48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/06/2024, 04:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
Size

1.9MB
MD5

fa307f68bd87260456ada24f7e6ace90
SHA1

12a15df3b9de4292583faf78ecfc054ba9159be0
SHA256

48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f
SHA512

a2632f212eb92b2d4d35cc10b9b7985aa64a865206ed6660ade885d6b6e0c79f85e17b8da8848684168f479a738ceb65beef52f4b46e7923ed299d674f5ca809
SSDEEP

24576:nDQIvJjFj1n27tXZavwruzm+o2qJGHG49W1hjDUcSz2ToHY9I+s:nUm9k7BRGWJGFWioTu+

Score

10^/10

spyware stealer

Malware Config

Signatures

Process spawned unexpected child process 15 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4932	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5008	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1116	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1020	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1644	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2464	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4460	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	2460	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1372	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3852	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4372	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1736	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	372	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	3512	3464	schtasks.exe	83
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	4696	3464	schtasks.exe	83

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe

Executes dropped EXE 1 IoCs

pid	Process
3924	fontdrvhost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\Offline Web Pages\fontdrvhost.exe	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
File created	C:\Windows\Offline Web Pages\5b884080fd4f94	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
File created	C:\Windows\Setup\State\Idle.exe	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
File created	C:\Windows\Setup\State\6ccacd8608530f	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
File created	C:\Windows\Sun\Idle.exe	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
File created	C:\Windows\Sun\6ccacd8608530f	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3716	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 15 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1020	schtasks.exe
4696	schtasks.exe
1116	schtasks.exe
2464	schtasks.exe
4460	schtasks.exe
3512	schtasks.exe
5008	schtasks.exe
1644	schtasks.exe
3852	schtasks.exe
372	schtasks.exe
4932	schtasks.exe
2460	schtasks.exe
1372	schtasks.exe
4372	schtasks.exe
1736	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
Token: SeDebugPrivilege	3924	fontdrvhost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 3568	4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe	99
PID 4864 wrote to memory of 3568	4864	48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe	99
PID 3568 wrote to memory of 4808	3568	cmd.exe	101
PID 3568 wrote to memory of 4808	3568	cmd.exe	101
PID 3568 wrote to memory of 3716	3568	cmd.exe	102
PID 3568 wrote to memory of 3716	3568	cmd.exe	102
PID 3568 wrote to memory of 3924	3568	cmd.exe	107
PID 3568 wrote to memory of 3924	3568	cmd.exe	107

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f_NeikiAnalytics.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\bpuc3WXTIJ.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3568
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:4808
- - C:\Windows\system32\PING.EXE
    ping -n 10 localhost
    3⤵
    - Runs ping.exe
    PID:3716
- - C:\Windows\Offline Web Pages\fontdrvhost.exe
    "C:\Windows\Offline Web Pages\fontdrvhost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3924

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 5 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4932

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:5008

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Recovery\WindowsRE\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1116

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 5 /tr "'C:\Windows\Offline Web Pages\fontdrvhost.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1020

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\Offline Web Pages\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1644

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhostf" /sc MINUTE /mo 11 /tr "'C:\Windows\Offline Web Pages\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2464

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 10 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4696

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 14 /tr "'C:\Recovery\WindowsRE\SppExtComObj.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:2460

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 6 /tr "'C:\Windows\Setup\State\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3512

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\Setup\State\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Windows\Setup\State\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:3852

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 7 /tr "'C:\Windows\Sun\Idle.exe'" /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:4372

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "Idle" /sc ONLOGON /tr "'C:\Windows\Sun\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:1736

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 13 /tr "'C:\Windows\Sun\Idle.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Scheduled Task/Job: Scheduled Task
PID:372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bpuc3WXTIJ.bat

Filesize
172B

MD5
268d092dbfaf7483e879a719d5f04a56

SHA1
ae27d1f4bfc45c07fcabe89de9c3822020a8b64d

SHA256
1703396dec81a35ccce78551862442aa740132df6433b8eec5de3041e44599b6

SHA512
08983141687f93f8e583649a55e2aa09a1fbfc2141e14f2ff4ef538342d14a0d6c8d3a0d0ff26917c4b7d7b241a842db3b5ecaec569c7bdac2e6cd3fdc4a7f4a

Download Submit
C:\Windows\Sun\Idle.exe

Filesize
1.9MB

MD5
fa307f68bd87260456ada24f7e6ace90

SHA1
12a15df3b9de4292583faf78ecfc054ba9159be0

SHA256
48e774dee2ab013d234248931f7c8e822e14c5d21ce9fb543933e6c2252f5b0f

SHA512
a2632f212eb92b2d4d35cc10b9b7985aa64a865206ed6660ade885d6b6e0c79f85e17b8da8848684168f479a738ceb65beef52f4b46e7923ed299d674f5ca809

Download Submit
memory/4864-19-0x000000001B4E0000-0x000000001B4EE000-memory.dmp

Filesize
56KB

Download
memory/4864-14-0x0000000002960000-0x000000000296E000-memory.dmp

Filesize
56KB

Download
memory/4864-4-0x00007FFF67030000-0x00007FFF67AF1000-memory.dmp

Filesize
10.8MB

Download
memory/4864-6-0x0000000002950000-0x000000000295E000-memory.dmp

Filesize
56KB

Download
memory/4864-8-0x000000001B4A0000-0x000000001B4BC000-memory.dmp

Filesize
112KB

Download
memory/4864-9-0x00007FFF67030000-0x00007FFF67AF1000-memory.dmp

Filesize
10.8MB

Download
memory/4864-10-0x000000001B510000-0x000000001B560000-memory.dmp

Filesize
320KB

Download
memory/4864-12-0x000000001B4C0000-0x000000001B4D8000-memory.dmp

Filesize
96KB

Download
memory/4864-17-0x0000000002970000-0x000000000297E000-memory.dmp

Filesize
56KB

Download
memory/4864-20-0x00007FFF67030000-0x00007FFF67AF1000-memory.dmp

Filesize
10.8MB

Download
memory/4864-3-0x00007FFF67030000-0x00007FFF67AF1000-memory.dmp

Filesize
10.8MB

Download
memory/4864-0-0x0000000000580000-0x0000000000774000-memory.dmp

Filesize
2.0MB

Download
memory/4864-15-0x00007FFF67030000-0x00007FFF67AF1000-memory.dmp

Filesize
10.8MB

Download
memory/4864-21-0x00007FFF67030000-0x00007FFF67AF1000-memory.dmp

Filesize
10.8MB

Download
memory/4864-2-0x00007FFF67030000-0x00007FFF67AF1000-memory.dmp

Filesize
10.8MB

Download
memory/4864-32-0x00007FFF67030000-0x00007FFF67AF1000-memory.dmp

Filesize
10.8MB

Download
memory/4864-34-0x00007FFF67030000-0x00007FFF67AF1000-memory.dmp

Filesize
10.8MB

Download
memory/4864-35-0x00007FFF67030000-0x00007FFF67AF1000-memory.dmp

Filesize
10.8MB

Download
memory/4864-36-0x00007FFF67030000-0x00007FFF67AF1000-memory.dmp

Filesize
10.8MB

Download
memory/4864-37-0x00007FFF67030000-0x00007FFF67AF1000-memory.dmp

Filesize
10.8MB

Download
memory/4864-43-0x00007FFF67030000-0x00007FFF67AF1000-memory.dmp

Filesize
10.8MB

Download
memory/4864-1-0x00007FFF67033000-0x00007FFF67035000-memory.dmp

Filesize
8KB

Download