bf782827fee0c2350eef32b486f7750a530d0e253187f85dd6b52af0b30c8a85

Analysis

max time kernel
126s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06-05-2024 09:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEXU$.exe
Size

27.7MB
MD5

9f7d0bfe3985c340f42f039fbf9c52af
SHA1

8769d102239db1f9befeaa67b25a7c12ea9ccf2b
SHA256

bf782827fee0c2350eef32b486f7750a530d0e253187f85dd6b52af0b30c8a85
SHA512

988f00c929d7d01b887dc511e586cc75a14180b8b65f34cc293bb998174b667cd488d4e4fc777c183f0c29c744cf649fa520f7265e13486226f3f074cdaf3f81
SSDEEP

786432:TBvc42en9y+aJtShY9Q6SZKb0SReIMrRRMVb:T+cUSG8Zw09YVb

Score

9^/10

agilenet evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

BaChRfyzdG.exeNEXU$.exeBaChRfyzdG.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	BaChRfyzdG.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	NEXU$.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	BaChRfyzdG.exe

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

BaChRfyzdG.exeBaChRfyzdG.exeNEXU$.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	BaChRfyzdG.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	BaChRfyzdG.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	BaChRfyzdG.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	BaChRfyzdG.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	NEXU$.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	NEXU$.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

NEXU$.exeBaChRfyzdG.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	NEXU$.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	BaChRfyzdG.exe

Deletes itself 1 IoCs

Processes:

BaChRfyzdG.exe

pid process

936 BaChRfyzdG.exe
Executes dropped EXE 2 IoCs

Processes:

BaChRfyzdG.exeBaChRfyzdG.exe

pid process

936 BaChRfyzdG.exe
4124 BaChRfyzdG.exe

Loads dropped DLL 57 IoCs

Processes:

NEXU$.exeBaChRfyzdG.exeBaChRfyzdG.exe

pid	process
392	NEXU$.exe
392	NEXU$.exe
392	NEXU$.exe
392	NEXU$.exe
392	NEXU$.exe
392	NEXU$.exe
392	NEXU$.exe
392	NEXU$.exe
392	NEXU$.exe
392	NEXU$.exe
392	NEXU$.exe
392	NEXU$.exe
392	NEXU$.exe
392	NEXU$.exe
392	NEXU$.exe
392	NEXU$.exe
392	NEXU$.exe
392	NEXU$.exe
392	NEXU$.exe
392	NEXU$.exe
392	NEXU$.exe
392	NEXU$.exe
392	NEXU$.exe
392	NEXU$.exe
392	NEXU$.exe
392	NEXU$.exe
392	NEXU$.exe
392	NEXU$.exe
392	NEXU$.exe
392	NEXU$.exe
392	NEXU$.exe
392	NEXU$.exe
392	NEXU$.exe
392	NEXU$.exe
392	NEXU$.exe
392	NEXU$.exe
392	NEXU$.exe
392	NEXU$.exe
392	NEXU$.exe
392	NEXU$.exe
392	NEXU$.exe
392	NEXU$.exe
392	NEXU$.exe
392	NEXU$.exe
392	NEXU$.exe
936	BaChRfyzdG.exe
936	BaChRfyzdG.exe
936	BaChRfyzdG.exe
936	BaChRfyzdG.exe
936	BaChRfyzdG.exe
4124	BaChRfyzdG.exe
936	BaChRfyzdG.exe
936	BaChRfyzdG.exe
936	BaChRfyzdG.exe
936	BaChRfyzdG.exe
936	BaChRfyzdG.exe
936	BaChRfyzdG.exe

Obfuscated with Agile.Net obfuscator 8 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral3/memory/392-0-0x0000000000A70000-0x00000000016A0000-memory.dmp	agile_net
behavioral3/memory/392-4-0x0000000000A70000-0x0000000001652000-memory.dmp	agile_net
behavioral3/memory/392-92-0x0000000000A70000-0x00000000016A0000-memory.dmp	agile_net
C:\Users\Admin\AppData\Local\Temp\BaChRfyzdG.exe	agile_net
behavioral3/memory/936-312-0x0000000000E40000-0x0000000001A70000-memory.dmp	agile_net
behavioral3/memory/936-315-0x0000000000E40000-0x0000000001A22000-memory.dmp	agile_net
behavioral3/memory/392-326-0x0000000000A70000-0x0000000001652000-memory.dmp	agile_net
behavioral3/memory/936-488-0x0000000000E40000-0x0000000001A70000-memory.dmp	agile_net

Themida packer 18 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral3/memory/392-13-0x0000000010000000-0x0000000010C6A000-memory.dmp	themida
behavioral3/memory/392-8-0x0000000010000000-0x0000000010C6A000-memory.dmp	themida
behavioral3/memory/392-18-0x0000000006CD0000-0x0000000007322000-memory.dmp	themida
behavioral3/memory/392-21-0x0000000010000000-0x0000000010C6A000-memory.dmp	themida
behavioral3/memory/392-22-0x0000000010000000-0x0000000010C6A000-memory.dmp	themida
behavioral3/memory/392-19-0x0000000010000000-0x0000000010C6A000-memory.dmp	themida
behavioral3/memory/392-20-0x0000000010000000-0x0000000010C6A000-memory.dmp	themida
behavioral3/memory/392-23-0x0000000010000000-0x0000000010C6A000-memory.dmp	themida
behavioral3/memory/392-24-0x0000000010000000-0x0000000010C6A000-memory.dmp	themida
behavioral3/memory/392-60-0x0000000010000000-0x0000000010C6A000-memory.dmp	themida
behavioral3/memory/392-130-0x0000000010000000-0x0000000010C6A000-memory.dmp	themida
behavioral3/memory/392-318-0x0000000010000000-0x0000000010C6A000-memory.dmp	themida
behavioral3/memory/936-332-0x0000000010000000-0x0000000010C6A000-memory.dmp	themida
behavioral3/memory/936-331-0x0000000010000000-0x0000000010C6A000-memory.dmp	themida
behavioral3/memory/936-333-0x0000000010000000-0x0000000010C6A000-memory.dmp	themida
behavioral3/memory/936-330-0x0000000010000000-0x0000000010C6A000-memory.dmp	themida
behavioral3/memory/936-335-0x0000000010000000-0x0000000010C6A000-memory.dmp	themida
behavioral3/memory/936-334-0x0000000010000000-0x0000000010C6A000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

NEXU$.exeBaChRfyzdG.exeBaChRfyzdG.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	NEXU$.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	BaChRfyzdG.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	BaChRfyzdG.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

68 sites.google.com
69 sites.google.com
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

Processes:

NEXU$.exeBaChRfyzdG.exeBaChRfyzdG.exe

pid process

392 NEXU$.exe
936 BaChRfyzdG.exe
4124 BaChRfyzdG.exe
Drops file in Windows directory 1 IoCs

Processes:

BaChRfyzdG.exe

description ioc process

File created C:\Windows\Fonts\DS-Digital.ttf BaChRfyzdG.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
68	sites.google.com
69	sites.google.com

description	ioc	process
File created	C:\Windows\Fonts\DS-Digital.ttf	BaChRfyzdG.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

Processes:

BaChRfyzdG.exeBaChRfyzdG.exe

pid	process
936	BaChRfyzdG.exe
936	BaChRfyzdG.exe
936	BaChRfyzdG.exe
936	BaChRfyzdG.exe
4124	BaChRfyzdG.exe
4124	BaChRfyzdG.exe
4124	BaChRfyzdG.exe
4124	BaChRfyzdG.exe
936	BaChRfyzdG.exe
936	BaChRfyzdG.exe
936	BaChRfyzdG.exe
936	BaChRfyzdG.exe
936	BaChRfyzdG.exe
936	BaChRfyzdG.exe
936	BaChRfyzdG.exe
936	BaChRfyzdG.exe
936	BaChRfyzdG.exe
936	BaChRfyzdG.exe
936	BaChRfyzdG.exe
936	BaChRfyzdG.exe
936	BaChRfyzdG.exe
936	BaChRfyzdG.exe
936	BaChRfyzdG.exe
936	BaChRfyzdG.exe
936	BaChRfyzdG.exe
936	BaChRfyzdG.exe
936	BaChRfyzdG.exe
936	BaChRfyzdG.exe
936	BaChRfyzdG.exe
936	BaChRfyzdG.exe
936	BaChRfyzdG.exe
936	BaChRfyzdG.exe
936	BaChRfyzdG.exe
936	BaChRfyzdG.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

NEXU$.exeBaChRfyzdG.exeBaChRfyzdG.exe

description pid process

Token: SeDebugPrivilege 392 NEXU$.exe
Token: SeDebugPrivilege 936 BaChRfyzdG.exe
Token: SeDebugPrivilege 4124 BaChRfyzdG.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

BaChRfyzdG.exe

pid process

936 BaChRfyzdG.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

BaChRfyzdG.exe

pid process

936 BaChRfyzdG.exe

description	pid	process
Token: SeDebugPrivilege	392	NEXU$.exe
Token: SeDebugPrivilege	936	BaChRfyzdG.exe
Token: SeDebugPrivilege	4124	BaChRfyzdG.exe

Suspicious use of WriteProcessMemory 33 IoCs

Processes:

NEXU$.exeBaChRfyzdG.exe

description	pid	process	target process
PID 392 wrote to memory of 936	392	NEXU$.exe	BaChRfyzdG.exe
PID 392 wrote to memory of 936	392	NEXU$.exe	BaChRfyzdG.exe
PID 392 wrote to memory of 936	392	NEXU$.exe	BaChRfyzdG.exe
PID 936 wrote to memory of 4124	936	BaChRfyzdG.exe	BaChRfyzdG.exe
PID 936 wrote to memory of 4124	936	BaChRfyzdG.exe	BaChRfyzdG.exe
PID 936 wrote to memory of 4124	936	BaChRfyzdG.exe	BaChRfyzdG.exe
PID 936 wrote to memory of 1548	936	BaChRfyzdG.exe	netsh.exe
PID 936 wrote to memory of 1548	936	BaChRfyzdG.exe	netsh.exe
PID 936 wrote to memory of 1548	936	BaChRfyzdG.exe	netsh.exe
PID 936 wrote to memory of 1084	936	BaChRfyzdG.exe	netsh.exe
PID 936 wrote to memory of 1084	936	BaChRfyzdG.exe	netsh.exe
PID 936 wrote to memory of 1084	936	BaChRfyzdG.exe	netsh.exe
PID 936 wrote to memory of 4040	936	BaChRfyzdG.exe	netsh.exe
PID 936 wrote to memory of 4040	936	BaChRfyzdG.exe	netsh.exe
PID 936 wrote to memory of 4040	936	BaChRfyzdG.exe	netsh.exe
PID 936 wrote to memory of 1660	936	BaChRfyzdG.exe	netsh.exe
PID 936 wrote to memory of 1660	936	BaChRfyzdG.exe	netsh.exe
PID 936 wrote to memory of 1660	936	BaChRfyzdG.exe	netsh.exe
PID 936 wrote to memory of 5100	936	BaChRfyzdG.exe	netsh.exe
PID 936 wrote to memory of 5100	936	BaChRfyzdG.exe	netsh.exe
PID 936 wrote to memory of 5100	936	BaChRfyzdG.exe	netsh.exe
PID 936 wrote to memory of 4368	936	BaChRfyzdG.exe	netsh.exe
PID 936 wrote to memory of 4368	936	BaChRfyzdG.exe	netsh.exe
PID 936 wrote to memory of 4368	936	BaChRfyzdG.exe	netsh.exe
PID 936 wrote to memory of 3816	936	BaChRfyzdG.exe	netsh.exe
PID 936 wrote to memory of 3816	936	BaChRfyzdG.exe	netsh.exe
PID 936 wrote to memory of 3816	936	BaChRfyzdG.exe	netsh.exe
PID 936 wrote to memory of 968	936	BaChRfyzdG.exe	netsh.exe
PID 936 wrote to memory of 968	936	BaChRfyzdG.exe	netsh.exe
PID 936 wrote to memory of 968	936	BaChRfyzdG.exe	netsh.exe
PID 936 wrote to memory of 904	936	BaChRfyzdG.exe	netsh.exe
PID 936 wrote to memory of 904	936	BaChRfyzdG.exe	netsh.exe
PID 936 wrote to memory of 904	936	BaChRfyzdG.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\NEXU$.exe
"C:\Users\Admin\AppData\Local\Temp\NEXU$.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:392

C:\Users\Admin\AppData\Local\Temp\BaChRfyzdG.exe
"C:\Users\Admin\AppData\Local\Temp\BaChRfyzdG.exe" NEXU$.exe
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:936

C:\Users\Admin\AppData\Local\Temp\BaChRfyzdG.exe
"C:\Users\Admin\AppData\Local\Temp\BaChRfyzdG.exe" "NEXU$.exe"
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4124

C:\Windows\SysWOW64\netsh.exe
"netsh" int tcp set heuristics disabled
3⤵
PID:1548

C:\Windows\SysWOW64\netsh.exe
"netsh" int tcp set global autotuninglevel=normal
3⤵
PID:1084

C:\Windows\SysWOW64\netsh.exe
"netsh" int tcp set global congestionprovider=ctcp
3⤵
PID:4040

C:\Windows\SysWOW64\netsh.exe
"netsh" int tcp set global ecncapability=default
3⤵
PID:1660

C:\Windows\SysWOW64\netsh.exe
"netsh" int tcp set global rss=enabled
3⤵
PID:5100

C:\Windows\SysWOW64\netsh.exe
"netsh" int tcp set global chimney=disabled
3⤵
PID:4368

C:\Windows\SysWOW64\netsh.exe
"netsh" int tcp set global dca=enabled
3⤵
PID:3816

C:\Windows\SysWOW64\netsh.exe
"netsh" int tcp set global timestamps=disabled
3⤵
PID:968

C:\Windows\SysWOW64\netsh.exe
"netsh" int tcp set global rsc=enabled
3⤵
PID:904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3972 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:2136

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\BaChRfyzdG.exe
Filesize
27.7MB

MD5
9f7d0bfe3985c340f42f039fbf9c52af

SHA1
8769d102239db1f9befeaa67b25a7c12ea9ccf2b

SHA256
bf782827fee0c2350eef32b486f7750a530d0e253187f85dd6b52af0b30c8a85

SHA512
988f00c929d7d01b887dc511e586cc75a14180b8b65f34cc293bb998174b667cd488d4e4fc777c183f0c29c744cf649fa520f7265e13486226f3f074cdaf3f81

Download Submit
C:\Users\Admin\AppData\Local\Temp\config.zip
Filesize
1.9MB

MD5
1ca4cecfca2c17a27a3a4a7e337ac1b3

SHA1
b8a5317fa59b127d4606715d204cd39d7f285241

SHA256
fbf60c26906f82b9b19cc39efa6262c63e0af3ca4321a46eea4ec0a19e6ea443

SHA512
b0f2ca8b4ab5b799dc8e5807c101037189cdcf8d0717a8cc2a2cc99a906b4cba191b4eb6a4eff3550f15d44bcdfb9711ebe0ee0a50fcf81be868f7b10cca964e

Download Submit
C:\Users\Admin\AppData\Local\Temp\evb346A.tmp
Filesize
1KB

MD5
57eb881a7adba6335b907ea2bfeab5da

SHA1
fb825489bb35cce81ec1fe1c7da9395b66a3212f

SHA256
eeb4ba320d8953f68267ff13e5ececc0ee7c7dd677bb95013b91b03198c41858

SHA512
b0921a715fe36694ff73428794b70b6289ad9fcfd536bf3b70e037bfbb6b4714fbcaedc164f0323f10d10901ce0526ae9cf1b1d4a66a2ffb24727d75ff56aa84

Download Submit
C:\Users\Admin\AppData\Local\Temp\evb5050.tmp
Filesize
1KB

MD5
a14bfff0d9a58df81fced932ea122af8

SHA1
e44b008e348c0ca79631548716a3c18a84a5b734

SHA256
121b4c05501609241b7059b18ff412d7e83f215e9af492cf494584fb22957609

SHA512
c633a22844f6177292fec5098210202e0efe8720eaa2084a3fb9b1ea6a99b3940c46f0077557300ef67e70471ce58cf52a3192ce9551147c0fac25e4558779a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\evb5090.tmp
Filesize
1KB

MD5
7516df78d526c407fea01eba7b083e41

SHA1
f42c285b9d732aa913a5e6f7bf527fe694a62963

SHA256
f506eb96b308d92535cb3539bfdc89023b09de019aae6419ced69f3436229435

SHA512
d6d2091ab00033f6cb188ab2febb0a261843dc94796efb022edad93decbb57f07e7a9d8af4a1c011092176e3c5062096059a74c3a520e1839409688759dbf673

Download Submit
C:\Users\Admin\AppData\Local\Temp\evb50B1.tmp
Filesize
1KB

MD5
169d89f5e98c1ec24910e2f0c1a35690

SHA1
58fe53b51777051cca50f448743088ea73a6feb7

SHA256
bc9c6304c5de48e472289c2c0246866e853d125bd292be635d60361a7618824b

SHA512
c5f45abf6da0a218a1c9051e4b2b7d5088de689bfdebf156de57696ab9d4a2766fc4c8232142d6b0af5a34b1da194a58277f19d3ca4d777692004389e25d5fe5

Download Submit
C:\Users\Admin\AppData\Local\Temp\evb50E3.tmp
Filesize
1KB

MD5
547fa32dd7c005708dd434075f6b1d70

SHA1
ba49acf69c1496447e6899870ccc2238a5c3ed87

SHA256
9062989f7ed30df9cd06e3632c59c3bf2a1e6e970d8f420aadf65d1a1f17036e

SHA512
b8ab3db39b14aa20c8475f8811ba113f7dec215ff449a2f50d44790476ec6b338ad93f9950778256b1a0406df60cd1ff980a3bb0ff6d65c0444073b7794c092f

Download Submit
C:\Users\Admin\AppData\Local\Temp\evb5114.tmp
Filesize
1KB

MD5
26fc5802d3da1539a5b4a4e9d1c0be94

SHA1
4451ad10ddd3a9910f3706e957ce32ae142fbf58

SHA256
d1781882a8f4ed09d0f0237271a72522b7679aca3112755c75f9b60e5db18840

SHA512
5dd81590049e6574e3e1325b637a4f2fb62bfc77635f8ad86b6125ff2a91f04a88182cc896e855b3054ed281545c6985e0db05c36ed55f0819ed5260ab27b44c

Download Submit
C:\Users\Admin\AppData\Local\Temp\evb5125.tmp
Filesize
1KB

MD5
394163f4458c968691ec5a8ae5c11ad1

SHA1
32b2d59ce48997dc832df6ec018d5cd08d3592a1

SHA256
b7c700fa8d686d98fd21d87c5788aaa30a39cad5e15f30f2928f8c8bd0c68e77

SHA512
7b56db7842d0ebf7affa8c32a3a1a2acfb06a5f40a265e27d45769ba6720985af404c854c8036dcb958de12c3789870f923e61ea629bae676a805c2c3422c91f

Download Submit
C:\Users\Admin\AppData\Local\Temp\evb51D4.tmp
Filesize
1KB

MD5
a8d20389688eb5bb2217374daac56135

SHA1
84206edd4f55aeede510e916137c9f3c49a11ff5

SHA256
5a1e88a2bcb9de8eab56724555cad7edf1c35f5a82782e7cd9d953b1e4206172

SHA512
a1b5db7e0ddd8f354e1f4d1eb58f5b73af8e1028b7aa3dcf2802dd4359c3e0331a2a095d1e5bda1249c2869ad302175101401483b0fa2ff41246d6ed26ca8978

Download Submit
C:\Users\Admin\AppData\Local\Temp\evb51D5.tmp
Filesize
1KB

MD5
b02ea8cf232a5c2ad2a91ac241b8ab78

SHA1
a460bccd303dae29bdf496ddc343cfd0aa6db8fe

SHA256
5defef4d85dc339c70be3b000d1cecc65fbadf137732ed2fe4ca5514fcaf59e1

SHA512
6416322dae4af0772505885f85ccdd0e33b76e41a56f6381a0a7d4a36e6dfc717e654ae260d0c5c12751d977c4f8a916bcd2239fb1e20a643124f69a0571fda0

Download Submit
C:\Users\Admin\AppData\Local\Temp\evb532F.tmp
Filesize
1KB

MD5
9c6a27a0e7a4e5507eaf2ae53d6cefc4

SHA1
1d2ada0b7c6255bf2d852c7bf16bab962fbdca47

SHA256
5393c6e414f4cb8dae92dd03b6642953e80f2b72bb7968fe0e5250e428e4265a

SHA512
5e3bc5a3f25878ca2b20a5ea6fda8642759b7451ed29b948b219f933b83080e8d0b7c28f57aa68432ea99ee84547bf340b808803d634c5cf9025f90281e0ed43

Download Submit
C:\Users\Admin\AppData\Local\Temp\evb53A0.tmp
Filesize
1KB

MD5
90259af8bab2c4b2a9c1a70ccd22886d

SHA1
056746307495e18972455b488f37931e607e802e

SHA256
2d91617c40e2b4cf5e9f3c0b773846f8eafc8ee2e57f5e1fb466ede694c2f058

SHA512
3aab255150621cc75a29472c1a5dc6ff52050ccf462065f48c27661f3331904ab5a7f35dbfe1bb8d6da0d789d3f35cd158923f0707dd06cee76c5890f8cba471

Download Submit
C:\Users\Admin\AppData\Local\Temp\evb55E5.tmp
Filesize
1KB

MD5
42934c8a30e26034cf40084b75915345

SHA1
a38ac374de3ae245c8799289dac6f5640618b86b

SHA256
8c4ec5491045e156b8e86c2872cdd69c8f72381f3635a0b6a5d6a7340dc6ec87

SHA512
c6427f777643555e228186e9574c86c4dc97fdb60dbf93a05a45d78754ee484f93a15c480986e7ffbe432c660bb0ffdf323a492a00083d80a916ae9b1147e1d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\evb5654.tmp
Filesize
1KB

MD5
65d4545e8b5b4bf89c1393c731617252

SHA1
6cc6f80814bef739e256ff0344f2957d1e649c1e

SHA256
0ad27262f323681cd0240dc075ad7b0db796a7d1510ac9155dd16eacffeba516

SHA512
66b0b315037d24601d6047408e9d8af570c4dc9828381758bf068bcf62b1abc5f5b25bb3345203a73cb9997e144b15f02ec3e8eb08f7a7d8592486cd022dcab6

Download Submit
C:\Users\Admin\AppData\Local\Temp\evb5665.tmp
Filesize
1KB

MD5
63098c2d15b8edd10285033ec1037d37

SHA1
d03b8866ab61dc722d86c957b3d2804ff051ef39

SHA256
3da1cda8365a58794ace3732e5da9e370da9024d36e61ddd1e1b1aa7add4c33d

SHA512
198d0df79eecbbaf5137ade21e00aac5a2f05c13dee7f6c89d378c462ea0d28f9fd79749a85b301a1c3f208a06f440441227dc4ba83449cf16d553f7fc4c5937

Download Submit
C:\Users\Admin\AppData\Local\Temp\evb56E5.tmp
Filesize
1KB

MD5
4e3dbd6001a9c81a5d1d6a8b2d874bb1

SHA1
e01494d70f75a86a63425f743c13b270feefbd9f

SHA256
5b4a8c43dd1111901fa99c6950ee2d8ce0bc549b97144feeedde5ca521ed15b0

SHA512
3b10527efb7d98527d6da61bd443fdb985dd58fe36c98fc8a72211e2ecc089aabc848155d50a0bb0fce5bd516178d54cd0eeea8d8160f0d34b1f9172119c6859

Download Submit
C:\Users\Admin\AppData\Local\Temp\evb5716.tmp
Filesize
1KB

MD5
094530769342de17b8ab80297ff4c8a8

SHA1
ea86ba51b011e748b69ccd1bf3bea6bf50820928

SHA256
bdabff206a5fba54a1a06fbf3f59606fc66e08882b26216aa053e7b46a20ea31

SHA512
9e7997e53d6f831aa50aba4425d40970aee10364fa3a996a270ffa248ff62187c9ef387f422f644e0bcc1ca9d7f21c4c7f40c6bf8dfa13a3e7558f80641eba8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\evb5747.tmp
Filesize
1KB

MD5
6ceb6e3be571bdaee3147adb325994f0

SHA1
25b8919e8c917c7d31436a4555d391306b96a3a3

SHA256
3705ac3ba0589b10770f0fb31000372e8f0ccecd2397c96db3ad3c6b986fd002

SHA512
339a1855a13fb844606e1950e430b5593528ec67da884d1b5a172a7740904daf1aaf6ae0cc0316638582742d1189720baba7f75030355ef706031074afd4d772

Download Submit
C:\Users\Admin\AppData\Local\Temp\evb5767.tmp
Filesize
1KB

MD5
6804eea872fd80ff18fdd41a3fee7291

SHA1
3426bd1435e4d10a0ee748928ea2d52abef840a5

SHA256
ea1b653feddf085f462687015ce7e20331371325b6621b6ffb2b1489e6007342

SHA512
b1ff2394e1dbd8c815fd5fd9422444965a0f9dcbfd101a785b9cb83a3aa96e3df04d9e45fa7e50d9bcd13d168d69c2d5b30688c4b2a301a6ddc7db0a4d717fa1

Download Submit
C:\Users\Admin\AppData\Local\Temp\evb62B4.tmp
Filesize
1KB

MD5
93d3032d0ef3ab29374adb476d3a2377

SHA1
ec50554b58da1bcac0867d2aeb191b8c084ebc04

SHA256
04d01a5a96f2f0a32c0f1ad15229ee4e658b4270f234f2c18a6227c7c1d29134

SHA512
3e03560eb58ab03ecf72ff46f509ea7ff1badde2b90bb4b3561458427eda36fbe849f38ecf7676a5a7bc28facd7dadf6cd773c3baa3037c1e6cc729a7ea3bda5

Download Submit
memory/392-216-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/392-8-0x0000000010000000-0x0000000010C6A000-memory.dmp

Filesize
12.4MB

Download
memory/392-57-0x0000000007820000-0x00000000078B2000-memory.dmp

Filesize
584KB

Download
memory/392-58-0x00000000078C0000-0x0000000007926000-memory.dmp

Filesize
408KB

Download
memory/392-60-0x0000000010000000-0x0000000010C6A000-memory.dmp

Filesize
12.4MB

Download
memory/392-65-0x0000000007B50000-0x0000000007C02000-memory.dmp

Filesize
712KB

Download
memory/392-87-0x00000000076B0000-0x00000000076C2000-memory.dmp

Filesize
72KB

Download
memory/392-96-0x00000000076B0000-0x00000000076D6000-memory.dmp

Filesize
152KB

Download
memory/392-113-0x00000000076B0000-0x00000000076D6000-memory.dmp

Filesize
152KB

Download
memory/392-117-0x0000000000400000-0x00000000006AE000-memory.dmp

Filesize
2.7MB

Download
memory/392-25-0x0000000072850000-0x00000000728D9000-memory.dmp

Filesize
548KB

Download
memory/392-24-0x0000000010000000-0x0000000010C6A000-memory.dmp

Filesize
12.4MB

Download
memory/392-128-0x0000000020530000-0x0000000020B5A000-memory.dmp

Filesize
6.2MB

Download
memory/392-130-0x0000000010000000-0x0000000010C6A000-memory.dmp

Filesize
12.4MB

Download
memory/392-134-0x0000000006DC0000-0x0000000006DCA000-memory.dmp

Filesize
40KB

Download
memory/392-135-0x0000000020530000-0x0000000020B5A000-memory.dmp

Filesize
6.2MB

Download
memory/392-133-0x0000000006DC0000-0x0000000006DCA000-memory.dmp

Filesize
40KB

Download
memory/392-141-0x0000000020530000-0x0000000020B5A000-memory.dmp

Filesize
6.2MB

Download
memory/392-23-0x0000000010000000-0x0000000010C6A000-memory.dmp

Filesize
12.4MB

Download
memory/392-154-0x0000000006DC0000-0x0000000006DC8000-memory.dmp

Filesize
32KB

Download
memory/392-158-0x0000000073E40000-0x00000000745F0000-memory.dmp

Filesize
7.7MB

Download
memory/392-159-0x0000000006DC0000-0x0000000006DC8000-memory.dmp

Filesize
32KB

Download
memory/392-151-0x00000000076B0000-0x0000000007750000-memory.dmp

Filesize
640KB

Download
memory/392-150-0x0000000073E4E000-0x0000000073E4F000-memory.dmp

Filesize
4KB

Download
memory/392-164-0x000000000A380000-0x000000000AB26000-memory.dmp

Filesize
7.6MB

Download
memory/392-160-0x000000000A380000-0x000000000AB26000-memory.dmp

Filesize
7.6MB

Download
memory/392-170-0x000000000A380000-0x000000000AB26000-memory.dmp

Filesize
7.6MB

Download
memory/392-20-0x0000000010000000-0x0000000010C6A000-memory.dmp

Filesize
12.4MB

Download
memory/392-19-0x0000000010000000-0x0000000010C6A000-memory.dmp

Filesize
12.4MB

Download
memory/392-197-0x00000000076B0000-0x00000000076FC000-memory.dmp

Filesize
304KB

Download
memory/392-214-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/392-224-0x00000000076B0000-0x0000000007722000-memory.dmp

Filesize
456KB

Download
memory/392-236-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/392-235-0x00000000076B0000-0x00000000076C2000-memory.dmp

Filesize
72KB

Download
memory/392-234-0x00000000076B0000-0x00000000076C2000-memory.dmp

Filesize
72KB

Download
memory/392-233-0x0000000006DC0000-0x0000000006DC8000-memory.dmp

Filesize
32KB

Download
memory/392-232-0x0000000006DC0000-0x0000000006DC8000-memory.dmp

Filesize
32KB

Download
memory/392-231-0x00000000076B0000-0x00000000076CA000-memory.dmp

Filesize
104KB

Download
memory/392-230-0x00000000076B0000-0x00000000076CA000-memory.dmp

Filesize
104KB

Download
memory/392-229-0x0000000007B50000-0x0000000007C02000-memory.dmp

Filesize
712KB

Download
memory/392-228-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/392-227-0x0000000007B50000-0x0000000007C20000-memory.dmp

Filesize
832KB

Download
memory/392-226-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/392-225-0x0000000000400000-0x00000000006AE000-memory.dmp

Filesize
2.7MB

Download
memory/392-223-0x0000000000400000-0x00000000006AE000-memory.dmp

Filesize
2.7MB

Download
memory/392-22-0x0000000010000000-0x0000000010C6A000-memory.dmp

Filesize
12.4MB

Download
memory/392-21-0x0000000010000000-0x0000000010C6A000-memory.dmp

Filesize
12.4MB

Download
memory/392-18-0x0000000006CD0000-0x0000000007322000-memory.dmp

Filesize
6.3MB

Download
memory/392-210-0x000000000A380000-0x000000000A6AE000-memory.dmp

Filesize
3.2MB

Download
memory/392-17-0x0000000073E40000-0x00000000745F0000-memory.dmp

Filesize
7.7MB

Download
memory/392-207-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/392-16-0x00000000FF160000-0x00000000FF34F000-memory.dmp

Filesize
1.9MB

Download
memory/392-199-0x00000000076B0000-0x0000000007722000-memory.dmp

Filesize
456KB

Download
memory/392-196-0x00000000076B0000-0x00000000076FC000-memory.dmp

Filesize
304KB

Download
memory/392-195-0x00000000076B0000-0x0000000007722000-memory.dmp

Filesize
456KB

Download
memory/392-187-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/392-186-0x0000000073E40000-0x00000000745F0000-memory.dmp

Filesize
7.7MB

Download
memory/392-56-0x0000000007DD0000-0x0000000008374000-memory.dmp

Filesize
5.6MB

Download
memory/392-178-0x000000000A380000-0x000000000A6AE000-memory.dmp

Filesize
3.2MB

Download
memory/392-169-0x00000000076B0000-0x00000000076FC000-memory.dmp

Filesize
304KB

Download
memory/392-237-0x0000000007B50000-0x0000000007C20000-memory.dmp

Filesize
832KB

Download
memory/392-251-0x0000000007B50000-0x0000000007C4C000-memory.dmp

Filesize
1008KB

Download
memory/392-250-0x0000000007B50000-0x0000000007C20000-memory.dmp

Filesize
832KB

Download
memory/392-13-0x0000000010000000-0x0000000010C6A000-memory.dmp

Filesize
12.4MB

Download
memory/392-265-0x0000000020530000-0x0000000020B5A000-memory.dmp

Filesize
6.2MB

Download
memory/392-277-0x0000000006DC0000-0x0000000006DC8000-memory.dmp

Filesize
32KB

Download
memory/392-273-0x0000000006DC0000-0x0000000006DCA000-memory.dmp

Filesize
40KB

Download
memory/392-272-0x0000000006DC0000-0x0000000006DCA000-memory.dmp

Filesize
40KB

Download
memory/392-248-0x00000000076B0000-0x00000000076D6000-memory.dmp

Filesize
152KB

Download
memory/392-245-0x0000000007B50000-0x0000000007C02000-memory.dmp

Filesize
712KB

Download
memory/392-246-0x0000000007B50000-0x0000000007C4C000-memory.dmp

Filesize
1008KB

Download
memory/392-247-0x00000000076B0000-0x00000000076D6000-memory.dmp

Filesize
152KB

Download
memory/392-4-0x0000000000A70000-0x0000000001652000-memory.dmp

Filesize
11.9MB

Download
memory/392-140-0x00000000076B0000-0x0000000007750000-memory.dmp

Filesize
640KB

Download
memory/392-112-0x0000000000400000-0x00000000006AE000-memory.dmp

Filesize
2.7MB

Download
memory/392-111-0x00000000076B0000-0x00000000076D6000-memory.dmp

Filesize
152KB

Download
memory/392-110-0x0000000007B50000-0x0000000007C02000-memory.dmp

Filesize
712KB

Download
memory/392-3-0x0000000073E4E000-0x0000000073E4F000-memory.dmp

Filesize
4KB

Download
memory/392-103-0x00000000076B0000-0x00000000076C2000-memory.dmp

Filesize
72KB

Download
memory/392-101-0x00000000076B0000-0x00000000076C2000-memory.dmp

Filesize
72KB

Download
memory/392-100-0x0000000006DC0000-0x0000000006DC8000-memory.dmp

Filesize
32KB

Download
memory/392-99-0x0000000006DC0000-0x0000000006DC8000-memory.dmp

Filesize
32KB

Download
memory/392-98-0x00000000076B0000-0x00000000076CA000-memory.dmp

Filesize
104KB

Download
memory/392-97-0x00000000076B0000-0x00000000076CA000-memory.dmp

Filesize
104KB

Download
memory/392-92-0x0000000000A70000-0x00000000016A0000-memory.dmp

Filesize
12.2MB

Download
memory/392-1-0x0000000076FC2000-0x0000000076FC3000-memory.dmp

Filesize
4KB

Download
memory/392-2-0x0000000076FC3000-0x0000000076FC4000-memory.dmp

Filesize
4KB

Download
memory/392-73-0x00000000076B0000-0x00000000076CA000-memory.dmp

Filesize
104KB

Download
memory/392-0-0x0000000000A70000-0x00000000016A0000-memory.dmp

Filesize
12.2MB

Download
memory/392-313-0x0000000006DC0000-0x0000000006DC8000-memory.dmp

Filesize
32KB

Download
memory/392-292-0x00000000076B0000-0x0000000007750000-memory.dmp

Filesize
640KB

Download
memory/392-314-0x000000000A380000-0x000000000AB26000-memory.dmp

Filesize
7.6MB

Download
memory/392-319-0x0000000073E40000-0x00000000745F0000-memory.dmp

Filesize
7.7MB

Download
memory/392-326-0x0000000000A70000-0x0000000001652000-memory.dmp

Filesize
11.9MB

Download
memory/392-318-0x0000000010000000-0x0000000010C6A000-memory.dmp

Filesize
12.4MB

Download
memory/392-293-0x0000000006DC0000-0x0000000006DC8000-memory.dmp

Filesize
32KB

Download
memory/392-291-0x00000000076B0000-0x0000000007750000-memory.dmp

Filesize
640KB

Download
memory/936-370-0x0000000007AE0000-0x0000000007B2C000-memory.dmp

Filesize
304KB

Download
memory/936-331-0x0000000010000000-0x0000000010C6A000-memory.dmp

Filesize
12.4MB

Download
memory/936-371-0x0000000007B30000-0x0000000007B38000-memory.dmp

Filesize
32KB

Download
memory/936-312-0x0000000000E40000-0x0000000001A70000-memory.dmp

Filesize
12.2MB

Download
memory/936-330-0x0000000010000000-0x0000000010C6A000-memory.dmp

Filesize
12.4MB

Download
memory/936-335-0x0000000010000000-0x0000000010C6A000-memory.dmp

Filesize
12.4MB

Download
memory/936-336-0x0000000072850000-0x00000000728D9000-memory.dmp

Filesize
548KB

Download
memory/936-334-0x0000000010000000-0x0000000010C6A000-memory.dmp

Filesize
12.4MB

Download
memory/936-512-0x0000000012520000-0x0000000012874000-memory.dmp

Filesize
3.3MB

Download
memory/936-332-0x0000000010000000-0x0000000010C6A000-memory.dmp

Filesize
12.4MB

Download
memory/936-333-0x0000000010000000-0x0000000010C6A000-memory.dmp

Filesize
12.4MB

Download
memory/936-421-0x0000000009CD0000-0x0000000009E56000-memory.dmp

Filesize
1.5MB

Download
memory/936-432-0x000000000A0A0000-0x000000000A0AA000-memory.dmp

Filesize
40KB

Download
memory/936-483-0x000000000D970000-0x000000000D986000-memory.dmp

Filesize
88KB

Download
memory/936-488-0x0000000000E40000-0x0000000001A70000-memory.dmp

Filesize
12.2MB

Download
memory/936-489-0x0000000012240000-0x00000000122DC000-memory.dmp

Filesize
624KB

Download
memory/936-511-0x0000000002040000-0x0000000002062000-memory.dmp

Filesize
136KB

Download
memory/936-315-0x0000000000E40000-0x0000000001A22000-memory.dmp

Filesize
11.9MB

Download