Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

03/07/2024, 17:18

240703-vvk8hazcqq 10

03/07/2024, 16:20

240703-ts74tatfpm 8

Analysis

  • max time kernel
    1792s
  • max time network
    1764s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240611-en
  • submitted
    03/07/2024, 17:18

General

  • Target

    Mia_Khalifia(18+).exe

  • Size

    4.2MB

  • MD5

    9c6352ad45c6ce5ab18f75f4fcf3c85d

  • SHA1

    3908a22b5a4dceedc813b0deded861fdbc9ae6fb

  • SHA256

    c00280f16aa9c12f6a8a7f29c493f17c237e570ae1fe481d368ea0ab4eafedf5

  • SHA512

    ba2d87ea0c656b6b3de4075e465b8b5c991c89a32446c460ede9052e7b9ea7b64e52858971a5b620ad78393074b84cc7bcde70cf989e1de76514f3076e07f925

  • SSDEEP

    98304:mnyNQa/26tLM4OXoQCn9+juAoHsvP0mDFn169ryxbTkNW:0yNQa+OLM4eoQIiIsXnu9exHko

Malware Config

Signatures

  • D3fackloader

    D3fackloader is a loader and downloader using Inno Setup.

  • D3fackloader family
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 1 IoCs
  • Sectoprat family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

    Run Powershell and hide display window.

  • Sets file to hidden 1 TTPs 2 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Downloads MZ/PE file
  • Suspicious use of SetThreadContext 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 16 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Script User-Agent 2 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 51 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Mia_Khalifia(18+).exe
    "C:\Users\Admin\AppData\Local\Temp\Mia_Khalifia(18+).exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3172
    • C:\Users\Admin\AppData\Local\Temp\is-OV62U.tmp\Mia_Khalifia(18+).tmp
      "C:\Users\Admin\AppData\Local\Temp\is-OV62U.tmp\Mia_Khalifia(18+).tmp" /SL5="$40214,4088111,75776,C:\Users\Admin\AppData\Local\Temp\Mia_Khalifia(18+).exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1408
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" cmd /c 4554.cmd
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3704
        • C:\Windows\SysWOW64\attrib.exe
          attrib +s +h /D "C:\Users\Admin\AppData\Local\Temp\av\*.*"
          4⤵
          • Sets file to hidden
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:5024
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c tar xf 85.zip
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:928
          • C:\Windows\SysWOW64\tar.exe
            tar xf 85.zip
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2916
        • C:\Windows\SysWOW64\attrib.exe
          attrib +s +h /D "C:\Users\Admin\AppData\Local\Temp\av\*.*"
          4⤵
          • Sets file to hidden
          • System Location Discovery: System Language Discovery
          • Views/modifies file attributes
          PID:4724
        • C:\Users\Admin\AppData\Local\Temp\av\208\208.exe
          ".\208\208.exe"
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3096
          • C:\Users\Admin\AppData\Local\Temp\av\208\jre\bin\javaw.exe
            "C:\Users\Admin\AppData\Local\Temp\av\208\jre\bin\javaw.exe" -Dfile.encoding=UTF-8 -classpath "lib\.;lib\..;lib\activation.jar;lib\asm-all.jar;lib\commons-email.jar;lib\dn-compiled-module.jar;lib\dn-php-sdk.jar;lib\gson.jar;lib\jfoenix.jar;lib\jkeymaster.jar;lib\jna.jar;lib\jphp-app-framework.jar;lib\jphp-core.jar;lib\jphp-desktop-ext.jar;lib\jphp-desktop-hotkey-ext.jar;lib\jphp-gui-ext.jar;lib\jphp-gui-jfoenix-ext.jar;lib\jphp-json-ext.jar;lib\jphp-jsoup-ext.jar;lib\jphp-mail-ext.jar;lib\jphp-runtime.jar;lib\jphp-systemtray-ext.jar;lib\jphp-xml-ext.jar;lib\jphp-zend-ext.jar;lib\jphp-zip-ext.jar;lib\jsoup.jar;lib\mail.jar;lib\slf4j-api.jar;lib\slf4j-simple.jar;lib\zt-zip.jar" org.develnext.jphp.ext.javafx.FXLauncher
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2772
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
              Powershell.exe -Command "& {Start-Process Powershell.exe -WindowStyle hidden -ArgumentList '-Command "Add-MpPreference -Force -ExclusionPath "C:\""' -Verb RunAs}"
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:3468
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -Force -ExclusionPath C:"
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1328
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
              Powershell.exe -Command "& {Start-Process Powershell.exe -WindowStyle hidden -ArgumentList '-Command "Set-MpPreference -Force -DisableBehaviorMonitoring "' -Verb RunAs}"
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2504
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Set-MpPreference -Force -DisableBehaviorMonitoring
                7⤵
                • Command and Scripting Interpreter: PowerShell
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1760
            • C:\Windows\SysWOW64\explorer.exe
              explorer C:\Users\Admin\AppData\Local\Temp\YWQ0OWYxYzdkMDk3NzNlNDFhZjM3YWI1MTE2ZWI1ZTE.exe
              6⤵
              • System Location Discovery: System Language Discovery
              PID:4964
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3448
    • C:\Users\Admin\AppData\Local\Temp\YWQ0OWYxYzdkMDk3NzNlNDFhZjM3YWI1MTE2ZWI1ZTE.exe
      "C:\Users\Admin\AppData\Local\Temp\YWQ0OWYxYzdkMDk3NzNlNDFhZjM3YWI1MTE2ZWI1ZTE.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:4092
      • C:\Windows\SysWOW64\more.com
        C:\Windows\SysWOW64\more.com
        3⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:1016
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:2884

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vvttcypj.mwf.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\av\208\208.exe

    Filesize

    32KB

    MD5

    28d71cb9b027a371f2a6a67baaab53ae

    SHA1

    f301deece217e3bdd45142f5a9c469a098049e00

    SHA256

    6a23c63193a3b8cf75786b29d1d7c8a816e77a241e1892bd4c80935abc6cf502

    SHA512

    a3ac97768e1046f7bf15eb5da543660b5ef0d914b3b45976c059f019e66d637288e6cc11dfaa842d021bf3e8421f68fd144db81f684aa4f3f68e6c5608ebe799

  • C:\Users\Admin\AppData\Local\Temp\av\208\jre\bin\client\jvm.dll

    Filesize

    3.7MB

    MD5

    39c302fe0781e5af6d007e55f509606a

    SHA1

    23690a52e8c6578de6a7980bb78aae69d0f31780

    SHA256

    b1fbdbb1e4c692b34d3b9f28f8188fc6105b05d311c266d59aa5e5ec531966bc

    SHA512

    67f91a75e16c02ca245233b820df985bd8290a2a50480dff4b2fd2695e3cf0b4534eb1bf0d357d0b14f15ce8bd13c82d2748b5edd9cc38dc9e713f5dc383ed77

  • C:\Users\Admin\AppData\Local\Temp\av\208\jre\bin\java.dll

    Filesize

    123KB

    MD5

    73bd0b62b158c5a8d0ce92064600620d

    SHA1

    63c74250c17f75fe6356b649c484ad5936c3e871

    SHA256

    e7b870deb08bc864fa7fd4dec67cef15896fe802fafb3009e1b7724625d7da30

    SHA512

    eba1cf977365446b35740471882c5209773a313de653404a8d603245417d32a4e9f23e3b6cd85721143d2f9a0e46ed330c3d8ba8c24aee390d137f9b5cd68d8f

  • C:\Users\Admin\AppData\Local\Temp\av\208\jre\bin\javaw.exe

    Filesize

    187KB

    MD5

    48c96771106dbdd5d42bba3772e4b414

    SHA1

    e84749b99eb491e40a62ed2e92e4d7a790d09273

    SHA256

    a96d26428942065411b1b32811afd4c5557c21f1d9430f3696aa2ba4c4ac5f22

    SHA512

    9f891c787eb8ceed30a4e16d8e54208fa9b19f72eeec55b9f12d30dc8b63e5a798a16b1ccc8cea3e986191822c4d37aedb556e534d2eb24e4a02259555d56a2c

  • C:\Users\Admin\AppData\Local\Temp\av\208\jre\bin\msvcp120.dll

    Filesize

    444KB

    MD5

    fd5cabbe52272bd76007b68186ebaf00

    SHA1

    efd1e306c1092c17f6944cc6bf9a1bfad4d14613

    SHA256

    87c42ca155473e4e71857d03497c8cbc28fa8ff7f2c8d72e8a1f39b71078f608

    SHA512

    1563c8257d85274267089cd4aeac0884a2a300ff17f84bdb64d567300543aa9cd57101d8408d0077b01a600ddf2e804f7890902c2590af103d2c53ff03d9e4a5

  • C:\Users\Admin\AppData\Local\Temp\av\208\jre\bin\msvcr100.dll

    Filesize

    755KB

    MD5

    bf38660a9125935658cfa3e53fdc7d65

    SHA1

    0b51fb415ec89848f339f8989d323bea722bfd70

    SHA256

    60c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa

    SHA512

    25f521ffe25a950d0f1a4de63b04cb62e2a3b0e72e7405799586913208bf8f8fa52aa34e96a9cc6ee47afcd41870f3aa0cd8289c53461d1b6e792d19b750c9a1

  • C:\Users\Admin\AppData\Local\Temp\av\208\jre\bin\msvcr120.dll

    Filesize

    948KB

    MD5

    034ccadc1c073e4216e9466b720f9849

    SHA1

    f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1

    SHA256

    86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f

    SHA512

    5f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7

  • C:\Users\Admin\AppData\Local\Temp\av\208\jre\bin\net.dll

    Filesize

    78KB

    MD5

    691b937a898271ee2cffab20518b310b

    SHA1

    abedfcd32c3022326bc593ab392dea433fcf667c

    SHA256

    2f5f1199d277850a009458edb5202688c26dd993f68fe86ca1b946dc74a36d61

    SHA512

    1c09f4e35a75b336170f64b5c7254a51461dc1997b5862b62208063c6cf84a7cb2d66a67e947cbbf27e1cf34ccd68ba4e91c71c236104070ef3beb85570213ec

  • C:\Users\Admin\AppData\Local\Temp\av\208\jre\bin\nio.dll

    Filesize

    50KB

    MD5

    95edb3cb2e2333c146a4dd489ce67cbd

    SHA1

    79013586a6e65e2e1f80e5caf9e2aa15b7363f9a

    SHA256

    96cf590bddfd90086476e012d9f48a9a696efc054852ef626b43d6d62e72af31

    SHA512

    ab671f1bce915d748ee49518cc2a666a2715b329cab4ab8f6b9a975c99c146bb095f7a4284cd2aaf4a5b4fcf4f939f54853af3b3acc4205f89ed2ba8a33bb553

  • C:\Users\Admin\AppData\Local\Temp\av\208\jre\bin\verify.dll

    Filesize

    38KB

    MD5

    de2167a880207bbf7464bcd1f8bc8657

    SHA1

    0ff7a5ea29c0364a1162a090dffc13d29bc3d3c7

    SHA256

    fd856ea783ad60215ce2f920fcb6bb4e416562d3c037c06d047f1ec103cd10b3

    SHA512

    bb83377c5cff6117cec6fbadf6d40989ce1ee3f37e4ceba17562a59ea903d8962091146e2aa5cc44cfdddf280da7928001eea98abf0c0942d69819b2433f1322

  • C:\Users\Admin\AppData\Local\Temp\av\208\jre\bin\zip.dll

    Filesize

    68KB

    MD5

    cb99b83bbc19cd0e1c2ec6031d0a80bc

    SHA1

    927e1e24fd19f9ca8b5191ef3cc746b74ab68bcd

    SHA256

    68148243e3a03a3a1aaf4637f054993cb174c04f6bd77894fe84d74af5833bec

    SHA512

    29c4978fa56f15025355ce26a52bdf8197b8d8073a441425df3dfc93c7d80d36755cc05b6485dd2e1f168df2941315f883960b81368e742c4ea8e69dd82fa2ba

  • C:\Users\Admin\AppData\Local\Temp\av\208\jre\lib\currency.data

    Filesize

    4KB

    MD5

    f6258230b51220609a60aa6ba70d68f3

    SHA1

    b5b95dd1ddcd3a433db14976e3b7f92664043536

    SHA256

    22458853da2415f7775652a7f57bb6665f83a9ae9fb8bd3cf05e29aac24c8441

    SHA512

    b2dfcfdebf9596f2bb05f021a24335f1eb2a094dca02b2d7dd1b7c871d5eecda7d50da7943b9f85edb5e92d9be6b6adfd24673ce816df3960e4d68c7f894563f

  • C:\Users\Admin\AppData\Local\Temp\av\208\jre\lib\ext\jfxrt.jar

    Filesize

    17.3MB

    MD5

    042b3675517d6a637b95014523b1fd7d

    SHA1

    82161caf5f0a4112686e4889a9e207c7ba62a880

    SHA256

    a570f20f8410f9b1b7e093957bf0ae53cae4731afaea624339aa2a897a635f22

    SHA512

    7672d0b50a92e854d3bd3724d01084cc10a90678b768e9a627baf761993e56a0c6c62c19155649fe9a8ceeabf845d86cbbb606554872ae789018a8b66e5a2b35

  • C:\Users\Admin\AppData\Local\Temp\av\208\jre\lib\ext\meta-index

    Filesize

    1KB

    MD5

    77abe2551c7a5931b70f78962ac5a3c7

    SHA1

    a8bb53a505d7002def70c7a8788b9a2ea8a1d7bc

    SHA256

    c557f0c9053301703798e01dc0f65e290b0ae69075fb49fcc0e68c14b21d87f4

    SHA512

    9fe671380335804d4416e26c1e00cded200687db484f770ebbdb8631a9c769f0a449c661cb38f49c41463e822beb5248e69fd63562c3d8c508154c5d64421935

  • C:\Users\Admin\AppData\Local\Temp\av\208\jre\lib\i386\jvm.cfg

    Filesize

    657B

    MD5

    9fd47c1a487b79a12e90e7506469477b

    SHA1

    7814df0ff2ea1827c75dcd73844ca7f025998cc6

    SHA256

    a73aea3074360cf62adedc0c82bc9c0c36c6a777c70da6c544d0fba7b2d8529e

    SHA512

    97b9d4c68ac4b534f86efa9af947763ee61aee6086581d96cbf7b3dbd6fd5d9db4b4d16772dce6f347b44085cef8a6ea3bfd3b84fbd9d4ef763cef39255fbce3

  • C:\Users\Admin\AppData\Local\Temp\av\208\jre\lib\jsse.jar

    Filesize

    619KB

    MD5

    fd1434c81219c385f30b07e33cef9f30

    SHA1

    0b5ee897864c8605ef69f66dfe1e15729cfcbc59

    SHA256

    bc3a736e08e68ace28c68b0621dccfb76c1063bd28d7bd8fce7b20e7b7526cc5

    SHA512

    9a778a3843744f1fabad960aa22880d37c30b1cab29e123170d853c9469dc54a81e81a9070e1de1bf63ba527c332bb2b1f1d872907f3bdce33a6898a02fef22d

  • C:\Users\Admin\AppData\Local\Temp\av\208\jre\lib\meta-index

    Filesize

    2KB

    MD5

    91aa6ea7320140f30379f758d626e59d

    SHA1

    3be2febe28723b1033ccdaa110eaf59bbd6d1f96

    SHA256

    4af21954cdf398d1eae795b6886ca2581dac9f2f1d41c98c6ed9b5dbc3e3c1d4

    SHA512

    03428803f1d644d89eb4c0dcbdea93acaac366d35fc1356ccabf83473f4fef7924edb771e44c721103cec22d94a179f092d1bfd1c0a62130f076eb82a826d7cb

  • C:\Users\Admin\AppData\Local\Temp\av\208\jre\lib\resources.jar

    Filesize

    3.3MB

    MD5

    9a084b91667e7437574236cd27b7c688

    SHA1

    d8926cc4aa12d6fe9abe64c8c3cb8bc0f594c5b1

    SHA256

    a1366a75454fc0f1ca5a14ea03b4927bb8584d6d5b402dfa453122ae16dbf22d

    SHA512

    d603aa29e1f6eefff4b15c7ebc8a0fa18e090d2e1147d56fd80581c7404ee1cb9d6972fcf2bd0cb24926b3af4dfc5be9bce1fe018681f22a38adaa278bf22d73

  • C:\Users\Admin\AppData\Local\Temp\av\208\jre\lib\security\java.security

    Filesize

    26KB

    MD5

    409c132fe4ea4abe9e5eb5a48a385b61

    SHA1

    446d68298be43eb657934552d656fa9ae240f2a2

    SHA256

    4d9e5a12b8cac8b36ecd88468b1c4018bc83c97eb467141901f90358d146a583

    SHA512

    7fed286ac9aed03e2dae24c3864edbbf812b65965c7173cc56ce622179eb5f872f77116275e96e1d52d1c58d3cdebe4e82b540b968e95d5da656aa74ad17400d

  • C:\Users\Admin\AppData\Local\Temp\av\208\jre\lib\tzdb.dat

    Filesize

    101KB

    MD5

    5a7f416bd764e4a0c2deb976b1d04b7b

    SHA1

    e12754541a58d7687deda517cdda14b897ff4400

    SHA256

    a636afa5edba8aa0944836793537d9c5b5ca0091ccc3741fc0823edae8697c9d

    SHA512

    3ab2ad86832b98f8e5e1ce1c1b3ffefa3c3d00b592eb1858e4a10fff88d1a74da81ad24c7ec82615c398192f976a1c15358fce9451aa0af9e65fb566731d6d8f

  • C:\Users\Admin\AppData\Local\Temp\av\208\jre\lib\tzmappings

    Filesize

    8KB

    MD5

    b8dd8953b143685b5e91abeb13ff24f0

    SHA1

    b5ceb39061fce39bb9d7a0176049a6e2600c419c

    SHA256

    3d49b3f2761c70f15057da48abe35a59b43d91fa4922be137c0022851b1ca272

    SHA512

    c9cd0eb1ba203c170f8196cbab1aaa067bcc86f2e52d0baf979aad370edf9f773e19f430777a5a1c66efe1ec3046f9bc82165acce3e3d1b8ae5879bd92f09c90

  • C:\Users\Admin\AppData\Local\Temp\av\208\lib\activation.jar

    Filesize

    67KB

    MD5

    46a37512971d8eca81c3fcf245bf07d2

    SHA1

    485de3a253e23f645037828c07f1d7f1af40763a

    SHA256

    ae475120e9fcd99b4b00b38329bd61cdc5eb754eee03fe66c01f50e137724f99

    SHA512

    49119b0cc3af02700685a55c6f15e6d40643f81640e642b9ea39a59e18d542f8837d30b43b5be006ce1a98c8ec9729bb2165c0442978168f64caa2fc6e3cb93d

  • C:\Users\Admin\AppData\Local\Temp\av\208\lib\asm-all.jar

    Filesize

    241KB

    MD5

    f5ad16c7f0338b541978b0430d51dc83

    SHA1

    2ea49e08b876bbd33e0a7ce75c8f371d29e1f10a

    SHA256

    7fbffbc1db3422e2101689fd88df8384b15817b52b9b2b267b9f6d2511dc198d

    SHA512

    82e6749f4a6956f5b8dd5a5596ca170a1b7ff4e551714b56a293e6b8c7b092cbec2bec9dc0d9503404deb8f175cbb1ded2e856c6bc829411c8ed311c1861336a

  • C:\Users\Admin\AppData\Local\Temp\av\208\lib\commons-email.jar

    Filesize

    48KB

    MD5

    f045afea3cb27ead50b0c59fc3f0dffd

    SHA1

    c1a7133db9008fa1eae082e6158c3f4c128ec27e

    SHA256

    268253139a8936afa68909df8ced52a9d769665ee9373a60e19a93f254fd54b5

    SHA512

    0e2d2cbef9d4c19310748e37ad909e57aa37490a7dfd41557b1914857fe7235e434a6fdee00f663688941da3e70fe882b5c63df10ba8c7ad18936959f906722b

  • C:\Users\Admin\AppData\Local\Temp\av\208\lib\dn-compiled-module.jar

    Filesize

    1.0MB

    MD5

    bf5f970ddf4c386b31664ce41d537094

    SHA1

    eada7f752c15e1176ae7c2cef577a06827f7551f

    SHA256

    a1a2e1b6d35d0f25d1bbd3639e89f4a4e7c96376d038c4540e41eefcdd24dc8a

    SHA512

    9a247a180d789b4ed34e588003db8a44f698eb54db794f94adb6bad413d4602ba79c85f66004d780a3459d58769130430000f3317e3838cbb443425d4777686d

  • C:\Users\Admin\AppData\Local\Temp\av\208\lib\dn-php-sdk.jar

    Filesize

    12KB

    MD5

    3e5e8cccff7ff343cbfe22588e569256

    SHA1

    66756daa182672bff27e453eed585325d8cc2a7a

    SHA256

    0f26584763ef1c5ec07d1f310f0b6504bc17732f04e37f4eb101338803be0dc4

    SHA512

    8ea5f31e25c3c48ee21c51abe9146ee2a270d603788ec47176c16acac15dad608eef4fa8ca0f34a1bbc6475c29e348bd62b0328e73d2e1071aaa745818867522

  • C:\Users\Admin\AppData\Local\Temp\av\208\lib\gson.jar

    Filesize

    226KB

    MD5

    5134a2350f58890ffb9db0b40047195d

    SHA1

    751f548c85fa49f330cecbb1875893f971b33c4e

    SHA256

    2d43eb5ea9e133d2ee2405cc14f5ee08951b8361302fdd93494a3a997b508d32

    SHA512

    c3cdaf66a99e6336abc80ff23374f6b62ac95ab2ae874c9075805e91d849b18e3f620cc202b4978fc92b73d98de96089c8714b1dd096b2ae1958cfa085715f7a

  • C:\Users\Admin\AppData\Local\Temp\av\208\lib\jfoenix.jar

    Filesize

    2.3MB

    MD5

    6316f84bc78d40b138dab1adc978ca5d

    SHA1

    b12ea05331ad89a9b09937367ebc20421f17b9ff

    SHA256

    d637e3326f87a173abd5f51ac98906a3237b9e511d07d31d6aafcf43f33dac17

    SHA512

    1cdca01ed9c2bc607207c8c51f4b532f4153e94b3846308332eccae25f9c5fddf8279e3063f44a75dd43d696eab0f9f340f9bf2f3ec805ab0f2f1de5135a426c

  • C:\Users\Admin\AppData\Local\Temp\av\208\lib\jkeymaster.jar

    Filesize

    51KB

    MD5

    21a017201cbb16ae0546069d4371f1c2

    SHA1

    9f1e8c9341a8a0c51299b961c4f6c7661c822756

    SHA256

    a2d68aaf08f15ff1c3b9b224641e8b4c35ee30b10f655d6420571b0429f19c87

    SHA512

    6c65740c17de72ba7b0df95aa29d095a1502f298924c63f364328f6fbb38920e92e0246d28a642f7c9fe3ab582341e607b0ae01515d470b4595d698ce81363d6

  • C:\Users\Admin\AppData\Local\Temp\av\208\lib\jna.jar

    Filesize

    1.1MB

    MD5

    8d536ddbe44d1500d262960891911f91

    SHA1

    fcc5b10cb812c41b00708e7b57baccc3aee5567c

    SHA256

    edc2a2c4f9b0b55fdc66aef3c9a9ddfff97e4b892842d4c0e1bc6eaff704abcb

    SHA512

    0ff97f158d1b1fbbef35813a1be2cc9f0c2321fa66e47af3276d3cb93178e668a652bac8a1aee82986dbf86e6db34518045eddfdd10ca827f3e4762faaa814f3

  • C:\Users\Admin\AppData\Local\Temp\av\208\lib\jphp-app-framework.jar

    Filesize

    103KB

    MD5

    0c8768cdeb3e894798f80465e0219c05

    SHA1

    c4da07ac93e4e547748ecc26b633d3db5b81ce47

    SHA256

    15f36830124fc7389e312cf228b952024a8ce8601bf5c4df806bc395d47db669

    SHA512

    35db507a3918093b529547e991ab6c1643a96258fc95ba1ea7665ff762b0b8abb1ef732b3854663a947effe505be667bd2609ffcccb6409a66df605f971da106

  • C:\Users\Admin\AppData\Local\Temp\av\208\lib\jphp-core.jar

    Filesize

    464KB

    MD5

    7e5e3d6d352025bd7f093c2d7f9b21ab

    SHA1

    ad9bfc2c3d70c574d34a752c5d0ebcc43a046c57

    SHA256

    5b37e8ff2850a4cbb02f9f02391e9f07285b4e0667f7e4b2d4515b78e699735a

    SHA512

    c19c29f8ad8b6beb3eed40ab7dc343468a4ca75d49f1d0d4ea0b4a5cee33f745893fba764d35c8bd157f7842268e0716b1eb4b8b26dcf888fb3b3f4314844aad

  • C:\Users\Admin\AppData\Local\Temp\av\208\lib\jphp-desktop-ext.jar

    Filesize

    16KB

    MD5

    b50e2c75f5f0e1094e997de8a2a2d0ca

    SHA1

    d789eb689c091536ea6a01764bada387841264cb

    SHA256

    cf4068ebb5ecd47adec92afba943aea4eb2fee40871330d064b69770cccb9e23

    SHA512

    57d8ac613805edada6aeba7b55417fd7d41c93913c56c4c2c1a8e8a28bbb7a05aade6e02b70a798a078dc3c747967da242c6922b342209874f3caf7312670cb0

  • C:\Users\Admin\AppData\Local\Temp\av\208\lib\jphp-desktop-hotkey-ext.jar

    Filesize

    5KB

    MD5

    22acc05e1efc1d4c5faa0359ce725d47

    SHA1

    458e7f911d024a3d786e76f256b017b0901f48f8

    SHA256

    c55c267d954ec9f24226780ee49fa7e1bc2baec3af6bfc0caa6cc1b49d8ca90c

    SHA512

    b11754f5337a73d317ae311fd4c20c0b548e1163107b741cc9e6d4d9027a8f99551e3184a83f9ad20098092e87ef1741c1e437058b7cac92727124589c303ef5

  • C:\Users\Admin\AppData\Local\Temp\av\208\lib\jphp-gui-ext.jar

    Filesize

    688KB

    MD5

    6696368a09c7f8fed4ea92c4e5238cee

    SHA1

    f89c282e557d1207afd7158b82721c3d425736a7

    SHA256

    c25d7a7b8f0715729bccb817e345f0fdd668dd4799c8dab1a4db3d6a37e7e3e4

    SHA512

    0ab24f07f956e3cdcd9d09c3aa4677ff60b70d7a48e7179a02e4ff9c0d2c7a1fc51624c3c8a5d892644e9f36f84f7aaf4aa6d2c9e1c291c88b3cff7568d54f76

  • C:\Users\Admin\AppData\Local\Temp\av\208\lib\jphp-gui-jfoenix-ext.jar

    Filesize

    50KB

    MD5

    d093f94c050d5900795de8149cb84817

    SHA1

    54058dda5c9e66a22074590072c8a48559bba1fb

    SHA256

    4bec0794a0d69debe2f955bf495ea7c0858ad84cb0d2d549cacb82e70c060cba

    SHA512

    3faaa415fba5745298981014d0042e8e01850fccaac22f92469765fd8c56b920da877ff3138a629242d9c52e270e7e2ce89e7c69f6902859f48ea0359842e2fb

  • C:\Users\Admin\AppData\Local\Temp\av\208\lib\jphp-json-ext.jar

    Filesize

    16KB

    MD5

    fde38932b12fc063451af6613d4470cc

    SHA1

    bc08c114681a3afc05fb8c0470776c3eae2eefeb

    SHA256

    9967ea3c3d1aee8db5a723f714fba38d2fc26d8553435ab0e1d4e123cd211830

    SHA512

    0f211f81101ced5fff466f2aab0e6c807bb18b23bc4928fe664c60653c99fa81b34edf5835fcc3affb34b0df1fa61c73a621df41355e4d82131f94fcc0b0e839

  • C:\Users\Admin\AppData\Local\Temp\av\208\lib\jphp-jsoup-ext.jar

    Filesize

    19KB

    MD5

    d963210c02cd1825e967086827da8294

    SHA1

    26c4d004b5ffdb8f81de2d6b158a3f34819faf01

    SHA256

    7908145cf17301bedefd6e3af8c93e0320582c0562919ffb56cc21b7fd532b96

    SHA512

    756c21dc1a02d579f0e2ed39e5bedca5491087cdc28e3e96c8663a493bcfeeeeea44dc40681ec6341426dfa995883dbce11b76d1f921e043ae220399a9e554fb

  • C:\Users\Admin\AppData\Local\Temp\av\208\lib\jphp-mail-ext.jar

    Filesize

    9KB

    MD5

    405861c5544a92fb345ebca30dcaec2d

    SHA1

    f8fe5dcb597fff1bf6489f1283a0157be1a313c3

    SHA256

    fb206af4ddcc568eb1f7b38b7266be683167c95befef797b0965b4533647b17d

    SHA512

    f1330e5b39a2af8cf378172d9311a50b65aaa7d0c793b354efbcaa3c843bddeffb756a50f1cb9adaf974c3bb3fa6b5ef4b779e1efeeeb1b3946605f47053fe03

  • C:\Users\Admin\AppData\Local\Temp\av\208\lib\jphp-runtime.jar

    Filesize

    1.1MB

    MD5

    d5ef47c915bef65a63d364f5cf7cd467

    SHA1

    f711f3846e144dddbfb31597c0c165ba8adf8d6b

    SHA256

    9c287472408857301594f8f7bda108457f6fdae6e25c87ec88dbf3012e5a98b6

    SHA512

    04aeb956bfcd3bd23b540f9ad2d4110bb2ffd25fe899152c4b2e782daa23a676df9507078ecf1bfc409ddfbe2858ab4c4c324f431e45d8234e13905eb192bae8

  • C:\Users\Admin\AppData\Local\Temp\av\208\lib\jphp-systemtray-ext.jar

    Filesize

    18KB

    MD5

    acc229916e4c7c666b45072b525041e7

    SHA1

    36f508f20347fce608130806a26cd796daf5dd20

    SHA256

    91ed39e83199784b0fb359a9e2b319572b2ba1b1f4492e82a590bf488650f7f4

    SHA512

    c537c442874c63103f5ae934b6fdd03834e62b7374070efcbcd05b606d02274679078c38437cb1de79e3284f39fc2981c79274d93b0ba4afeb7c6942cca54235

  • C:\Users\Admin\AppData\Local\Temp\av\208\lib\jphp-xml-ext.jar

    Filesize

    19KB

    MD5

    0a79304556a1289aa9e6213f574f3b08

    SHA1

    7ee3bde3b1777bf65d4f62ce33295556223a26cd

    SHA256

    434e57fffc7df0b725c1d95cabafdcdb83858ccb3e5e728a74d3cf33a0ca9c79

    SHA512

    1560703d0c162d73c99cef9e8ddc050362e45209cc8dea6a34a49e2b6f99aae462eae27ba026bdb29433952b6696896bb96998a0f6ac0a3c1dbbb2f6ebc26a7e

  • C:\Users\Admin\AppData\Local\Temp\av\208\lib\jphp-zend-ext.jar

    Filesize

    95KB

    MD5

    4bc2aea7281e27bc91566377d0ed1897

    SHA1

    d02d897e8a8aca58e3635c009a16d595a5649d44

    SHA256

    4aef566bbf3f0b56769a0c45275ebbf7894e9ddb54430c9db2874124b7cea288

    SHA512

    da35bb2f67bca7527dc94e5a99a162180b2701ddca2c688d9e0be69876aca7c48f192d0f03d431ccd2d8eec55e0e681322b4f15eba4db29ef5557316e8e51e10

  • C:\Users\Admin\AppData\Local\Temp\av\208\lib\jphp-zip-ext.jar

    Filesize

    12KB

    MD5

    20f6f88989e806d23c29686b090f6190

    SHA1

    1fdb9a66bb5ca587c05d3159829a8780bb66c87d

    SHA256

    9d5f06d539b91e98fd277fc01fd2f9af6fea58654e3b91098503b235a83abb16

    SHA512

    2798bb1dd0aa121cd766bd5b47d256b1a528e9db83ed61311fa685f669b7f60898118ae8c69d2a30d746af362b810b133103cbe426e0293dd2111aca1b41ccea

  • C:\Users\Admin\AppData\Local\Temp\av\208\lib\jsoup.jar

    Filesize

    342KB

    MD5

    36145fee38e79b81035787f1be296a52

    SHA1

    33ee82e324f4b1e40167f3dc5e01234a1c5cab61

    SHA256

    6ebe6abd7775c10a49407ae22db45c840cd2cdaf715866a5b0b5af70941c3f4a

    SHA512

    3b00b07320831f075a6af9ac1863b8756fe4f99a1b4f2e53578dca17fdaf7bdb147279225045e9eeeba4898fe321cf5457832b8e6a1a5b71acff9a1c10392659

  • C:\Users\Admin\AppData\Local\Temp\av\208\lib\mail.jar

    Filesize

    496KB

    MD5

    ec6e4e5ebd85a221b395b8f3b37545e6

    SHA1

    85319c87280f30e1afc54c355f91f44741beac49

    SHA256

    17bddec86cfe01092bd358c249b7c2ce4295c13cdad314d8eacc8426fdbe3034

    SHA512

    3e3e406542676f27b5008a061ceaa90580e2f9fd78b31576c99f7612033f2dd0a14824e7bfb16e6f1a12ad96985319fd6f1c2706230019c76ce22da8c7dfd181

  • C:\Users\Admin\AppData\Local\Temp\av\208\lib\slf4j-api.jar

    Filesize

    40KB

    MD5

    caafe376afb7086dcbee79f780394ca3

    SHA1

    da76ca59f6a57ee3102f8f9bd9cee742973efa8a

    SHA256

    18c4a0095d5c1da6b817592e767bb23d29dd2f560ad74df75ff3961dbde25b79

    SHA512

    5dd6271fd5b34579d8e66271bab75c89baca8b2ebeaa9966de391284bd08f2d720083c6e0e1edda106ecf8a04e9a32116de6873f0f88c19c049c0fe27e5d820b

  • C:\Users\Admin\AppData\Local\Temp\av\208\lib\slf4j-simple.jar

    Filesize

    14KB

    MD5

    722bb90689aecc523e3fe317e1f0984b

    SHA1

    8dacf9514f0c707cbbcdd6fd699e8940d42fb54e

    SHA256

    0966e86fffa5be52d3d9e7b89dd674d98a03eed0a454fbaf7c1bd9493bd9d874

    SHA512

    d5effbfa105bcd615e56ef983075c9ef0f52bcfdbefa3ce8cea9550f25b859e48b32f2ec9aa7a305c6611a3be5e0cde0d269588d9c2897ca987359b77213331d

  • C:\Users\Admin\AppData\Local\Temp\av\208\lib\zt-zip.jar

    Filesize

    102KB

    MD5

    0fd8bc4f0f2e37feb1efc474d037af55

    SHA1

    add8fface4c1936787eb4bffe4ea944a13467d53

    SHA256

    1e31ef3145d1e30b31107b7afc4a61011ebca99550dce65f945c2ea4ccac714b

    SHA512

    29de5832db5b43fdc99bb7ea32a7359441d6cf5c05561dd0a6960b33078471e4740ee08ffbd97a5ced4b7dd9cc98fad6add43edb4418bf719f90f83c58188149

  • C:\Users\Admin\AppData\Local\Temp\av\4554.cmd

    Filesize

    210B

    MD5

    f8254e719c5f499fcd279d9a7f3eae3d

    SHA1

    ba6158e60b2da3d9eab7e2c3a76630194d099e25

    SHA256

    b302609a09311ad913431e2be94447c9fe248ff573510d6d3b7d80a0cd49d031

    SHA512

    d02be62040c62b0916b750c2ed776a273b57a9754eab8a2858a713dafd915ccb3257cb6944565490dfcea6608e38b31a7189b8c19bfd01b7d2e487b5bfeb547b

  • C:\Users\Admin\AppData\Local\Temp\d1590c88

    Filesize

    2.4MB

    MD5

    c05cef3f6ef4cef78575167fb3ce9d66

    SHA1

    573faadb55043ca567fa776e869224b814247daf

    SHA256

    2c89fe6bfa5f0094d176d6dad0c13566024941ade0a6f118f1517c1f84a61a99

    SHA512

    8447f82d349aaaa24120a4bbbc83395de74a5a8f307dedc1e3c66bb73fd603faf4dd373595c329af0ab468a47e2d77a4be0aac32d996d1906ccb27057a4007be

  • C:\Users\Admin\AppData\Local\Temp\is-6DM6A.tmp\idp.dll

    Filesize

    216KB

    MD5

    b37377d34c8262a90ff95a9a92b65ed8

    SHA1

    faeef415bd0bc2a08cf9fe1e987007bf28e7218d

    SHA256

    e5a0ad2e37dde043a0dd4ad7634961ff3f0d70e87d2db49761eb4c1f468bb02f

    SHA512

    69d8da5b45d9b4b996d32328d3402fa37a3d710564d47c474bf9e15c1e45bc15b2858dbab446e6baec0c099d99007ff1099e9c4e66cfd1597f28c420bb50fdcc

  • C:\Users\Admin\AppData\Local\Temp\is-OV62U.tmp\Mia_Khalifia(18+).tmp

    Filesize

    915KB

    MD5

    9659ca7527a63b56d0bc5750be04a2d5

    SHA1

    e09fde1f286802c9374ea9a5a813e321c28d1de2

    SHA256

    7b8b708f6062f4a3a1d7dca4e71d04035e5f3df0aae41f1f9d83692787a78706

    SHA512

    80a4b22d49384b61fa50814ea5d475879bacf47a52c6e211935b127e234cefca20fa6fe67b582d2ea503db85246a1650384fa0dbd7d7c0d6abb20ea5d0f028dd

  • C:\Users\Admin\AppData\Local\Temp\tmp61C1.tmp

    Filesize

    20KB

    MD5

    22be08f683bcc01d7a9799bbd2c10041

    SHA1

    2efb6041cf3d6e67970135e592569c76fc4c41de

    SHA256

    451c2c0cf3b7cb412a05347c6e75ed8680f0d2e5f2ab0f64cc2436db9309a457

    SHA512

    0eef192b3d5abe5d2435acf54b42c729c3979e4ad0b73d36666521458043ee7df1e10386bef266d7df9c31db94fb2833152bb2798936cb2082715318ef05d936

  • memory/1328-488-0x000000006EAC0000-0x000000006EB0C000-memory.dmp

    Filesize

    304KB

  • memory/1328-510-0x0000000007540000-0x000000000754E000-memory.dmp

    Filesize

    56KB

  • memory/1328-509-0x0000000007500000-0x0000000007511000-memory.dmp

    Filesize

    68KB

  • memory/1328-477-0x0000000005B30000-0x0000000005E87000-memory.dmp

    Filesize

    3.3MB

  • memory/1408-67-0x0000000000400000-0x00000000004F7000-memory.dmp

    Filesize

    988KB

  • memory/1408-27-0x0000000000400000-0x00000000004F7000-memory.dmp

    Filesize

    988KB

  • memory/1408-37-0x0000000000400000-0x00000000004F7000-memory.dmp

    Filesize

    988KB

  • memory/1408-12-0x0000000000400000-0x00000000004F7000-memory.dmp

    Filesize

    988KB

  • memory/1760-507-0x0000000007D50000-0x00000000083CA000-memory.dmp

    Filesize

    6.5MB

  • memory/1760-513-0x0000000007A60000-0x0000000007A68000-memory.dmp

    Filesize

    32KB

  • memory/1760-506-0x00000000075F0000-0x0000000007694000-memory.dmp

    Filesize

    656KB

  • memory/1760-487-0x000000006EAC0000-0x000000006EB0C000-memory.dmp

    Filesize

    304KB

  • memory/1760-503-0x00000000075C0000-0x00000000075DE000-memory.dmp

    Filesize

    120KB

  • memory/1760-511-0x0000000007980000-0x0000000007995000-memory.dmp

    Filesize

    84KB

  • memory/1760-508-0x00000000077A0000-0x00000000077AA000-memory.dmp

    Filesize

    40KB

  • memory/1760-486-0x0000000007580000-0x00000000075B4000-memory.dmp

    Filesize

    208KB

  • memory/1760-512-0x0000000007A70000-0x0000000007A8A000-memory.dmp

    Filesize

    104KB

  • memory/2504-439-0x0000000004B40000-0x0000000004B62000-memory.dmp

    Filesize

    136KB

  • memory/2504-464-0x0000000007340000-0x00000000078E6000-memory.dmp

    Filesize

    5.6MB

  • memory/2504-440-0x0000000005530000-0x0000000005596000-memory.dmp

    Filesize

    408KB

  • memory/2504-441-0x00000000055A0000-0x0000000005606000-memory.dmp

    Filesize

    408KB

  • memory/2504-461-0x0000000006CF0000-0x0000000006D86000-memory.dmp

    Filesize

    600KB

  • memory/2504-462-0x0000000005F90000-0x0000000005FAA000-memory.dmp

    Filesize

    104KB

  • memory/2504-463-0x0000000005FE0000-0x0000000006002000-memory.dmp

    Filesize

    136KB

  • memory/2772-349-0x00000000027B0000-0x00000000027B1000-memory.dmp

    Filesize

    4KB

  • memory/2772-402-0x00000000027B0000-0x00000000027B1000-memory.dmp

    Filesize

    4KB

  • memory/2772-535-0x00000000027B0000-0x00000000027B1000-memory.dmp

    Filesize

    4KB

  • memory/2772-554-0x00000000027B0000-0x00000000027B1000-memory.dmp

    Filesize

    4KB

  • memory/2772-352-0x00000000027B0000-0x00000000027B1000-memory.dmp

    Filesize

    4KB

  • memory/2772-431-0x00000000027B0000-0x00000000027B1000-memory.dmp

    Filesize

    4KB

  • memory/2772-413-0x00000000027B0000-0x00000000027B1000-memory.dmp

    Filesize

    4KB

  • memory/2772-410-0x00000000027B0000-0x00000000027B1000-memory.dmp

    Filesize

    4KB

  • memory/2884-605-0x0000000007B30000-0x0000000007B3A000-memory.dmp

    Filesize

    40KB

  • memory/2884-584-0x0000000005280000-0x00000000052D0000-memory.dmp

    Filesize

    320KB

  • memory/2884-585-0x00000000050B0000-0x00000000050BA000-memory.dmp

    Filesize

    40KB

  • memory/2884-586-0x0000000006390000-0x00000000068BC000-memory.dmp

    Filesize

    5.2MB

  • memory/2884-587-0x0000000005E60000-0x0000000005E7E000-memory.dmp

    Filesize

    120KB

  • memory/2884-582-0x0000000005530000-0x00000000056F2000-memory.dmp

    Filesize

    1.8MB

  • memory/2884-613-0x00000000052F0000-0x0000000005302000-memory.dmp

    Filesize

    72KB

  • memory/2884-583-0x0000000005200000-0x0000000005276000-memory.dmp

    Filesize

    472KB

  • memory/2884-614-0x0000000005420000-0x000000000545C000-memory.dmp

    Filesize

    240KB

  • memory/2884-580-0x0000000000B00000-0x0000000000BC6000-memory.dmp

    Filesize

    792KB

  • memory/2884-581-0x0000000005160000-0x00000000051F2000-memory.dmp

    Filesize

    584KB

  • memory/3096-285-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/3172-2-0x0000000000401000-0x000000000040B000-memory.dmp

    Filesize

    40KB

  • memory/3172-75-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

  • memory/3172-26-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

  • memory/3172-0-0x0000000000400000-0x0000000000419000-memory.dmp

    Filesize

    100KB

  • memory/3468-460-0x0000000006830000-0x000000000687C000-memory.dmp

    Filesize

    304KB

  • memory/3468-459-0x00000000067A0000-0x00000000067BE000-memory.dmp

    Filesize

    120KB

  • memory/3468-450-0x0000000006250000-0x00000000065A7000-memory.dmp

    Filesize

    3.3MB

  • memory/3468-438-0x0000000005AE0000-0x000000000610A000-memory.dmp

    Filesize

    6.2MB

  • memory/3468-437-0x0000000003320000-0x0000000003356000-memory.dmp

    Filesize

    216KB

  • memory/4092-555-0x0000000000400000-0x0000000000C7A000-memory.dmp

    Filesize

    8.5MB