neshta | 3dd40cca786c621b9883bad5ea44257468dba3b2892d78190a09c72c51f38304

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02-07-2024 05:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

server.vbe
Size

1.1MB
MD5

44fb327da402e69994ffac915d1d555c
SHA1

0edfb246b38b2f485ace4b7ea3da444080b486c3
SHA256

30df4612deed312396df9a87b4b1b1c777f4e3fa3d7defebd7947586b7d43806
SHA512

03ac6b1c9a13757e75aab121266eee8a92e0e117c0719a0008a433cb6afa7704f3f0006508f78966bca485958df9cea3e7d9ec4e6230cc9e9a036ac6ccd08727
SSDEEP

24576:xMydSNpU0/rrHAcvg+jiEPBrD5JQo3xF8srpIUTC:xNEZB/C

Score

10^/10

neshta predatorstealer collection discovery persistence spyware stealer

Malware Config

Signatures

Detect Neshta payload 54 IoCs

resource	yara_rule
behavioral6/files/0x000f000000023230-4.dat	family_neshta
behavioral6/memory/708-25-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral6/memory/708-26-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral6/memory/708-33-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral6/files/0x000700000002324e-44.dat	family_neshta
behavioral6/files/0x0004000000009f86-52.dat	family_neshta
behavioral6/memory/708-84-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral6/memory/3136-87-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral6/files/0x0002000000020144-92.dat	family_neshta
behavioral6/files/0x0001000000021311-110.dat	family_neshta
behavioral6/files/0x0001000000021310-109.dat	family_neshta
behavioral6/files/0x0001000000021312-112.dat	family_neshta
behavioral6/files/0x0001000000022d67-114.dat	family_neshta
behavioral6/files/0x0001000000022d62-119.dat	family_neshta
behavioral6/files/0x0001000000022d66-125.dat	family_neshta
behavioral6/files/0x000100000001e7f9-141.dat	family_neshta
behavioral6/files/0x000100000001e7b4-145.dat	family_neshta
behavioral6/files/0x000100000001e7c1-151.dat	family_neshta
behavioral6/files/0x000100000001e714-159.dat	family_neshta
behavioral6/files/0x000100000001e729-164.dat	family_neshta
behavioral6/files/0x000100000001e724-163.dat	family_neshta
behavioral6/files/0x000100000001e716-160.dat	family_neshta
behavioral6/files/0x000100000001e7b9-169.dat	family_neshta
behavioral6/files/0x000100000001e7b2-167.dat	family_neshta
behavioral6/files/0x000100000001e7ba-170.dat	family_neshta
behavioral6/files/0x000100000001e7c8-172.dat	family_neshta
behavioral6/files/0x000100000001df3f-181.dat	family_neshta
behavioral6/files/0x0001000000022ce8-191.dat	family_neshta
behavioral6/memory/708-193-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral6/files/0x000b00000001ee5c-198.dat	family_neshta
behavioral6/memory/3136-207-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral6/files/0x000200000000072d-222.dat	family_neshta
behavioral6/files/0x000200000002141c-223.dat	family_neshta
behavioral6/files/0x000400000001e90c-226.dat	family_neshta
behavioral6/files/0x000800000001da4b-225.dat	family_neshta
behavioral6/files/0x000500000001e969-233.dat	family_neshta
behavioral6/files/0x000c00000001e85b-232.dat	family_neshta
behavioral6/files/0x001200000001db61-231.dat	family_neshta
behavioral6/files/0x000500000001e588-230.dat	family_neshta
behavioral6/files/0x000300000001e96f-229.dat	family_neshta
behavioral6/memory/708-234-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral6/memory/3136-235-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral6/memory/708-236-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral6/memory/3136-237-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral6/memory/708-238-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral6/memory/3136-239-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral6/memory/708-240-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral6/memory/3136-241-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral6/memory/708-242-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral6/memory/3136-243-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral6/memory/708-244-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral6/memory/3136-245-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral6/memory/708-246-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral6/memory/3136-247-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
PredatorStealer
Predator is a modular stealer written in C#.
stealer predatorstealer

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Tempwinlogon.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	Tempwinlogon.exe

Executes dropped EXE 4 IoCs

pid	Process
708	Tempwinlogon.exe
1796	Tempwinlogon.exe
3136	svchost.com
3252	Zip.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	Tempwinlogon.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Tempwinlogon.exe
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Tempwinlogon.exe
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Tempwinlogon.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Defender Updater = "C:\\Users\\Admin\\AppData\\Local\\Temp\\update_240205.exe / start"	Tempwinlogon.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
24	ip-api.com

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~3\PACKAG~1\{FB050~1\WINDOW~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\elevation_service.exe	Tempwinlogon.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\pwahelper.exe	Tempwinlogon.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	Tempwinlogon.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	Tempwinlogon.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	Tempwinlogon.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	Tempwinlogon.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	Tempwinlogon.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\msedge_proxy.exe	Tempwinlogon.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	Tempwinlogon.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.17\MI391D~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe	Tempwinlogon.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE	Tempwinlogon.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\BHO\ie_to_edge_stub.exe	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\cookie_exporter.exe	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\MicrosoftEdgeUpdate.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	Tempwinlogon.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	svchost.com
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	Tempwinlogon.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\Download\{F3C4F~1\13185~1.17\MICROS~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	Tempwinlogon.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{17316~1\WINDOW~1.EXE	Tempwinlogon.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE	Tempwinlogon.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\BHO\ie_to_edge_stub.exe	Tempwinlogon.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	Tempwinlogon.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.17\MICROS~3.EXE	svchost.com
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\msedge_proxy.exe	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\msedge_pwa_launcher.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	Tempwinlogon.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	Tempwinlogon.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOBD5D~1.EXE	Tempwinlogon.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\msedge.exe	Tempwinlogon.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	Tempwinlogon.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	Tempwinlogon.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	svchost.com
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	Tempwinlogon.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	Tempwinlogon.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~4.EXE	Tempwinlogon.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\msedge.exe	svchost.com
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	Tempwinlogon.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	svchost.com
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	svchost.com
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	Tempwinlogon.exe
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.17\MICROS~4.EXE	Tempwinlogon.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.17\MI391D~1.EXE	Tempwinlogon.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.17\MICROS~2.EXE	Tempwinlogon.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE	svchost.com
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.151\GOF5E2~1.EXE	Tempwinlogon.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	Tempwinlogon.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	Tempwinlogon.exe
File opened for modification	C:\Windows\directx.sys	svchost.com
File opened for modification	C:\Windows\svchost.com	svchost.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 2 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	Tempwinlogon.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	Tempwinlogon.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1796	Tempwinlogon.exe
1796	Tempwinlogon.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1796	Tempwinlogon.exe
Token: SeDebugPrivilege	3252	Zip.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 708	4596	WScript.exe	93
PID 4596 wrote to memory of 708	4596	WScript.exe	93
PID 4596 wrote to memory of 708	4596	WScript.exe	93
PID 708 wrote to memory of 1796	708	Tempwinlogon.exe	97
PID 708 wrote to memory of 1796	708	Tempwinlogon.exe	97
PID 1796 wrote to memory of 3136	1796	Tempwinlogon.exe	102
PID 1796 wrote to memory of 3136	1796	Tempwinlogon.exe	102
PID 1796 wrote to memory of 3136	1796	Tempwinlogon.exe	102
PID 3136 wrote to memory of 3252	3136	svchost.com	103
PID 3136 wrote to memory of 3252	3136	svchost.com	103

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Tempwinlogon.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Tempwinlogon.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\server.vbe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Users\Admin\AppData\Local\Tempwinlogon.exe
  "C:\Users\Admin\AppData\Local\Tempwinlogon.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies system executable filetype association
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:708
- - C:\Users\Admin\AppData\Local\Temp\3582-490\Tempwinlogon.exe
    "C:\Users\Admin\AppData\Local\Temp\3582-490\Tempwinlogon.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    - outlook_office_path
    - outlook_win_path
    PID:1796
  - - C:\Windows\svchost.com
      "C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\Zip.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:3136
    - - C:\Users\Admin\AppData\Local\Temp\Zip.exe
        
        C:\Users\Admin\AppData\Local\Temp\Zip.exe
        5⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:3252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3592 --field-trial-handle=2356,i,13261194862334667799,7441241219475888176,262144 --variations-seed-version /prefetch:8
1⤵
PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE

Filesize
494KB

MD5
3ad3461ef1d630f38ed3749838bbedc3

SHA1
8d85b0b392ae75c5d0b004ee9cf5a7b80b1b79e6

SHA256
32be2bca2b848da78c02140a288f1bb771cb66757f90d20126b1bcfd5bb40e62

SHA512
0e95e5181eab14d5820a3a4952018ac9b290fa3b17add8a5e13d893052f1d2a90a2323c62843f6a9e9af00f27e00108b60e0bce2f848e0a4d8ce0cce153db1ba

Download Submit
C:\PROGRA~2\COMMON~1\Oracle\Java\JAVAPA~1\java.exe

Filesize
366KB

MD5
b0152d6bc8f286f34e23849c85c04840

SHA1
f97b4f87b1a7bc33abd3bf9fcad4e65d8b703f32

SHA256
22057bedcf7f73b29bfc113e16f8798adce3ac88462e96174c03af175f832ab5

SHA512
98bc6189752af61f887e50f8bd86719d109a5e08b333472692c610779fc808d71c2188b4c952310f82b0e7adbd1ab4ed3a98902815070b2c7b741a422d9227ba

Download Submit
C:\PROGRA~2\COMMON~1\Oracle\Java\JAVAPA~1\javaw.exe

Filesize
366KB

MD5
a86afb3fa465bf9bb4d8a55ee58c6a07

SHA1
d3c83ae5232ea99b3779e8ac2edb728988f86668

SHA256
4768e8061e174c132cff83bf39d46390e8118a4c71d25bfafb827b910b003acb

SHA512
70d0521fe17502002299745c89b9551019f9026ca658c24244a6a389cedd65de5aa05198bb1bca1fd0a0741c524c6b58ec1cb31201c2652ef1e7b40e91ba0391

Download Submit
C:\PROGRA~2\COMMON~1\Oracle\Java\JAVAPA~1\javaws.exe

Filesize
546KB

MD5
2fbf8e73fc690c57c64459cb4c349ddb

SHA1
1038053aff4e542a8dbb77fc4d100fe083493e50

SHA256
408ad7354171bc8d51846bbe8238e8fbd6a5bf9b0b12b3f55b43f61e03371bf2

SHA512
7e29b6ae75865dc9e7004665f6c90513e5b8f593509cbd209f523ea5602ea9e242ef1fee867f8d293781a51fa816d502456bbe97414de2e7ecbc6f6f640a49fc

Download Submit
C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~1.EXE

Filesize
248KB

MD5
6a57dc8a285dc9738c88e78fba506d22

SHA1
6c7fbb72d162b60ae27df884aa379c9e41ecbf9d

SHA256
b3c0c2c2eba96fb385979636c2593d7322ef3d72a6d67cad4bb9ef64f7eb4699

SHA512
4d559ded8758ce92b4f2bb7ad819873aa6fcb4f351e1aec820d49ba87cb840a593f9c6dca6f5244bbe4748b9f1c623e981ba0e77ad57e1364a1876f6fc3a88f1

Download Submit
C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~2.EXE

Filesize
305KB

MD5
20d724819f31bd89107b7b930ea01f7c

SHA1
ec65940fe3e30d3309e232267c000cefc047e42e

SHA256
41d6a7e9725262e1c055b5979b4e9ab4b5585e5f3760c3edd5f175552713b365

SHA512
16dc256250c81df50a5e270c5a9c24dbfd9a04c258218e0cb96179011b4724426917b16c7fa0f87941f4ab7e4150c6a7bbab4dd11fac1c8ddde2602d2d259fec

Download Submit
C:\PROGRA~2\Google\Update\1336~1.151\GOOGLE~3.EXE

Filesize
383KB

MD5
ced8e6dcb29f4ebfe22640cead56262a

SHA1
b62ef32054b8732f9605fac30de49f6b1a885839

SHA256
b8a4176459b2c6f1647d223381c5ce36454a2becace419397e2fa3fbd493c7f5

SHA512
65e521b5703349a5ebf3235b48d0148c5d81558a1acac16509aae1aac7b95d95019a91f341f22cdd09736a154177778fbcd9d29a2f6cc12329209495d8d90c03

Download Submit
C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.17\MI9C33~1.EXE

Filesize
179KB

MD5
8ffc074117472a10689ab8daf08b6f42

SHA1
841ba4ed0498c22e73559d5244755c01b1a7646c

SHA256
63b456f3324fd719288ccc4eaa80ed8d7d21fc5677785e2e58ea92874e48369c

SHA512
65021aa66b0117c9cfcbd27c406daaf8de4767c40d2a9c30d048301e3d0a826c2b4e9ea2011b6882282d6274976a5e846549c6fcc920ecf05420f1ebd2f22c8b

Download Submit
C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.52\BHO\IE_TO_~1.EXE

Filesize
555KB

MD5
46bda7f4ac4ec1457af4aceec4b0951e

SHA1
9038a90a2b4f6363fd20dc45984405e1d1e2a2d6

SHA256
5eb1cd925ce4a5c5dd035a0de64bb7249303e53d1efff96ea510b0930470524f

SHA512
36e917760e250ad7550b73b20471c5c8264a6ab12984e95d4bba1f3f15602aa8ac1acbb0af3fa8fbd9aba80f002eeb444d1fb49a6d64b720e5368a7a8ce58465

Download Submit
C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.52\COOKIE~1.EXE

Filesize
157KB

MD5
fe0269e24575d8a8590185540f7b4f6c

SHA1
e133f0f269ac97b93caf93fe6f7ecf55e929cef1

SHA256
1b3d321b505dd2f13e8b669f554b31e6e00f5a5ab4f98160a8f7a0dd96c3b9fa

SHA512
b30ce7aad664d2ad7ad9ff046e16a80bbf13caa70c981c12ee164f45f570b7e2013dacb630d6341ee67d4821519a9c33277f2801ad87521329b984e66873e6c0

Download Submit
C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.52\ELEVAT~1.EXE

Filesize
1.7MB

MD5
00b64ce89ccd175bdc98aad0caa8adf8

SHA1
64b390e4ce6a7003d5849377b88bc79ca92e9dbd

SHA256
39d3548699012bbb15d0f6f42e3794490f3355696bc15b8d51bb332402039ab3

SHA512
4b0d43963ecea351f123abdbc782d6fae24b0c60864ab317ae1652647cc737ab7c0fca9bb229637658d0bb4e8940450d665b45f1359f684a087740e900534a0e

Download Submit
C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.52\IDENTI~1.EXE

Filesize
1.2MB

MD5
ef77cadf63f42b65cd2df14f91e51430

SHA1
7054e0a49727ae03bd1f67ca34004741cabd4475

SHA256
051b163153ed9f6506c5b5b0ca3adc8ca623a61cfbe73c398829568b0b27ca93

SHA512
193a04d1c52b4edb98e20c01c041553d2139ad0859b66e71bae983a54c39cda2a2f0ffd45cb88dba0b740776c8d4d75a4aad43e7b9ae0adf581c8b6e6af99b68

Download Submit
C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.52\MSEDGE~2.EXE

Filesize
1.2MB

MD5
7f88f3f90ac64568f91d7886f56ff0b6

SHA1
2ef4a4496c09928a09da0af641e3c092ade4f03b

SHA256
1dc1ebb5939a050cd9eff7b7011afbf877cb33f21950fff127d7481f3e9d38b2

SHA512
412345a84eeffd2ddd1bd66230d4eef5fa29e35891a4b5f329626f4b557fb2fc972f05f131b8c4c94c8296c774545b288da7ba2fda93e6654733a03d247f33e3

Download Submit
C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.52\MSEDGE~3.EXE

Filesize
1.6MB

MD5
fc11ab97d3331bd8d60bdd61d8205502

SHA1
a725615f45cad179bde8ca81883c08d97d869148

SHA256
1798654a8b209222ba862ad554d19cfc0cd056db2a3c8e9f2a3a0ee52bea1436

SHA512
a00b81263a42018bf511b95dae2cc589aa4502473c1d61a07fd4cb8f30f4e54018d00aa88d6d33f4d45dbdf3e533e367c26bf61128fb1343842eda5cb46b40c0

Download Submit
C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.52\PWAHEL~1.EXE

Filesize
1.2MB

MD5
a6ecae26a916771319a3217563e320d7

SHA1
7addd2c0f618f06486f610364135c646ff05812d

SHA256
864dcf4f72bb6d690ba64f6c4b4523a693830f7dbcd6e2b61203cacb5dc0a556

SHA512
22dfe586067f1ae75c550a4187ecdd7d65f1d9e65b52b7e782a4c06f5d4dc2f410ddc7f18bdbebffe19efce9397c65f7f1a99b757ffc56f4f4efc77dd8f31697

Download Submit
C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.52\msedge.exe

Filesize
3.9MB

MD5
5d756a0168c787760258a53087193fcd

SHA1
3a1190370ec84df9cbc2d0b8dc2c3c040268e667

SHA256
4dcb3cc3b7e87ea4fdfe524d5d24a32eab1f87f1d477620879edbf8ac99c25d8

SHA512
213c39edbce4602f5e2882ba39d59ab51552b5e1c384c5e274addf3ddaafecd50fd9763a888fac7b406f136dcca63ca29a696ba407ae5e1e0446bee95ad24af4

Download Submit
C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\INSTAL~1\setup.exe

Filesize
6.9MB

MD5
0727361d4c5123a1016523834e59752e

SHA1
402dae10eafa45586443097ac900a1de7cf410fa

SHA256
94b567d46e3278cee68db82521b2b5eecb9d79e4868dc8af3f639188da0b8410

SHA512
5f2e42057c5fd0e089471d9701883ceddc8e0797187a794d59a1360619f516c8e122a95437aa38752e5f0fb5496b84efb0d977c24732ed0bc68b1d672b75be84

Download Submit
C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\msedgewebview2.exe

Filesize
3.5MB

MD5
a4b214a072e3b243c4ebc478e6eb36a7

SHA1
03d0e04d345971141a1cd5f56e31e7f8480974f7

SHA256
77411e2933273fb7b04fd0dec90ea0a620b2293b6fbdbd5c29afa0cd7536fa51

SHA512
e32edd286477a52cbeaea9a0d20c49328bf78e86698620cee8c6900b672c0cc7feed5d2a5426770e9c2c70fe2a339814db4468d9fc960070e61e928ca3866a8d

Download Submit
C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\122023~1.52\notification_helper.exe

Filesize
1.4MB

MD5
693243503490f534b5a8169522b1f20c

SHA1
225e8e201dc5aca29119b3f8ee28f7936fbe1144

SHA256
fd7565ee880050cdd2fe34f9762dad1f47579ba99eef8a3ffa66f8af289de7bd

SHA512
934c40f58dc38daba2f6f4d4542c6b7e560ba2e7e693bbf668f5847e97beab6f027d2b826742ecf5e92eec1d6b50545ab1c5026d62a18b4266ef063e571b8b72

Download Submit
C:\PROGRA~2\MOZILL~1\UNINST~1.EXE

Filesize
181KB

MD5
a471aeae6a5ecdbdf978d076551228ad

SHA1
7ae57187319530e84371cefac2271db349431f4e

SHA256
d621284d9f534a8dfb275e2c8d1cd39bb46c025ec687e48e053309e633195944

SHA512
f9840c8f6bdadbf1da8ee7f1806902f7ab37b6d0d531fdb922f409e96a407bc2017541848f5cb9645201a252640d97024c57f5b2b3f6a57dc1bff30874b368a5

Download Submit
C:\PROGRA~3\PACKAG~1\{17316~1\WINDOW~1.EXE

Filesize
691KB

MD5
82ff4ff2a82092323145a1e2681ec337

SHA1
26c4d69e0cfba7e972b693b9f60adad8ef8f72a3

SHA256
10b0b2097e86b216f43d1747fa3390ca5bf1e219dfc5a3d777f2347056684dfd

SHA512
ed95243cac1c090fc5ebbe290f0b1a08353500f4a129e63523e27f3d2fab1ed9ac2aec7a9af442b8124ce1fcd045a327a85e324659af1e9d2a41323790f5461f

Download Submit
C:\Users\ALLUSE~1\Adobe\Setup\{AC76B~1\setup.exe

Filesize
534KB

MD5
8a403bc371b84920c641afa3cf9fef2f

SHA1
d6c9d38f3e571b54132dd7ee31a169c683abfd63

SHA256
614a701b90739e7dbf66b14fbdb6854394290030cc87bbcb3f47e1c45d1f06c3

SHA512
b376ef1f49b793a8cd8b7af587f538cf87cb2fffa70fc144e1d1b7e2e8e365ba4ad0568321a0b1c04e69b4b8b694d77e812597a66be1c59eda626cbf132e2c72

Download Submit
C:\Users\ALLUSE~1\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE

Filesize
6.7MB

MD5
32853955255a94fcd7587ca9cbfe2b60

SHA1
c33a88184c09e89598f0cabf68ce91c8d5791521

SHA256
64df64b39ac4391aea14eb48b0489e6a970a3ea44c02c6a8f10c278cc0636330

SHA512
8566b69668729d70567ff494de8f241329baf2a7748ab0ebf5a53308c3e53e646100af4f6fc33325f3851030d11ff045a7e85e5897008e95c991990d8f80a997

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{33D1F~1\VCREDI~1.EXE

Filesize
526KB

MD5
cc5020b193486a88f373bedca78e24c8

SHA1
61744a1675ce10ddd196129b49331d517d7da884

SHA256
e87936bb1f0794b7622f8ce5b88e4b57b2358c4e0d0fd87c5cd9fa03b8429e2a

SHA512
bc2c77a25ad9f25ac19d8216dafc5417513cb57b9984237a5589a0bb684fdac4540695fcfb0df150556823b191014c96b002e4234a779bd064d36166afeb09d2

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{4D8DC~1\VC_RED~1.EXE

Filesize
714KB

MD5
24179b4581907abfef8a55ab41c97999

SHA1
e4de417476f43da4405f4340ebf6044f6b094337

SHA256
a8b960bcbf3045bedd2f6b59c521837ac4aee9c566001c01d8fc43b15b1dfdc7

SHA512
6fb0621ea3755db8af58d86bdc4f5324ba0832790e83375d07c378b6f569a109e14a78ed7d1a5e105b7a005194a31bd7771f3008b2026a0938d695e62f6ea6b8

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{57A73~1\VC_RED~1.EXE

Filesize
715KB

MD5
4e8b1a54dabe6aaef26fdf8f76333a1f

SHA1
57c47f539bb89aa863391bde59a802673fe5abac

SHA256
263e6c6a5f9b939101b66c069ed4d0266959d9f4b17deb2a0faa06759c136000

SHA512
04802988333f8e95cd6288b6cc303ea5068e1eb1daae042e539df6fdcc867f95b147a7c3fd587fe623d7c9f205ba6627fc62aaea177c9abb1a8e24f62b591697

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{61087~1\VCREDI~1.EXE

Filesize
536KB

MD5
31685b921fcd439185495e2bdc8c5ebf

SHA1
5d171dd1f2fc2ad55bde2e3c16a58abff07ae636

SHA256
4798142637154af13e3ed0e0b508459cf71d2dc1ae2f80f8439d14975617e05c

SHA512
04a414a89e02f9541b0728c82c38f0c64af1e95074f00699a48c82a5e99f4a6488fd7914ff1fa7a5bf383ce85d2dceab7f686d4ee5344ab36e7b9f13ceec9e7f

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{CA675~1\VCREDI~1.EXE

Filesize
525KB

MD5
a55d2c94c27ffe098171e6c1f296f56d

SHA1
d0c875b2721894404c9eaa07d444c0637a3cbc3b

SHA256
e81e4630b01d181fb3116e9e874eedfe1a43472bfa6d83cc24f55e78721ddf86

SHA512
13ee9041b21d4e00392aeaa5440c34301f945d9bbd4f07f831397040991eee79842a5618c1fd26ec75e7132b5da811bc9605b76b83a48355ede37a2a1c1cd6f0

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{EF6B0~1\VCREDI~1.EXE

Filesize
536KB

MD5
3e8de969e12cd5e6292489a12a9834b6

SHA1
285b89585a09ead4affa32ecaaa842bc51d53ad5

SHA256
7a25fc3b1ce0f1d06a84dd344c8f5a6c4604732f7d13a8aaad504c4376b305cf

SHA512
b14a5936181a1d8c0f966d969a049254238bf1eacdb1da952c2dc084d5d6dcd5d611d2d058d4c00d6384c20046deef5e74ea865c0062bb0761a391a1eaf1640e

Download Submit
C:\Users\ALLUSE~1\PACKAG~1\{FB050~1\WINDOW~1.EXE

Filesize
650KB

MD5
727ed26760e3d496094a75db0d5235be

SHA1
667cf86b708829a885594bf6d6281f29a3056974

SHA256
34f8011c28acc9dd99eba0cb7347583f7e53aeb332eee257886673cd3e64584c

SHA512
4256c25b66cf0093ae5ac3b137e8519ba04f8315ed9d74a5ae1b0ec0e3bb3e2cbbc9b5efe2b75d82b120d63a487b7d1f2b7241f094fa6118a5133cbfd9077138

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\Tempwinlogon.exe

Filesize
536KB

MD5
af18fa94837c18a2ff3634967da9c00a

SHA1
7ecf8c716171a4e46199a1ba8f780ca41ad8fd42

SHA256
f219846f86904447f6a1d4e3c7f906b930be01c0862147e7fcd2394f94027bad

SHA512
b80464d996273ceef749ffe34a7859f21466a4d2d23acc50303c7d9b398623b309b26eab166dd5741155f30378bb8daa79d6d2d3dedbe0cab97bf06ef08834a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\GB_BFEBFBFF00090672.zip

Filesize
418KB

MD5
c1ac7017602cb6b18e7c667a5067dabe

SHA1
679a3f4f3195505af783f38b4117c14887d00233

SHA256
f700eacd4e2843c47cadca566419210ec747ff085b2596b6fe34f2381e63da2a

SHA512
52b39d3110eba99cb474604c1881b125524549266cdee530273a9f02235a9f3949105338ca1abbb65732c68ee9477dc7b72987b8fab64d9b092eb187f1910cc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\GB_BFEBFBFF00090672\ProgramList.txt

Filesize
2KB

MD5
cfe18367f0cd09ecc89e4dec41435205

SHA1
c6f7c17d06b8fcecab9034bae5f3ba23689cfb9b

SHA256
86bcda1f2679269abe24d399316b5b7542deb1acdc3d89f100f367917b9fba4e

SHA512
bd3a517c8c687b6b9a62fb2f5c239575f825cbd13ae298c174285bb6ab882c9753498756b0888e34753d64999882cd3771bd65943653b768ffefae314b8dd8a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\GB_BFEBFBFF00090672\ProsessList.txt

Filesize
1KB

MD5
5e624eaa52c9a0d4b68b19946e971192

SHA1
83f3cec62ff18c3d3584e00c9f3b98b71745d318

SHA256
837d6222143f8531bf504989ee201b53d0b4ed414ecc7601b89e8fe84798b204

SHA512
5361bde8c05ccc46b4699bf7217278524ce69acd326277ceec89629908563b0240a581b1bc50d9da7e7ee86aeafb3590a0607b881270ff2446a84849b8b41a90

Download Submit
C:\Users\Admin\AppData\Local\Temp\GB_BFEBFBFF00090672\Screenshot.png

Filesize
419KB

MD5
8778a7ec61bca2540e7ac973bf622b74

SHA1
051d61a23e26d8ae85c387aaa3e2ed0177cbbd0e

SHA256
60c252e8bedba9610f0723bf355297c595938beb0a5d4a95c282e6487cca38be

SHA512
789c71d792d5be6e8041495d14577670e1572b929550ee85458a0fe66829596d40500834aedcc72b355b9f63347a285c360c244cba4bbc4174fdaf32c02cd705

Download Submit
C:\Users\Admin\AppData\Local\Temp\GB_BFEBFBFF00090672\info.txt

Filesize
315B

MD5
5124ab27f5a1645b33329b07656cb47f

SHA1
73b7bcc67759f3b7128f9c0fc4d399579a6e4eea

SHA256
6e9b8deae94f6cede267f37748d6b7bdefa5809dad1f4a1caaf5573ab1018a3f

SHA512
54e99a97e880832b09a1e3c45912ea540d31e424ac15b2b26c690c4f1b6bd79469db2cd13aa702446ec8286ab0627c42ade2331390676bc881ef90f3ac4f7aa3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Zip.exe

Filesize
31KB

MD5
af07e88ec22cc90cebfda29517f101b9

SHA1
a9e6f4ae24abf76966d7db03af9c802e83760143

SHA256
1632fbff8edc50f2c7ef7bb2fe9b2c17e6472094f0d365a98e0dec2a12fa8ec2

SHA512
b4575af98071fc8d46c022e24bfb2c1567d7e5f3de0d8fb5fee6f876985c7780a5b145f645725ff27a15367162aa08490ac2f8dd59d705663094fe4e1eeec7bc

Download Submit
C:\Users\Admin\AppData\Local\Tempwinlogon.exe

Filesize
577KB

MD5
f9330a18b7aee16a7f167d0d0a8f4a60

SHA1
1341533d0f67aa8866d141028310a374e257e7e2

SHA256
4d9cf0e60b2fe13cc8f5dd36e1b0e771d6b6e001e5f95c5a3dede78cdcdbd01c

SHA512
8141da7a5d651dfae69879adba492e9b0bff4406b8e233d5c468ace1a700d248f16bb6697b703c124957829b0b8e3cb64bf89714c422a63ecfc9516136aebdff

Download Submit
C:\Windows\svchost.com

Filesize
40KB

MD5
aa962d6ec2961e8b1ba5739ddeb2e4b4

SHA1
c5aed4ad464c5720010ef764247a36721048c72f

SHA256
60cd79482f561687b17f8e4ab37bd42f69d431f93cd1b8ed4eb913be0e37fdb9

SHA512
3085c38208c7c134a7d58846322bbe4c717f9710cf22dd0aadc7402c2943d521637b5b8dfbfe8e01de3052504765544fa542e50dfb9d6989c8f92cdc4a00ecad

Download Submit
C:\odt\OFFICE~1.EXE

Filesize
5.1MB

MD5
02c3d242fe142b0eabec69211b34bc55

SHA1
ea0a4a6d6078b362f7b3a4ad1505ce49957dc16e

SHA256
2a1ed24be7e3859b46ec3ebc316789ead5f12055853f86a9656e04b4bb771842

SHA512
0efb08492eaaa2e923beddc21566e98fbbef3a102f9415ff310ec616f5c84fd2ba3a7025b05e01c0bdf37e5e2f64dfd845f9254a376144cc7d827e7577dbb099

Download Submit
memory/708-240-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/708-242-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/708-33-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/708-193-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/708-238-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/708-236-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/708-26-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/708-25-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/708-234-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/708-244-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/708-84-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/708-246-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1796-23-0x000000001BC10000-0x000000001BDD2000-memory.dmp

Filesize
1.8MB

Download
memory/1796-31-0x00007FFFA4583000-0x00007FFFA4585000-memory.dmp

Filesize
8KB

Download
memory/1796-22-0x0000000000C00000-0x0000000000C8C000-memory.dmp

Filesize
560KB

Download
memory/1796-24-0x000000001CA10000-0x000000001CF38000-memory.dmp

Filesize
5.2MB

Download
memory/1796-20-0x00007FFFA4583000-0x00007FFFA4585000-memory.dmp

Filesize
8KB

Download
memory/3136-235-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3136-237-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3136-207-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3136-239-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3136-245-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3136-241-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3136-247-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3136-243-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3136-87-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3252-51-0x0000019B3ADE0000-0x0000019B3ADF0000-memory.dmp

Filesize
64KB

Download
memory/3252-54-0x0000019B556A0000-0x0000019B556B2000-memory.dmp

Filesize
72KB

Download
memory/3252-53-0x0000019B55350000-0x0000019B5535A000-memory.dmp

Filesize
40KB

Download