ce9f05e318551c0e494ccdb1b06fbf4c9c1a717a3aa4c6e609c90e562ad596c6

Analysis

max time kernel
600s
max time network
567s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/08/2024, 11:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TrafficerMC.exe
Size

168.6MB
MD5

6c694ca528b13ffc9fd2835f5e57333d
SHA1

a8bd8a621c320d0d03e414ee4776bca7430dec03
SHA256

2d08d78c151efc3985320b80771cd2ac6978397607ee53eb0ee5644090dcd369
SHA512

da0a507242dd777a3f51b62b9ff34001f3ad50bac5e5ea516d7b79cb8cf1f26b9ecb9a91ac0178b8582624acd62ddff183f14efa6f8a27ea07c7be3c934dc3a1
SSDEEP

1572864:qOhiqBPiJU33xaD1gWcdcMPEDCNCgDX0Bf+NNvTPQYhl49RIuKj53fHcTLNKJF96:EgmeNxNNZxqV

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	TrafficerMC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	TrafficerMC.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
19	raw.githubusercontent.com
20	raw.githubusercontent.com
26	raw.githubusercontent.com
27	raw.githubusercontent.com
32	raw.githubusercontent.com
34	raw.githubusercontent.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	TrafficerMC.exe
File created	\??\c:\windows\system32\driverstore\filerepository\display.inf_amd64_71aa85b0e2292a7a\display.PNF	TrafficerMC.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
71216	TrafficerMC.exe
71216	TrafficerMC.exe
71216	TrafficerMC.exe
71216	TrafficerMC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5044	TrafficerMC.exe
Token: SeCreatePagefilePrivilege	5044	TrafficerMC.exe
Token: SeShutdownPrivilege	5044	TrafficerMC.exe
Token: SeCreatePagefilePrivilege	5044	TrafficerMC.exe
Token: SeShutdownPrivilege	5044	TrafficerMC.exe
Token: SeCreatePagefilePrivilege	5044	TrafficerMC.exe
Token: SeShutdownPrivilege	5044	TrafficerMC.exe
Token: SeCreatePagefilePrivilege	5044	TrafficerMC.exe
Token: SeShutdownPrivilege	5044	TrafficerMC.exe
Token: SeCreatePagefilePrivilege	5044	TrafficerMC.exe
Token: SeShutdownPrivilege	5044	TrafficerMC.exe
Token: SeCreatePagefilePrivilege	5044	TrafficerMC.exe
Token: SeShutdownPrivilege	5044	TrafficerMC.exe
Token: SeCreatePagefilePrivilege	5044	TrafficerMC.exe
Token: SeShutdownPrivilege	5044	TrafficerMC.exe
Token: SeCreatePagefilePrivilege	5044	TrafficerMC.exe
Token: SeShutdownPrivilege	5044	TrafficerMC.exe
Token: SeCreatePagefilePrivilege	5044	TrafficerMC.exe
Token: SeShutdownPrivilege	5044	TrafficerMC.exe
Token: SeCreatePagefilePrivilege	5044	TrafficerMC.exe
Token: SeShutdownPrivilege	5044	TrafficerMC.exe
Token: SeCreatePagefilePrivilege	5044	TrafficerMC.exe
Token: SeShutdownPrivilege	5044	TrafficerMC.exe
Token: SeCreatePagefilePrivilege	5044	TrafficerMC.exe
Token: SeShutdownPrivilege	5044	TrafficerMC.exe
Token: SeCreatePagefilePrivilege	5044	TrafficerMC.exe
Token: SeShutdownPrivilege	5044	TrafficerMC.exe
Token: SeCreatePagefilePrivilege	5044	TrafficerMC.exe
Token: SeShutdownPrivilege	5044	TrafficerMC.exe
Token: SeCreatePagefilePrivilege	5044	TrafficerMC.exe
Token: SeShutdownPrivilege	5044	TrafficerMC.exe
Token: SeCreatePagefilePrivilege	5044	TrafficerMC.exe
Token: SeShutdownPrivilege	5044	TrafficerMC.exe
Token: SeCreatePagefilePrivilege	5044	TrafficerMC.exe
Token: SeShutdownPrivilege	5044	TrafficerMC.exe
Token: SeCreatePagefilePrivilege	5044	TrafficerMC.exe
Token: SeShutdownPrivilege	5044	TrafficerMC.exe
Token: SeCreatePagefilePrivilege	5044	TrafficerMC.exe
Token: SeShutdownPrivilege	5044	TrafficerMC.exe
Token: SeCreatePagefilePrivilege	5044	TrafficerMC.exe
Token: SeShutdownPrivilege	5044	TrafficerMC.exe
Token: SeCreatePagefilePrivilege	5044	TrafficerMC.exe
Token: SeShutdownPrivilege	5044	TrafficerMC.exe
Token: SeCreatePagefilePrivilege	5044	TrafficerMC.exe
Token: SeShutdownPrivilege	5044	TrafficerMC.exe
Token: SeCreatePagefilePrivilege	5044	TrafficerMC.exe
Token: SeShutdownPrivilege	5044	TrafficerMC.exe
Token: SeCreatePagefilePrivilege	5044	TrafficerMC.exe
Token: SeShutdownPrivilege	5044	TrafficerMC.exe
Token: SeCreatePagefilePrivilege	5044	TrafficerMC.exe
Token: SeShutdownPrivilege	5044	TrafficerMC.exe
Token: SeCreatePagefilePrivilege	5044	TrafficerMC.exe
Token: SeShutdownPrivilege	5044	TrafficerMC.exe
Token: SeCreatePagefilePrivilege	5044	TrafficerMC.exe
Token: SeShutdownPrivilege	5044	TrafficerMC.exe
Token: SeCreatePagefilePrivilege	5044	TrafficerMC.exe
Token: SeShutdownPrivilege	5044	TrafficerMC.exe
Token: SeCreatePagefilePrivilege	5044	TrafficerMC.exe
Token: SeShutdownPrivilege	5044	TrafficerMC.exe
Token: SeCreatePagefilePrivilege	5044	TrafficerMC.exe
Token: SeShutdownPrivilege	5044	TrafficerMC.exe
Token: SeCreatePagefilePrivilege	5044	TrafficerMC.exe
Token: SeShutdownPrivilege	5044	TrafficerMC.exe
Token: SeCreatePagefilePrivilege	5044	TrafficerMC.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 3192	5044	TrafficerMC.exe	84
PID 5044 wrote to memory of 3192	5044	TrafficerMC.exe	84
PID 5044 wrote to memory of 3192	5044	TrafficerMC.exe	84
PID 5044 wrote to memory of 3192	5044	TrafficerMC.exe	84
PID 5044 wrote to memory of 3192	5044	TrafficerMC.exe	84
PID 5044 wrote to memory of 3192	5044	TrafficerMC.exe	84
PID 5044 wrote to memory of 3192	5044	TrafficerMC.exe	84
PID 5044 wrote to memory of 3192	5044	TrafficerMC.exe	84
PID 5044 wrote to memory of 3192	5044	TrafficerMC.exe	84
PID 5044 wrote to memory of 3192	5044	TrafficerMC.exe	84
PID 5044 wrote to memory of 3192	5044	TrafficerMC.exe	84
PID 5044 wrote to memory of 3192	5044	TrafficerMC.exe	84
PID 5044 wrote to memory of 3192	5044	TrafficerMC.exe	84
PID 5044 wrote to memory of 3192	5044	TrafficerMC.exe	84
PID 5044 wrote to memory of 3192	5044	TrafficerMC.exe	84
PID 5044 wrote to memory of 3192	5044	TrafficerMC.exe	84
PID 5044 wrote to memory of 3192	5044	TrafficerMC.exe	84
PID 5044 wrote to memory of 3192	5044	TrafficerMC.exe	84
PID 5044 wrote to memory of 3192	5044	TrafficerMC.exe	84
PID 5044 wrote to memory of 3192	5044	TrafficerMC.exe	84
PID 5044 wrote to memory of 3192	5044	TrafficerMC.exe	84
PID 5044 wrote to memory of 3192	5044	TrafficerMC.exe	84
PID 5044 wrote to memory of 3192	5044	TrafficerMC.exe	84
PID 5044 wrote to memory of 3192	5044	TrafficerMC.exe	84
PID 5044 wrote to memory of 3192	5044	TrafficerMC.exe	84
PID 5044 wrote to memory of 3192	5044	TrafficerMC.exe	84
PID 5044 wrote to memory of 3192	5044	TrafficerMC.exe	84
PID 5044 wrote to memory of 3192	5044	TrafficerMC.exe	84
PID 5044 wrote to memory of 3192	5044	TrafficerMC.exe	84
PID 5044 wrote to memory of 3192	5044	TrafficerMC.exe	84
PID 5044 wrote to memory of 2432	5044	TrafficerMC.exe	85
PID 5044 wrote to memory of 2432	5044	TrafficerMC.exe	85
PID 5044 wrote to memory of 4376	5044	TrafficerMC.exe	86
PID 5044 wrote to memory of 4376	5044	TrafficerMC.exe	86
PID 5044 wrote to memory of 71216	5044	TrafficerMC.exe	93
PID 5044 wrote to memory of 71216	5044	TrafficerMC.exe	93

C:\Users\Admin\AppData\Local\Temp\TrafficerMC.exe
"C:\Users\Admin\AppData\Local\Temp\TrafficerMC.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Users\Admin\AppData\Local\Temp\TrafficerMC.exe
  "C:\Users\Admin\AppData\Local\Temp\TrafficerMC.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\trafficermc" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1832 --field-trial-handle=1836,i,16652012478885545450,6561509789607244664,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
  2⤵
  PID:3192
- C:\Users\Admin\AppData\Local\Temp\TrafficerMC.exe
  "C:\Users\Admin\AppData\Local\Temp\TrafficerMC.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\trafficermc" --mojo-platform-channel-handle=2148 --field-trial-handle=1836,i,16652012478885545450,6561509789607244664,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
  2⤵
  PID:2432
- C:\Users\Admin\AppData\Local\Temp\TrafficerMC.exe
  "C:\Users\Admin\AppData\Local\Temp\TrafficerMC.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\trafficermc" --app-user-model-id=com.rattleshyper.trafficermc --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2396 --field-trial-handle=1836,i,16652012478885545450,6561509789607244664,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1
  2⤵
  - Checks computer location settings
  PID:4376
- C:\Users\Admin\AppData\Local\Temp\TrafficerMC.exe
  "C:\Users\Admin\AppData\Local\Temp\TrafficerMC.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\trafficermc" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3324 --field-trial-handle=1836,i,16652012478885545450,6561509789607244664,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:8
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:71216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\trafficermc\Network\Network Persistent State

Filesize
387B

MD5
ad65227cffc8e51087fd3922d9eb81bf

SHA1
50fee8213b7e1ab4466f43716d8892d58fe0c713

SHA256
c2353e59df7664641c4791b8d9596811f74bc727ba9daad56d575cd6275f6410

SHA512
18b95bb283da1c5c51ff4a5788781e7f05c20b3af8eade5efbdd6210034aebd7d98d43553b31736c23723d4074a32a220ab373250ae1d8aa1b3591742dfb48d7

Download Submit
C:\Users\Admin\AppData\Roaming\trafficermc\Network\Network Persistent State~RFe58f509.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Roaming\trafficermc\config.json

Filesize
37B

MD5
427a9811a50ad51c811a8438a1e94ab0

SHA1
8ab36937f70b37896a48472ed5f78ea97969341b

SHA256
7e3395815ea8a6128c659eeb63c5593e592fc3e8822f828f4f796048df8c7141

SHA512
2f2550258c737d44d299ef34e6616278a2e0a45e11a26577508082719b4510bcfc0ca7bdb98b0134e44920532ea4d2b741adc43bbcd8d36652121f81e5eec2af

Download Submit
C:\Users\Admin\AppData\Roaming\trafficermc\config.json.tmp-29446134837a1be4

Filesize
89B

MD5
f15a213c00d7690b8290264544d1300e

SHA1
1829709d274d7d7e2c9d48f2c91b6272f22fdc81

SHA256
982c94d8dfeaa93486a3cac5520137c35a06686fbbfb55ce8036e53a677fe959

SHA512
7796fb778a7febdcc9fc3a492b3478824b98987338a012368b6e8a0a88d20084ffc13f63f5402c2eee59c8d1cd5004321eb9cc78c9ebe852061f772d8e4f21dd

Download Submit
C:\Users\Admin\AppData\Roaming\trafficermc\config.json.tmp-294461358826061c

Filesize
87B

MD5
b09351e4aa8492d42ddd40d17434ad59

SHA1
2b2986e5619f02036c8de0f0e0e2995055fd9ed5

SHA256
c147b717d5704750611f9579b52a30aa2897a107159f160171f3cd636f4ba9bb

SHA512
cbf036e9d2cbb05c973685a76c1f0d2e7bf7325546296371bebca575535f2b69e2b93388c9a836862f12deccf9850e5d1731a93e63011ccc7cef77ce458752f6

Download Submit
C:\Users\Admin\AppData\Roaming\trafficermc\config.json.tmp-29446136979cba3e

Filesize
87B

MD5
35d9e6150dfbcc75b0b57047806bfbfd

SHA1
ca3b170827d080cdcd4c28d63bcbe2b60308aa92

SHA256
0155f4ad0614a73d5bcd69726bf823a8a75347d1d7048141e4bbd52b5abd1c79

SHA512
76b34f3dc0071bc0ae89e9f369efd5beb510ecf142cca5143d61eb1c081a26f55daa1772b576c7ac82486f28fc343918e3cfff023f1d7ca43bd150164b2c1f31

Download Submit
C:\Users\Admin\AppData\Roaming\trafficermc\config.json.tmp-2944613807b22fdd

Filesize
90B

MD5
a73dece86591f3f0850332f571ac5d18

SHA1
71e143c24728273415a02bf8e3df26ed8a27fe80

SHA256
d6a6840ff9eb71fc66d0d202087ab2bdce9f82d3f690048a3c1a7ca1d38aeb9e

SHA512
d4074b8bbee39e3ffd95d19e2f9178b4d2eff1212e4f80d8ed452878781279f6055c2cf9ed9173dc7123e8800d8582e455556dc527741e2ffa87b542c7ce953d

Download Submit
C:\Users\Admin\AppData\Roaming\trafficermc\config.json.tmp-2944613916634038

Filesize
92B

MD5
35141c27974a6ba646f4ecb79dc86601

SHA1
7e52400a60e6615ec2dc2aa08cde2aa662108b08

SHA256
217b9973cfea2e8dafd16224f4f5473201283ce76ef5177ee6170a9ce2b742c5

SHA512
3c91c1e52065d241d6f162b71c3976fac335901d0dfed358e693b2e68c55a548e7b0d856667ca8c70a2e242cf86ec62f2d8cfb1d467c736adb504daf816bf85d

Download Submit
C:\Users\Admin\AppData\Roaming\trafficermc\config.json.tmp-29446140278ffbae

Filesize
96B

MD5
969bdb5584b333d37a8acd8dbb262e88

SHA1
508f2ee18c5bb9fbc26719a6c3cb373a01692172

SHA256
74a5e3729778f9dfbd430fdcfffc2166f6ce7617c23051704adb7d8de2bf99c7

SHA512
be1ace17ff50c4f5dee2556799c615c557017031580038c6c6c1b439b6794b037c12d1198a30bb786226830b7505e48de4bda34e59aa192c93aafd69842bb9fb

Download Submit
C:\Users\Admin\AppData\Roaming\trafficermc\config.json.tmp-2944614139400cad

Filesize
96B

MD5
e84a5e6fde08408e2f5b253fb00f5d2e

SHA1
f7d0127781daaa47772d10c2356e28205a4dcbd4

SHA256
ab7d819472c5bed59c75e1d7571214baa487f5bdc1492b53ba69f04ce048ce9f

SHA512
7745d3177abe6dc6d94da1155f16e040cfa70032f0aa95983384b402c2b8fe25580cb160deaf8ec030805ab2e7ec077a11548b649e892425211cb60e3d66412c

Download Submit
C:\Users\Admin\AppData\Roaming\trafficermc\config.json.tmp-29446142502fcc9f

Filesize
88B

MD5
f89a40fc984723566bf5cba82865a4f6

SHA1
f2d14263a93b7fa3ed65c98de2750665104fafda

SHA256
bef23d68e06f87207dc059c55a7e6d739b7d07cb885edd4a99778383f6e477a7

SHA512
51e2880057e7a6f5ce04a470023d7a85feae944e5c930a20c43f71d02fee6d75782f30bb1ba2614bd5e073ce186586a22bed170236707955fc0574835f52d561

Download Submit
C:\Users\Admin\AppData\Roaming\trafficermc\config.json.tmp-2944614355109cbc

Filesize
94B

MD5
52d3eaf7cd70805f12cc93716c16c90e

SHA1
627ea3e2c67f92d176a56e53d04faa9e9feb0423

SHA256
f2c553e44dc7dd1c44b78b30d09887895fbf52ff93d015b0f39eb24a96787590

SHA512
4a4efee5ede1e4eea6aae1a9bcd161b20ddc88fd7ec218dc9b187aab917eb3de1a7242b5ebe301a96c75f4ce273b3782af0eff318d5cf98d52d1fb7bd0679ca9

Download Submit
C:\Users\Admin\AppData\Roaming\trafficermc\config.json.tmp-2944614465c6d4cd

Filesize
88B

MD5
1b1515a414f68cfa38f45c85b4e224b9

SHA1
387abb14d20bbd9454f99b7dc8e745803f255d9d

SHA256
a8ecd67aafa1324e8c4845d68858aaebccf157018b5cac3df6db9e0fb8564cc8

SHA512
2dff3ea8055450473ead754b8beca951626d9b259a40650d853dadee609857726b3046b4e751af3e1f77d0d0aa2f46fe84ab836d42bcc992365de9c3bfec11c1

Download Submit
C:\Users\Admin\AppData\Roaming\trafficermc\config.json.tmp-294461456772becc

Filesize
90B

MD5
1a9be198c0fdbad40019d5abe74ada4d

SHA1
4a8be2490e350b25da920fad093158a06b2cd3dd

SHA256
e63559b08bca2856c26f3367bd558e6fabef8bdcc67697016a2e2e11df4f78ad

SHA512
bb7993c12a1671d394c72a8cbf06e03bfd1afa0c7789aa7f3016440dc0069e0a11c29547f60780d85e81acf937e37689dca40f2963da2d29836b193ce4b67382

Download Submit
C:\Users\Admin\AppData\Roaming\trafficermc\config.json.tmp-29446146905d9c81

Filesize
92B

MD5
a06494ce498acb1cacdcc503705621f3

SHA1
8f0f0f4ee1c26a92b17667b0288de33de79f966d

SHA256
1a7b2656c5446a4dfea7628f50e7d4c134f4a4ce9949ff9c6847c892517fa2c3

SHA512
466a5596bcd4dbbad18b5663f11be6557d8e7b669c4110f225601406c7c8e7cf204122a2b9af17820b261534027274af6bfd6439d0efbd48708954b3dd372859

Download Submit
C:\Users\Admin\AppData\Roaming\trafficermc\config.json.tmp-29446147963dd7ff

Filesize
88B

MD5
567ac7cae28c8dba3511f1ec6753f75f

SHA1
e335abaeb17986a5e9b71920d83c318596ebe0d1

SHA256
e3fb50c1764e8a1300843647a3212d47109c668626d63a0e06648d4980d20267

SHA512
cb7850535ec04b42b5fd874432fae4cf13667401d269a67da857433cc1e48fe5a75a6829001f861ca222e341c8d1a360028b55c7e49c08542c121c91a6ca4a3a

Download Submit
C:\Users\Admin\AppData\Roaming\trafficermc\config.json.tmp-2944614902d5e706

Filesize
96B

MD5
2e530dd715f56b5251b726ac4cc4eef6

SHA1
f9a0639d632c6fc11698a165c8bef9ba1b49a920

SHA256
ba86b51146dab999571079feb67b7db10217990738f32d88e312851fb7287fa8

SHA512
98172eecd7dbfadf216fe662850afe2a1c65878be950c18f765fdef1c44d86076273a98a4554c2fc72907f5d5a3ddfba9ed0e9a8cc81b58812821ab2bc9e81e8

Download Submit
C:\Users\Admin\AppData\Roaming\trafficermc\config.json.tmp-29446150176620a6

Filesize
95B

MD5
2a1a0ce6fd32188483c610ebea2abcbb

SHA1
97278c71faefef5ff3afc4aeb8438278edc8b64c

SHA256
b1e19be8a2e5520453b5a1fabd3bb754f513e372096f4a1e1bc8eb3c88e9d10f

SHA512
ebc0e8993f13bb49fd83815a74a29a365f7d5450529e3479934aadbafeef99818f2803eddfd356bf85afd9e3b46c1c40d6f64bade34648f269e89532da9d43bf

Download Submit
C:\Users\Admin\AppData\Roaming\trafficermc\config.json.tmp-2944615118c1192c

Filesize
95B

MD5
57155fd5744f682cce63c2a441a02b6f

SHA1
fbe9653a84c591cd85a76a64d354c3edaa843b75

SHA256
e217d3e805a23ee08edbbcbbd79608612d84a2616ba0818f1cc869c3708c1f9b

SHA512
9ae0a18956747bf9d84f77b5223dea4433504eae378e27505e03a12d7ba60c1693f00eaeed4090978cc23692bb1398108d7bfb6a88d46b4f8952a99cc82c193d

Download Submit
C:\Users\Admin\AppData\Roaming\trafficermc\config.json.tmp-29446152276e84a9

Filesize
94B

MD5
995dd2039ddf3a50345220b9ef8d6a7c

SHA1
e68f6f98c36be72cf74f06b0ee6769528d0a14c9

SHA256
8614ec7201cda174abe2acc15c24673d47888056a636ce2e754316656343c1e4

SHA512
1511dea1f2b7c77476a12ff3a65244af1c29c3ef2182c34e747df29290f632e08f557a909f70f15acf36d3b070239d0d32a4eb041dae7438f2d9aa103dfde478

Download Submit
C:\Users\Admin\AppData\Roaming\trafficermc\config.json.tmp-294461533941fa0b

Filesize
95B

MD5
e0795cb3fe55b49a325b4555a0e4530a

SHA1
ab8abd336528097f1b55d9a5dd386d5a11de5480

SHA256
bae2928bfd12c376e53480131a957333571485b84b1f6af794b462911a296b50

SHA512
0b8a3af7abf91b9acfa761aec175c798e95829da13b87f3aa06055dc5748ab7a3e3522e17ad8c1e295af52b13850d696de34130ccc96e6693a4e93f1987d74da

Download Submit
C:\Users\Admin\AppData\Roaming\trafficermc\config.json.tmp-29446154502c57a3

Filesize
94B

MD5
4bfa1c545d7897e5d0417b7918d3636f

SHA1
8b8e2585fb355c116696660da8a55b12bb90a01e

SHA256
f4ab8a40704b32a2c970976bc4468350de46f6668aa80c46fff57ea409d188b0

SHA512
a2f4ed5bf5bb7ad5cb61ca8faecfdcb1713c0e6a1b3c53f8a8ef7c1745cf11bea4adb466d475c2e5aab5d6ed75f6a5bb8852456bee7cc4a242bf6f5b6dd60bbf

Download Submit
C:\Users\Admin\AppData\Roaming\trafficermc\config.json.tmp-29446155610a3464

Filesize
96B

MD5
dc44e6ba97f7223cbc36f4682855e435

SHA1
cfcc618f0781c3b4d19b0a6576b5d875db7b28bb

SHA256
497c121a544b7e40bb9c8392a621e3042a3a81143f2b32d4af5ef4250298965d

SHA512
2df5dd35ee898e366997c9ad6838d6d68663470ade1bafa896ce1838b58d2667290adb906512c8fd6bb6c36a11924a9d7b58d86d8dabc4453d603f998e3f6f10

Download Submit
C:\Users\Admin\AppData\Roaming\trafficermc\config.json.tmp-29446161483c0311

Filesize
97B

MD5
7c27f341ac9a07ea1419f492621af828

SHA1
3729a56d2bb22a5c513c84f29a8891d943048aa5

SHA256
868ddecf9eb43686aec4c176bcc58aae1dfa3d97b1fc28e0fd8a839980687929

SHA512
1decbbd3904259bbdf2d9c2959c04ae4cc3a4de057c0895728f03e3f89bc23520f2adb1c95ff5ec705ab5dc9110dbf4a8b68dca6915d9ae622163672190062e8

Download Submit
C:\Users\Admin\AppData\Roaming\trafficermc\config.json.tmp-2944616258336f05

Filesize
99B

MD5
3986f64b17c1057b0906b741d973e6c1

SHA1
3f529001b6c4156081d16de39762f4e329a5b199

SHA256
0315548728d4fdb96c8694c37e5d3d3db9a9d0ac2f52481d8490e74a514bbb7c

SHA512
2cde6889637aca919ce0fc76e87cbb30d71ad117d58de9073fc62563af3fe2e5f47691e2da3cc8fbcdee56dfaa34d4a459895fc68b0d86d9c4b4c3a476b5673f

Download Submit
C:\Users\Admin\AppData\Roaming\trafficermc\config.json.tmp-294461637184e87a

Filesize
96B

MD5
15d95139117aa28fb0438ab070a94601

SHA1
3a05dc4d13d27a3951bed2914aca32aed47d1e6f

SHA256
5e16c9666483baa4ebe951743c44a23ab778e338e2217b593a4f761fcd3e4e95

SHA512
fbd71c764acf61732c4544994ae903db606a4db19c6ed30a7e650a6e935a4e746f8a4e02d632bc92f11c19171d7401ad49f035d1b270c5ff31dbf5d16132ed78

Download Submit
C:\Users\Admin\AppData\Roaming\trafficermc\config.json.tmp-29446164896b8b3f

Filesize
105B

MD5
715623bd09d17883b6485a48914e980f

SHA1
0ae0e51656350f4c91720bcc22fc5d3582ffa31c

SHA256
15adccb4ba9985d4837924dbb5318b472a382e2b60b9962c3fca9c62d3d7b8c7

SHA512
a56240ceb0da618b35042e6ed4c188ae2075e5883d799e61359119364d9f1363dd14fd5a8b3d70a3240ec263a6330dd33c78d33bf23abc446a90f01800f11f35

Download Submit
C:\Users\Admin\AppData\Roaming\trafficermc\config.json.tmp-294461681561d1ee

Filesize
98B

MD5
39b3daf92bb223b444b5df80f037e182

SHA1
51242378930783a8320356d053b08dec675ce3f4

SHA256
e15b7b931486fa273481c2305f4c6a636ba03714636fffecc94f54911485bebb

SHA512
3d94065c87f777249478eb274b036567861257b6531659894d68f13e1a84bc18a011804e91ea1ba205ef3cfafa79bef556868f63a1dec90ac07395b351e0503e

Download Submit
C:\Users\Admin\AppData\Roaming\trafficermc\config.json.tmp-2944617029dd99ad

Filesize
94B

MD5
ba138f3c902c91e5ca5dbc712eeeebc4

SHA1
d443eabc16901d903b5df5385aa00967a03b2d1e

SHA256
1279f238ff28dc7438eeddd577fcd6d2b3668ade5312ca371f3366b24f119661

SHA512
e39a588bbe4fb5c687e9b6fb8929a78515276b8feb5c45a54c0d9cac1578244f90c29a0073ce3c1acae8d20f857a22d00904216a7854c11924501cd420c4a52f

Download Submit
memory/71216-43588-0x0000027DE1600000-0x0000027DE1601000-memory.dmp

Filesize
4KB

Download
memory/71216-43587-0x0000027DE1600000-0x0000027DE1601000-memory.dmp

Filesize
4KB

Download
memory/71216-43593-0x0000027DE1600000-0x0000027DE1601000-memory.dmp

Filesize
4KB

Download
memory/71216-43599-0x0000027DE1600000-0x0000027DE1601000-memory.dmp

Filesize
4KB

Download
memory/71216-43598-0x0000027DE1600000-0x0000027DE1601000-memory.dmp

Filesize
4KB

Download
memory/71216-43597-0x0000027DE1600000-0x0000027DE1601000-memory.dmp

Filesize
4KB

Download
memory/71216-43596-0x0000027DE1600000-0x0000027DE1601000-memory.dmp

Filesize
4KB

Download
memory/71216-43595-0x0000027DE1600000-0x0000027DE1601000-memory.dmp

Filesize
4KB

Download
memory/71216-43594-0x0000027DE1600000-0x0000027DE1601000-memory.dmp

Filesize
4KB

Download
memory/71216-43589-0x0000027DE1600000-0x0000027DE1601000-memory.dmp

Filesize
4KB

Download