\dvd32plugin.exe" -s
        3⤵
        • Executes dropped EXE
        PID:4748
  • C:\Users\Admin\AppData\Local\Temp\B5B3.exe
    C:\Users\Admin\AppData\Local\Temp\B5B3.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:644
    • C:\Users\Admin\AppData\Local\Temp\B5B3.exe
      C:\Users\Admin\AppData\Local\Temp\B5B3.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:4496
  • C:\Users\Admin\AppData\Local\Temp\B9CB.exe
    C:\Users\Admin\AppData\Local\Temp\B9CB.exe
    1⤵
    • Executes dropped EXE
    PID:4348
  • C:\Users\Admin\AppData\Roaming\ujuhrhj
    C:\Users\Admin\AppData\Roaming\ujuhrhj
    1⤵
    • Executes dropped EXE
    • Checks SCSI registry key(s)
    • Suspicious behavior: MapViewOfSection
    PID:1092
  • C:\Users\Admin\AppData\Local\Temp\D65C.exe
    C:\Users\Admin\AppData\Local\Temp\D65C.exe
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:5096
    • C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
      "C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"
      2⤵
      • Executes dropped EXE
      PID:4728
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell -nologo -noprofile
        3⤵
          PID:4400
      • C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe
        "C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:2956
        • C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
          C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:856
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "
            4⤵
              PID:756
              • C:\Windows\SysWOW64\chcp.com
                chcp 1251
                5⤵
                  PID:1992
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F
                  5⤵
                  • Creates scheduled task(s)
                  PID:2156
            • C:\Users\Admin\AppData\Local\Temp\nsoE7DC.tmp
              C:\Users\Admin\AppData\Local\Temp\nsoE7DC.tmp
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Checks processor information in registry
              PID:4584
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 2344
                4⤵
                • Program crash
                PID:344
          • C:\Users\Admin\AppData\Local\Temp\FourthX.exe
            "C:\Users\Admin\AppData\Local\Temp\FourthX.exe"
            2⤵
            • Executes dropped EXE
            PID:1228
            • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
              C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
              3⤵
                PID:1112
          • C:\Users\Admin\AppData\Local\Temp\E532.exe
            C:\Users\Admin\AppData\Local\Temp\E532.exe
            1⤵
            • Executes dropped EXE
            PID:3852
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3852 -s 340
              2⤵
              • Program crash
              PID:3660
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3852 -ip 3852
            1⤵
              PID:1960
            • C:\Users\Admin\AppData\Local\Temp\F1C6.exe
              C:\Users\Admin\AppData\Local\Temp\F1C6.exe
              1⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:1544
              • C:\Users\Admin\AppData\Local\Temp\is-F0MNE.tmp\F1C6.tmp
                "C:\Users\Admin\AppData\Local\Temp\is-F0MNE.tmp\F1C6.tmp" /SL5="$20272,3525380,54272,C:\Users\Admin\AppData\Local\Temp\F1C6.exe"
                2⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of FindShellTrayWindow
                PID:5112
                • C:\Users\Admin\AppData\Local\Audio DVD Copier\audiodvdcopier.exe
                  "C:\Users\Admin\AppData\Local\Audio DVD Copier\audiodvdcopier.exe" -i
                  3⤵
                  • Executes dropped EXE
                  PID:4840
                • C:\Users\Admin\AppData\Local\Audio DVD Copier\audiodvdcopier.exe
                  "C:\Users\Admin\AppData\Local\Audio DVD Copier\audiodvdcopier.exe" -s
                  3⤵
                  • Executes dropped EXE
                  PID:876
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4584 -ip 4584
              1⤵
                PID:748

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\ProgramData\Are.docx

                Filesize

                11KB

                MD5

                a33e5b189842c5867f46566bdbf7a095

                SHA1

                e1c06359f6a76da90d19e8fd95e79c832edb3196

                SHA256

                5abf8e3d1f78de7b09d7f6fb87f9e80e60caacf13ef3c1289665653dacd7c454

                SHA512

                f2ad3812ec9b915e9618539b0f103f2e9acaad25fbbacd84941c954ce070af231324e83a4621e951c1dbae8d40d50410954e40dd52bbd46e34c54b0d1957407b

              • C:\ProgramData\PowerGo 65.0 Build 2191 Essential\PowerGo 65.0 Build 2191 Essential.exe

                Filesize

                1.6MB

                MD5

                66c4b721e3fa64c794bf30fa0f5a1d6c

                SHA1

                ab43b69e6c6de3a6c6e6e4a5a1c2840e8a56c386

                SHA256

                3b3295e190fa7ae32d588ace0df7fb73acdc973668e60edc1e772e918d8d5a85

                SHA512

                f6c7f8a3af0147d2967af36aabe82b49494caba3d7373ff752d92bac1436979dd55d4972cc32d0fc892a3d3f5eeb6bbd95ec323b6772dd8935a58ac64648aeb5

              • C:\ProgramData\PowerGo 65.0 Build 2191 Essential\PowerGo 65.0 Build 2191 Essential.exe

                Filesize

                2.7MB

                MD5

                acbebea2f8ec2e035cacc9be62b117d1

                SHA1

                1059bb3df016cd29494ed07142a00a5f74cfe4a9

                SHA256

                46ac8bca95af3bd5a28d5b284ea3605264a9a9310e1971bbe03924250edb8fda

                SHA512

                4b648f4c5142b002346cd986d9bd2c45abf334927632d80d1ec78d8097a9e10ee4d66d962266202ee78374d2af0e2c0bd748f6431a01976b7e9658a50c609e7e

              • C:\ProgramData\PowerGo 65.0 Build 2191 Essential\PowerGo 65.0 Build 2191 Essential.exe

                Filesize

                1.9MB

                MD5

                d2648ac280f420087da2429cab0ffdac

                SHA1

                8329d0f2d80c42461999810b210e23d83092eed1

                SHA256

                6b864b9be1108e2dadccf4cac06cecac41153dd1f44ce9b86e3b639bca3e0ec0

                SHA512

                5ad98a76fec62cb880cb1fa46595bbc72913bf0ca4ffc2d7688df5ad8a3c630da74ab27d0735f29a538110a4d35cf5a3c04a65902e02062cf0d6bd704271a3c1

              • C:\ProgramData\mozglue.dll

                Filesize

                593KB

                MD5

                c8fd9be83bc728cc04beffafc2907fe9

                SHA1

                95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                SHA256

                ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                SHA512

                fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

              • C:\ProgramData\nss3.dll

                Filesize

                2.0MB

                MD5

                1cc453cdf74f31e4d913ff9c10acdde2

                SHA1

                6e85eae544d6e965f15fa5c39700fa7202f3aafe

                SHA256

                ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                SHA512

                dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

              • C:\Users\Admin\AppData\Local\Audio DVD Copier\audiodvdcopier.exe

                Filesize

                2.2MB

                MD5

                e92fdb5a16306a4b94a65f6542f4d961

                SHA1

                bae49d925a5c744154b5cb585a8e316eb1000768

                SHA256

                4713f895f243d395b0a394b7fb760260a18c7d3f747a941e0dbd838bf3db1422

                SHA512

                c78086eccac3a48be072f5cb78e078dabb61c65ed3e414f01baa5661f4c32aa74cbc6fd5e7131e6378340834a6303f70315e9fcfd80b4e6a0e485e64df60904b

              • C:\Users\Admin\AppData\Local\Audio DVD Copier\audiodvdcopier.exe

                Filesize

                2.4MB

                MD5

                3b4ac2af9f29d7390397575562521b3a

                SHA1

                1cff02641012eea21570acfd72ee800f6322fa8f

                SHA256

                812d5e5f308c13ffbf23aec1f1cdc92903239c37e468c42c5c2af2403dfbd0d7

                SHA512

                658d3243e63fb81922abf51e692beb5e45707c2c88944a1d62f01c018764d503bdf8eec2c258ed50075dd413177d4ab34ef7bb0f29f595800e82d59f1dfc07f3

              • C:\Users\Admin\AppData\Local\Audio DVD Copier\audiodvdcopier.exe

                Filesize

                2.7MB

                MD5

                17911c257f3d88a1ea6e0a5004d07f0b

                SHA1

                63170a972172f254e496fae7a118f00697f2e6ec

                SHA256

                d5a64a08427ba61793fbb45e89e114b25071a688b397c23dc38ef94194c95d2d

                SHA512

                d2c3496265af1e173f9625523b86bb9ee209d63c8a4ec0671d4bf2bb6c82b051fb4e514fe13c2d30af8f9d606aabde8ca4ab170f9d5c330fae825b5a8c16b508

              • C:\Users\Admin\AppData\Local\Audio DVD Copier\is-RFM5H.tmp

                Filesize

                122KB

                MD5

                6231b452e676ade27ca0ceb3a3cf874a

                SHA1

                f8236dbf9fa3b2835bbb5a8d08dab3a155f310d1

                SHA256

                9941eee1cafffad854ab2dfd49bf6e57b181efeb4e2d731ba7a28f5ab27e91cf

                SHA512

                f5882a3cded0a4e498519de5679ea12a0ea275c220e318af1762855a94bdac8dc5413d1c5d1a55a7cc31cfebcf4647dcf1f653195536ce1826a3002cf01aa12c

              • C:\Users\Admin\AppData\Local\DVD32 Plug-in\dvd32plugin.exe

                Filesize

                2.0MB

                MD5

                9a3bbfe3dd361d83282773ccb2f3d087

                SHA1

                336e9c10f3ac4e8a7b98fe47bda1f5d93ff9336a

                SHA256

                74448ea6fd95e234d0a7d7086d42798063c87efa713063f66d6c6060c87aee98

                SHA512

                a234ee0e3324d60c43b9a08c86010caa7a2693766e633fb9d25c68021bcbd02b160676d012fcda131b62a6aef91f155fd8af4c83884113e5ac032e84717ac260

              • C:\Users\Admin\AppData\Local\DVD32 Plug-in\dvd32plugin.exe

                Filesize

                1.6MB

                MD5

                c54fdfa55980472a6e8b95cda49b57e8

                SHA1

                a50b1ae8133724b424e973f36040855f01385bf2

                SHA256

                dd3c0547f45d059d47fa060d4a01f06a7148c3c8255fbb8a37f70b9ec12b03eb

                SHA512

                01ff73810fce69273fc601ea5d21abab0e7e0ec649e38f41df0cc1682bf52a7ebaa9d46748813ba8561f66e2576ee73e0dd621be06331e0bd2e290a7b60abc1a

              • C:\Users\Admin\AppData\Local\DVD32 Plug-in\dvd32plugin.exe

                Filesize

                1.3MB

                MD5

                4bf1795d7938fa40b340c4f5e157d42b

                SHA1

                a4d97bdd507bd9c9207062ab42e58c7e65c9a6af

                SHA256

                b250f51b1752616626329356a43a264cf8e9ff89232743a58bbe6576b81b2d12

                SHA512

                fb2a8edc311e77e961b995694afb713574d342c19a4efb0e460bb1394a970e9c9b0bf911ecf2c021107c5ee3557e88604c578c30354ad1b23af27bb3cfd0b7c6

              • C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

                Filesize

                2.8MB

                MD5

                a5cc28d59b8709a33ce44c89443c0f34

                SHA1

                845fc50743f64a353a191a89acd23420f4069fbf

                SHA256

                78b0d313c2261b476ecf373f31c487984ea136b86a3e0ad036f2db04cb9850ae

                SHA512

                c722a996e8d28d37c9d812cde8810dd1bde005d25e8a52b7037da1e879ab9d193c59de1e2b11a63db1b864408042f266d08a51bdf43cf23021b88b4a081db999

              • C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

                Filesize

                1.3MB

                MD5

                69d8541afe9eb5d47b8a4ec080212d19

                SHA1

                2bd9cda3c37de1569edc024935374ef90a8d186b

                SHA256

                5731567f5316e5c8535d8b9aa0ec8c2c839b89dbba2dd9aacbc76e46b26080b7

                SHA512

                56aa8cc13b79695bf1c0e1ce51302d569411d22072dbfca1943e97a3d5fe5e6f7c66ce341f8f065de73a85c9d29c820570202aa6977d89e3e5a979ccceec0c95

              • C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe

                Filesize

                1.2MB

                MD5

                6bdb234305778c39ec1121b20dbb5b46

                SHA1

                9397990981227c7b06a4ad4d1a2b030d38fcd6e1

                SHA256

                0e50b406c6cd99dda7328f15c6dad4c1bf4c5b0a12a2476ee69e58e7d544233b

                SHA512

                6a58cafa3ed7cbbd091da4f240ff88e517d40167d1f901352cdde871931636bcc934f69937b830851969dc15dc1b04c6ce9d7cd689f5a9f864c60a5ad198777a

              • C:\Users\Admin\AppData\Local\Temp\6212.exe

                Filesize

                5.6MB

                MD5

                479342d62078aaf31881972c7574f6f2

                SHA1

                382fa9a95746ca6199e7dfb9ae2bd035f4000fb4

                SHA256

                a6b59e0a275b5314935a3f812a5ba7dd5d5cc9524d3a6efdeb3a103eea386f6d

                SHA512

                0e74e3e0b993968220e712ffd94a76c00d35f0452494d62b3f6780c80cc0cae2e9982978830c54bed3a57d17a5a84abbdc4c0cbb5961afcae785048ac4ac47da

              • C:\Users\Admin\AppData\Local\Temp\6212.exe

                Filesize

                1.5MB

                MD5

                6806dc55002084959537c1db11646c72

                SHA1

                baeb48ed42529a3f64c12ad62d4df1bd2e28d7a7

                SHA256

                53ad359d95bbd203383d7b0bda7107dce106ede2eb827740cf1d3c6c9ce66c87

                SHA512

                cca877b088dbadc4fda8932cdbc7d8ee4e456c9e38273a6db4c7a547b3a8bdaac0946180795da807ebf11fccc82e0d47fb88b3616f18018e9673eb7f3b04bbf0

              • C:\Users\Admin\AppData\Local\Temp\9BE2.dll

                Filesize

                1.6MB

                MD5

                ec6878849a30cad1ddb5ab3ff4921124

                SHA1

                0c1208b6d2e153352b8c4ccc345ff30281ab2af9

                SHA256

                3bc2c7cc924b87108429a7d64fdfe54f6804d158c853e5375e61cb4c871e2639

                SHA512

                773e7e196bec58000b626b0ea12adf300381ca324e0c70dc7e262da8d0a12b6c41fd673d78010886233888435a7d426fe1b9fe1f60546ac821992c067c120edb

              • C:\Users\Admin\AppData\Local\Temp\9BE2.dll

                Filesize

                603KB

                MD5

                1ac35cadceded37e0c0384c0e5d794af

                SHA1

                4215607a5d39e925f153a2b0981c417c8ba7a413

                SHA256

                522b7b03a58ca2a36186888226a7dd9e7b52a7bfaed490865d9257fdca8bf738

                SHA512

                c54bb774f812810caf58331e3467976e79b5530ea53064ee20ff35ce2900de8b2eb007d4f750e9ad05a3b1391562fd97e8c430e8f05591bd1059e7aa66427691

              • C:\Users\Admin\AppData\Local\Temp\A2F8.exe

                Filesize

                421KB

                MD5

                1996a23c7c764a77ccacf5808fec23b0

                SHA1

                5a7141b167056bf8f01c067ebe12ed4ccc608dc7

                SHA256

                e40c8e14e8cb8a0667026a35e6e281c7a8a02bdf7bc39b53cfe0605e29372888

                SHA512

                430c8b43c2cbb937d2528fa79c754be1a1b80c95c45c49dba323e3fe6097a7505fc437ddafab54b21d00fba9300b5fa36555535a6fa2eb656b5aa45ccf942e23

              • C:\Users\Admin\AppData\Local\Temp\ABA0.exe

                Filesize

                1.7MB

                MD5

                5bf677843dc42bb266139b7ee252803f

                SHA1

                16d811fe8484b57c6e603beda94fb6095d821035

                SHA256

                1e0bba2e76e3206ca6bc76a6f45e81cd951ea26770005ea17b44c37fb81ef0ea

                SHA512

                2ec9795a8b33a24a1eaed8d9c22c21309581bfeee5436884e3d8264d75209ed8f7767f786b4b9290c3e3fa67325d900d3359e3ffe0b262ec41b1c791361c7968

              • C:\Users\Admin\AppData\Local\Temp\ABA0.exe

                Filesize

                2.2MB

                MD5

                a725bdafbeed72ef8c2985feb59b5c1d

                SHA1

                f15c838044ac71d181f247d8caad3de08c346670

                SHA256

                ae7fdc392bca4f09b1e8814c2c5321b1f558a752cd35ef348a29ddb199ea1209

                SHA512

                f2d429256b8fb2f501f14d10a01c3a5e76c45265fac4bf48ad975bac1f4ab560500835c33f0a6ba64d11f826b33efaecf498e126f4abbf9bb8837510b39ae047

              • C:\Users\Admin\AppData\Local\Temp\B5B3.exe

                Filesize

                435KB

                MD5

                b76b7fee4432c0d0f558c60e0e7bd7a7

                SHA1

                d9fa29e6b301b7753a3606fc2da38e6e3c4e0b43

                SHA256

                3f949dc07285fa4cb5e3faf70fd8f0e2e09538f4a21eaeaa2c79eb2538b2ef39

                SHA512

                3df2fc9e7518623a03021c5629f9a0097812587a70ccdf17092b36b9a5dd5333ee880fbde0c5dd14ad7fc6f16ac7c529b6e6c7fd2678b1b51cd274ea8ce832d6

              • C:\Users\Admin\AppData\Local\Temp\B5B3.exe

                Filesize

                206KB

                MD5

                79d0881a365f3d679c2f096a73f15965

                SHA1

                def3bd4b37365c9ab5acc923ac114125aba87238

                SHA256

                e538dc338b2dd6eaaba95b96094c1a95374af765a8234207c362ccf0bdb131b2

                SHA512

                05c0b92966a10d97ce51280665aa0eb96bc824dccc5902da2808f9bd89348f5838c575f156cd1705c7bfb9ea5464070295405b3150505f13a9fcb00ebfb2a350

              • C:\Users\Admin\AppData\Local\Temp\B5B3.exe

                Filesize

                1.3MB

                MD5

                1a0b1e3296221b9d0663b3f0b421a881

                SHA1

                adb6c975ee026624b62347366c3db66533042af5

                SHA256

                43bb90f9921fe858ba220a0c08739389c25f8a44d06720a497eae2cdb6e91e5e

                SHA512

                8495a8a653b4e8ea0b737b30bbf318f51849388048904f6af47076fb0a534efd9a658090a5579cebe56c812785153db7460bd2bfefca47073fcbc03dc0d0008f

              • C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe

                Filesize

                128KB

                MD5

                1844d76e7d4331107eeb8fc6274fa9b2

                SHA1

                82ae81925c68a662af3b5243db9ae9d0b1721958

                SHA256

                0fddf79ba668abf7a760e7076da3fdcca389e221c5005b10737a75b271da3aa1

                SHA512

                2be6c7a7f25b12ee3082f122fd17ded3697dd97518e41765d49f5141e969b6e4d24f664a6aae29e647c2e8d7518d3a6b1216c8a460a7425ab4c60e5bd60dc947

              • C:\Users\Admin\AppData\Local\Temp\D65C.exe

                Filesize

                3.8MB

                MD5

                39ebc5f3395064152b1f1cd4766c6f35

                SHA1

                fad87e45cdcb01fc8e4bcb0d96ad983d22c23f0d

                SHA256

                bce03dcdbab5d6fda63e92ebaf3cda1247cc6a0391b00a9a241caeccf24239f8

                SHA512

                7ada1a62606ed33b35dd07eed22ba411a5a594dbbe5aa91db2d96e6fedc5075f28e2085f0146769f613d20ce4efc1f100eebf172e91ff9f80c39e011bb5aef18

              • C:\Users\Admin\AppData\Local\Temp\D65C.exe

                Filesize

                4.1MB

                MD5

                cb5dd212a324d2a07b75d3dfe998d198

                SHA1

                009e6fd4cb3d18cdfbab00a02da70c5d478ea56a

                SHA256

                d046eaade93a0c1453480ffe8aeb411b9801d636cf26c55d1c19ecfcc9dc4e83

                SHA512

                768809bd6133f320789045b26e90a835a1130b20319535d3c8a9faf7bd952799a17cf76eb4c6f202544c18cfec3147b1edb35f4b5adf04fd6940e1355bdb5644

              • C:\Users\Admin\AppData\Local\Temp\E532.exe

                Filesize

                214KB

                MD5

                3dd02e3a7d6552f6312e29bc4189c06a

                SHA1

                c52bb026df26445a1e4ccf66baf61d99ecd1ff8a

                SHA256

                cb34f0fe3c44490fcf75fae3bfbda353d52b8463ad4f12a67c503e9c3d855a70

                SHA512

                4a64121a31e09d6114209fbf91f2ff1d130d8faa7c7d2a739e461c0cf6230072afabd51da34f38d476df1ecec89f111c1d63136a22bba187cc20b66dc7aa4485

              • C:\Users\Admin\AppData\Local\Temp\F1C6.exe

                Filesize

                2.5MB

                MD5

                9ed5add10faf2961bfd48152e46da5c5

                SHA1

                aa12af2b61a229eab05ea38c91fb7e7179cee846

                SHA256

                fa4f46e35b2931f6688630d3035aeee45ace3d28a658b86ace382736292c6f2f

                SHA512

                c989a521352d2b56114320b6f718f1fac0d3dc7f761fe490dad88bdc3626955451dda12827feb870f237cca7b15e7959fab93129fc3708ec0031a624169706f1

              • C:\Users\Admin\AppData\Local\Temp\F1C6.exe

                Filesize

                1.4MB

                MD5

                e387095d614440e0e33f5d4c8c6bcfd4

                SHA1

                ed78b68ec8b0cc0b639433c3b5569c6a5beed2d5

                SHA256

                f44769c70046af420efceb84209d0e4185b82edd85054dcb2dcc361915cf4cbe

                SHA512

                1a7368e105b08e8d9ef98985d2f398a00e59c34496ec9da8a3a2c56f825c6938826b086be90ccb86c5756ffc1077256b87bd28f44c86d52199d903fe613f92cc

              • C:\Users\Admin\AppData\Local\Temp\FourthX.exe

                Filesize

                384KB

                MD5

                147b6aa5bd0222e5d58af8984b073c56

                SHA1

                399923e38ba252bffbe5c13b39bcbf41798e15f5

                SHA256

                6a2447d974f6eeaaa5ad420a24faa13417df7ebd5c76d0b872a11183d29c5bd9

                SHA512

                c0002076c0eed73addcaee17d389293eee9b462d02187944ad7c5a5235b78265257efc958473d91bd5e63f3b0a8ed7ed166a550f311c348170914620da519d70

              • C:\Users\Admin\AppData\Local\Temp\FourthX.exe

                Filesize

                704KB

                MD5

                029a5147d2f0d080800b095d06298a55

                SHA1

                6d53b0c00f128318d23de9db082989e30369baad

                SHA256

                cd1818fa6f2a4cbdd75985ba9e36c6141d206f5728b994875c3af7c874938566

                SHA512

                b035c22bd7b41375cff69882f696d37f8167c12a770da3f6d919d1350789bd1f1d4cfc623fe325c696b3f30e96632bbd1233cdff878df05e8c5b7a153f3c9e1c

              • C:\Users\Admin\AppData\Local\Temp\FourthX.exe

                Filesize

                128KB

                MD5

                107d51b63924f31b65dd7cf8f223fc8e

                SHA1

                30a1f85554f49cda1e887a5619333a0e1cae3b74

                SHA256

                b97e3e6fd9164d017db870ff64f66bc3ca6a9a8388d50043ef1e2e1c8a7e5f1e

                SHA512

                95d6eca043e4653bbd9ce9a8cd25a7fa66b33bb545b614529e220d4bb94943d17837b5786eff58e49620adae249e7711eef2e51910dcbafe1bc492a1316ac05f

              • C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe

                Filesize

                768KB

                MD5

                f0ff5f372a958f41fa51da9c9f03c8b2

                SHA1

                06d46a56e5bc97c19dd5fb7195e973121b641c55

                SHA256

                d2ed2c2940a1994e68fb473cf5e7c0ab0487d38ea141f35c0f6c07230e7e868b

                SHA512

                8ebc3a3acd0f9139707f0681f85457ffdaba8f6532bb7d28a196be05a0bf04692ffff4c0cf0a712897068c395e3f5aa64c799fd9cffc810b0139cb7d778e8424

              • C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe

                Filesize

                832KB

                MD5

                f75b9beec810c7d22ac06871935465cc

                SHA1

                02a949c1e44035114022079454555c9c145bf8fb

                SHA256

                edbe5331590b5dd47a67f9546820b96f3f2b4590cd4444ec6e6185762c6a2182

                SHA512

                e2e8b13f7e69d46fd1d3a08e08ef0bf661dc690df37583ea653321ac05ccc717a716ec9ac1670e574a87e70c8096bce538b976d7fbb4af9f46cf5c1ad598a37c

              • C:\Users\Admin\AppData\Local\Temp\InstallSetup4.exe

                Filesize

                384KB

                MD5

                6e1c3da5e773acb3dfd13e38cd9c1898

                SHA1

                b9fb4c0bef05310d6528a1fb47dd702970302c56

                SHA256

                7d5ba777ef0835d0a7f38587ac7f6ba1a96a1288114f6157b55ede2d35658ff0

                SHA512

                814bfcac9800d5956fe2cd5dcf23f26fb6572386f829c58fd2a3eea3061a37d312e1766568595bf2e3bd33c3fababe220c8eac4d79712d2170cb3c6711e70ad5

              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qqfygu5x.pna.ps1

                Filesize

                60B

                MD5

                d17fe0a3f47be24a6453e9ef58c94641

                SHA1

                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                SHA256

                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                SHA512

                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

              • C:\Users\Admin\AppData\Local\Temp\is-F0MNE.tmp\F1C6.tmp

                Filesize

                689KB

                MD5

                d33381c9542ef119f3e2c73822539b13

                SHA1

                04c855c2a6a0052850a2781ba03d57eac8d1e344

                SHA256

                679b09a828efb0b30e6ae3d95cf67903807848d87c99af5799a902d5b28901d1

                SHA512

                a30b153837fc00ce3cf56d62fcc15e9b9a2506fcb29383ed614d454fb742ac5945cecfcd5e389dc61e1b7198131cf04574a2d2fe97b8b0735939387de17b3daa

              • C:\Users\Admin\AppData\Local\Temp\is-MKJ9D.tmp\_isetup\_shfoldr.dll

                Filesize

                22KB

                MD5

                92dc6ef532fbb4a5c3201469a5b5eb63

                SHA1

                3e89ff837147c16b4e41c30d6c796374e0b8e62c

                SHA256

                9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

                SHA512

                9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

              • C:\Users\Admin\AppData\Local\Temp\is-N1PU6.tmp\ABA0.tmp

                Filesize

                689KB

                MD5

                1ba055823154222509be8b1cb57f0d49

                SHA1

                a11bdd1f4106f1de2dd075801987965f97c5c2b2

                SHA256

                c2994637d1dca3be7b8237176a71a5dca9a68f1442345f2f950a5b4bf3b0d841

                SHA512

                2a1372383e7ddb3a238c5e38cd5687689f9040f227cb75dffc422fcdf91be4086935cf4a8885b1a571ec3ea5dec150b72cce029e6f389ce6129e318061dfd41a

              • C:\Users\Admin\AppData\Local\Temp\is-VLQOD.tmp\_isetup\_iscrypt.dll

                Filesize

                2KB

                MD5

                a69559718ab506675e907fe49deb71e9

                SHA1

                bc8f404ffdb1960b50c12ff9413c893b56f2e36f

                SHA256

                2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

                SHA512

                e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

              • C:\Users\Admin\AppData\Local\Temp\nsoE7DC.tmp

                Filesize

                226KB

                MD5

                4e947abc3916088f9aeb96ca58ae4b2a

                SHA1

                ed78b516acdea1e79c242f585d4c1a2a3f45661e

                SHA256

                ecc6907c2fdbab7c96faf570aa575097d1f151e157acea3a958f21adf6de6abe

                SHA512

                80a58e16729d8d14675123cdf28b5c86ffb24ebe244d5d6caedd5ccdf97db6f430e90fea7375213e57e46d74e8c5e3558a13677e330acee7d119b8c42069fa2e

              • C:\Users\Admin\AppData\Local\Temp\nsvDEA4.tmp\INetC.dll

                Filesize

                25KB

                MD5

                40d7eca32b2f4d29db98715dd45bfac5

                SHA1

                124df3f617f562e46095776454e1c0c7bb791cc7

                SHA256

                85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9

                SHA512

                5fd4f516ce23fb7e705e150d5c1c93fc7133694ba495fb73101674a528883a013a34ab258083aa7ce6072973b067a605158316a4c9159c1b4d765761f91c513d

              • C:\Users\Admin\AppData\Roaming\Temp\Task.bat

                Filesize

                128B

                MD5

                11bb3db51f701d4e42d3287f71a6a43e

                SHA1

                63a4ee82223be6a62d04bdfe40ef8ba91ae49a86

                SHA256

                6be22058abfb22b40a42fb003f86b89e204a83024c03eb82cd53e2a0a047c331

                SHA512

                907ad2c070cc1db89f43459a94d7f48985d939d749c9648b78572a266f0d3fde47813a129e9151dbf4a7d96d36f588172f57c88b8b947b56ed818d7d068abab2

              • C:\Users\Admin\AppData\Roaming\ujuhrhj

                Filesize

                135KB

                MD5

                1334bbd7e0d0d3bb073194939f7dada8

                SHA1

                1b94edaf8a275a4c2e2ec6550a4567fd2048dcf4

                SHA256

                c89ac5cb4dbb4116ed1d3b9630aac5a927066938e5b4a24649cf09116882a146

                SHA512

                e960d3ea5bda9f39afb449fed300e9863dbbc7ee1c216cd8fa4b681316f78515316bb1fb1f7b4743d689b6a5896f2d4b6bb4a52052d2a298af210888cacf8336

              • memory/644-143-0x0000000004E60000-0x0000000005017000-memory.dmp

                Filesize

                1.7MB

              • memory/644-142-0x0000000004B90000-0x0000000004D58000-memory.dmp

                Filesize

                1.8MB

              • memory/856-234-0x0000000000A80000-0x0000000000A81000-memory.dmp

                Filesize

                4KB

              • memory/856-335-0x0000000000A80000-0x0000000000A81000-memory.dmp

                Filesize

                4KB

              • memory/876-332-0x0000000000400000-0x0000000000734000-memory.dmp

                Filesize

                3.2MB

              • memory/876-339-0x0000000000400000-0x0000000000734000-memory.dmp

                Filesize

                3.2MB

              • memory/1092-324-0x0000000000910000-0x0000000000A10000-memory.dmp

                Filesize

                1024KB

              • memory/1092-178-0x0000000000400000-0x0000000000817000-memory.dmp

                Filesize

                4.1MB

              • memory/1092-176-0x0000000000910000-0x0000000000A10000-memory.dmp

                Filesize

                1024KB

              • memory/1092-427-0x0000000000400000-0x0000000000817000-memory.dmp

                Filesize

                4.1MB

              • memory/1112-484-0x00007FFF850D0000-0x00007FFF85B91000-memory.dmp

                Filesize

                10.8MB

              • memory/1544-270-0x0000000000400000-0x0000000000414000-memory.dmp

                Filesize

                80KB

              • memory/1544-485-0x0000000000400000-0x0000000000414000-memory.dmp

                Filesize

                80KB

              • memory/2288-73-0x0000000000400000-0x0000000000414000-memory.dmp

                Filesize

                80KB

              • memory/2288-175-0x0000000000400000-0x0000000000414000-memory.dmp

                Filesize

                80KB

              • memory/2428-63-0x0000000003280000-0x00000000032B2000-memory.dmp

                Filesize

                200KB

              • memory/2428-41-0x00000000007B0000-0x0000000001287000-memory.dmp

                Filesize

                10.8MB

              • memory/2428-45-0x00000000013F0000-0x00000000013F1000-memory.dmp

                Filesize

                4KB

              • memory/2428-44-0x00000000013E0000-0x00000000013E1000-memory.dmp

                Filesize

                4KB

              • memory/2428-47-0x0000000001710000-0x0000000001711000-memory.dmp

                Filesize

                4KB

              • memory/2428-46-0x0000000001700000-0x0000000001701000-memory.dmp

                Filesize

                4KB

              • memory/2428-48-0x0000000001720000-0x0000000001721000-memory.dmp

                Filesize

                4KB

              • memory/2428-49-0x0000000001730000-0x0000000001731000-memory.dmp

                Filesize

                4KB

              • memory/2428-50-0x0000000001740000-0x0000000001741000-memory.dmp

                Filesize

                4KB

              • memory/2428-42-0x00000000013C0000-0x00000000013C1000-memory.dmp

                Filesize

                4KB

              • memory/2428-43-0x00000000013D0000-0x00000000013D1000-memory.dmp

                Filesize

                4KB

              • memory/2428-51-0x0000000001750000-0x0000000001751000-memory.dmp

                Filesize

                4KB

              • memory/2428-40-0x00000000013B0000-0x00000000013B1000-memory.dmp

                Filesize

                4KB

              • memory/2428-38-0x00000000013A0000-0x00000000013A1000-memory.dmp

                Filesize

                4KB

              • memory/2428-33-0x00000000007B0000-0x0000000001287000-memory.dmp

                Filesize

                10.8MB

              • memory/2428-52-0x0000000001760000-0x0000000001761000-memory.dmp

                Filesize

                4KB

              • memory/2428-53-0x0000000001770000-0x0000000001771000-memory.dmp

                Filesize

                4KB

              • memory/2428-54-0x0000000001780000-0x0000000001781000-memory.dmp

                Filesize

                4KB

              • memory/2428-55-0x0000000001790000-0x0000000001791000-memory.dmp

                Filesize

                4KB

              • memory/2428-56-0x0000000001940000-0x0000000001941000-memory.dmp

                Filesize

                4KB

              • memory/2428-57-0x0000000003260000-0x0000000003261000-memory.dmp

                Filesize

                4KB

              • memory/2428-58-0x0000000003270000-0x0000000003271000-memory.dmp

                Filesize

                4KB

              • memory/2428-61-0x0000000003280000-0x00000000032B2000-memory.dmp

                Filesize

                200KB

              • memory/2428-66-0x00000000007B0000-0x0000000001287000-memory.dmp

                Filesize

                10.8MB

              • memory/2428-65-0x0000000003280000-0x00000000032B2000-memory.dmp

                Filesize

                200KB

              • memory/2428-64-0x0000000003280000-0x00000000032B2000-memory.dmp

                Filesize

                200KB

              • memory/2428-62-0x0000000003280000-0x00000000032B2000-memory.dmp

                Filesize

                200KB

              • memory/2452-131-0x0000000000400000-0x0000000000736000-memory.dmp

                Filesize

                3.2MB

              • memory/2452-128-0x0000000000400000-0x0000000000736000-memory.dmp

                Filesize

                3.2MB

              • memory/2452-127-0x0000000000400000-0x0000000000736000-memory.dmp

                Filesize

                3.2MB

              • memory/2508-89-0x0000000000530000-0x0000000000531000-memory.dmp

                Filesize

                4KB

              • memory/3448-4-0x0000000002BA0000-0x0000000002BB6000-memory.dmp

                Filesize

                88KB

              • memory/3852-243-0x0000000002E90000-0x0000000002E9B000-memory.dmp

                Filesize

                44KB

              • memory/3852-255-0x0000000002ED0000-0x0000000002FD0000-memory.dmp

                Filesize

                1024KB

              • memory/3852-252-0x0000000000400000-0x0000000002D35000-memory.dmp

                Filesize

                41.2MB

              • memory/4060-5-0x0000000000400000-0x0000000000817000-memory.dmp

                Filesize

                4.1MB

              • memory/4060-1-0x0000000000AC0000-0x0000000000BC0000-memory.dmp

                Filesize

                1024KB

              • memory/4060-2-0x00000000009A0000-0x00000000009AB000-memory.dmp

                Filesize

                44KB

              • memory/4060-3-0x0000000000400000-0x0000000000817000-memory.dmp

                Filesize

                4.1MB

              • memory/4400-458-0x00000000052B0000-0x00000000052C0000-memory.dmp

                Filesize

                64KB

              • memory/4400-478-0x0000000006270000-0x00000000065C4000-memory.dmp

                Filesize

                3.3MB

              • memory/4400-472-0x0000000006090000-0x00000000060F6000-memory.dmp

                Filesize

                408KB

              • memory/4400-456-0x0000000072090000-0x0000000072840000-memory.dmp

                Filesize

                7.7MB

              • memory/4400-455-0x00000000058F0000-0x0000000005F18000-memory.dmp

                Filesize

                6.2MB

              • memory/4400-477-0x0000000006200000-0x0000000006266000-memory.dmp

                Filesize

                408KB

              • memory/4400-451-0x0000000005160000-0x0000000005196000-memory.dmp

                Filesize

                216KB

              • memory/4400-459-0x00000000052B0000-0x00000000052C0000-memory.dmp

                Filesize

                64KB

              • memory/4400-466-0x0000000005850000-0x0000000005872000-memory.dmp

                Filesize

                136KB

              • memory/4496-147-0x0000000000400000-0x0000000000848000-memory.dmp

                Filesize

                4.3MB

              • memory/4496-157-0x0000000000980000-0x0000000000986000-memory.dmp

                Filesize

                24KB

              • memory/4496-144-0x0000000000400000-0x0000000000848000-memory.dmp

                Filesize

                4.3MB

              • memory/4496-152-0x0000000000400000-0x0000000000848000-memory.dmp

                Filesize

                4.3MB

              • memory/4496-149-0x0000000000400000-0x0000000000848000-memory.dmp

                Filesize

                4.3MB

              • memory/4496-148-0x0000000000400000-0x0000000000848000-memory.dmp

                Filesize

                4.3MB

              • memory/4496-146-0x0000000000400000-0x0000000000848000-memory.dmp

                Filesize

                4.3MB

              • memory/4584-260-0x0000000002F90000-0x0000000003090000-memory.dmp

                Filesize

                1024KB

              • memory/4584-465-0x0000000002F90000-0x0000000003090000-memory.dmp

                Filesize

                1024KB

              • memory/4584-480-0x0000000000400000-0x0000000002D38000-memory.dmp

                Filesize

                41.2MB

              • memory/4584-464-0x0000000000400000-0x0000000002D38000-memory.dmp

                Filesize

                41.2MB

              • memory/4584-263-0x0000000000400000-0x0000000002D38000-memory.dmp

                Filesize

                41.2MB

              • memory/4584-261-0x0000000002E80000-0x0000000002EB4000-memory.dmp

                Filesize

                208KB

              • memory/4728-237-0x0000000002A10000-0x0000000002E12000-memory.dmp

                Filesize

                4.0MB

              • memory/4728-436-0x0000000000400000-0x0000000000D1C000-memory.dmp

                Filesize

                9.1MB

              • memory/4728-249-0x0000000000400000-0x0000000000D1C000-memory.dmp

                Filesize

                9.1MB

              • memory/4728-336-0x0000000002A10000-0x0000000002E12000-memory.dmp

                Filesize

                4.0MB

              • memory/4728-242-0x0000000002E20000-0x000000000370B000-memory.dmp

                Filesize

                8.9MB

              • memory/4748-136-0x0000000000400000-0x0000000000736000-memory.dmp

                Filesize

                3.2MB

              • memory/4748-134-0x0000000000400000-0x0000000000736000-memory.dmp

                Filesize

                3.2MB

              • memory/4748-241-0x0000000000400000-0x0000000000736000-memory.dmp

                Filesize

                3.2MB

              • memory/4840-330-0x0000000000400000-0x0000000000734000-memory.dmp

                Filesize

                3.2MB

              • memory/4840-323-0x0000000000400000-0x0000000000734000-memory.dmp

                Filesize

                3.2MB

              • memory/4840-325-0x0000000000400000-0x0000000000734000-memory.dmp

                Filesize

                3.2MB

              • memory/4948-22-0x0000000003060000-0x0000000003168000-memory.dmp

                Filesize

                1.0MB

              • memory/4948-166-0x0000000000D80000-0x0000000000D92000-memory.dmp

                Filesize

                72KB

              • memory/4948-160-0x0000000003170000-0x00000000049F8000-memory.dmp

                Filesize

                24.5MB

              • memory/4948-159-0x0000000003060000-0x0000000003168000-memory.dmp

                Filesize

                1.0MB

              • memory/4948-161-0x0000000001230000-0x000000000132B000-memory.dmp

                Filesize

                1004KB

              • memory/4948-14-0x0000000001190000-0x0000000001196000-memory.dmp

                Filesize

                24KB

              • memory/4948-21-0x0000000002F30000-0x0000000003054000-memory.dmp

                Filesize

                1.1MB

              • memory/4948-25-0x0000000003060000-0x0000000003168000-memory.dmp

                Filesize

                1.0MB

              • memory/4948-26-0x0000000010000000-0x00000000101A5000-memory.dmp

                Filesize

                1.6MB

              • memory/4948-15-0x0000000010000000-0x00000000101A5000-memory.dmp

                Filesize

                1.6MB

              • memory/4948-167-0x000000006F390000-0x000000006F3DB000-memory.dmp

                Filesize

                300KB

              • memory/4948-165-0x0000000004A00000-0x0000000004AFB000-memory.dmp

                Filesize

                1004KB

              • memory/4948-162-0x0000000004A00000-0x0000000004AFB000-memory.dmp

                Filesize

                1004KB

              • memory/5096-189-0x0000000000890000-0x0000000001146000-memory.dmp

                Filesize

                8.7MB

              • memory/5096-190-0x00000000728F0000-0x00000000730A0000-memory.dmp

                Filesize

                7.7MB

              • memory/5096-229-0x00000000728F0000-0x00000000730A0000-memory.dmp

                Filesize

                7.7MB

              • memory/5112-288-0x0000000000540000-0x0000000000541000-memory.dmp

                Filesize

                4KB