Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    121s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/08/2024, 16:31

General

  • Target

    af32a658ac6e451c522a8bf349dbc7b0N.exe

  • Size

    64KB

  • MD5

    af32a658ac6e451c522a8bf349dbc7b0

  • SHA1

    73d74234c6330f8d20fe341b2a3363ef4cdf71fe

  • SHA256

    47c0d62021c8e4de9ea3ee9edebd130809e5be45df82daadee731e0eccd78bf5

  • SHA512

    0ab126ba303f7764df8318eef630514b04d53ce1654a4f1b13fff533f3116a8059eea08dfb8f04a868829323ab76b5e61dd7332f991d1e4a22226938c9d1f71e

  • SSDEEP

    768:jK61C+rFo1BH01Y54CJvsRRQK6LUPZA+ZaHTPKlLwYw42p/1H5hiXdnh7L4Kz5H3:rtmUSiMqfKGZ/aHDKl0Yw42Lw7RZR

Score
10/10

Malware Config

Signatures

  • Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs
  • Executes dropped EXE 57 IoCs
  • Drops file in System32 directory 64 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 58 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\af32a658ac6e451c522a8bf349dbc7b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\af32a658ac6e451c522a8bf349dbc7b0N.exe"
    1⤵
    • Adds autorun key to be loaded by Explorer.exe on startup
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4768
    • C:\Windows\SysWOW64\Afoeiklb.exe
      C:\Windows\system32\Afoeiklb.exe
      2⤵
      • Adds autorun key to be loaded by Explorer.exe on startup
      • Executes dropped EXE
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4292
      • C:\Windows\SysWOW64\Anfmjhmd.exe
        C:\Windows\system32\Anfmjhmd.exe
        3⤵
        • Adds autorun key to be loaded by Explorer.exe on startup
        • Executes dropped EXE
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4820
        • C:\Windows\SysWOW64\Aepefb32.exe
          C:\Windows\system32\Aepefb32.exe
          4⤵
          • Adds autorun key to be loaded by Explorer.exe on startup
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3376
          • C:\Windows\SysWOW64\Agoabn32.exe
            C:\Windows\system32\Agoabn32.exe
            5⤵
            • Adds autorun key to be loaded by Explorer.exe on startup
            • Executes dropped EXE
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:3116
            • C:\Windows\SysWOW64\Bnhjohkb.exe
              C:\Windows\system32\Bnhjohkb.exe
              6⤵
              • Adds autorun key to be loaded by Explorer.exe on startup
              • Executes dropped EXE
              • Drops file in System32 directory
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:3236
              • C:\Windows\SysWOW64\Bagflcje.exe
                C:\Windows\system32\Bagflcje.exe
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:1488
                • C:\Windows\SysWOW64\Bganhm32.exe
                  C:\Windows\system32\Bganhm32.exe
                  8⤵
                  • Adds autorun key to be loaded by Explorer.exe on startup
                  • Executes dropped EXE
                  • Drops file in System32 directory
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:2332
                  • C:\Windows\SysWOW64\Bjokdipf.exe
                    C:\Windows\system32\Bjokdipf.exe
                    9⤵
                    • Adds autorun key to be loaded by Explorer.exe on startup
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    • Suspicious use of WriteProcessMemory
                    PID:4444
                    • C:\Windows\SysWOW64\Bmngqdpj.exe
                      C:\Windows\system32\Bmngqdpj.exe
                      10⤵
                      • Executes dropped EXE
                      • Drops file in System32 directory
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      • Suspicious use of WriteProcessMemory
                      PID:1284
                      • C:\Windows\SysWOW64\Beeoaapl.exe
                        C:\Windows\system32\Beeoaapl.exe
                        11⤵
                        • Adds autorun key to be loaded by Explorer.exe on startup
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • System Location Discovery: System Language Discovery
                        • Modifies registry class
                        • Suspicious use of WriteProcessMemory
                        PID:4456
                        • C:\Windows\SysWOW64\Bgcknmop.exe
                          C:\Windows\system32\Bgcknmop.exe
                          12⤵
                          • Adds autorun key to be loaded by Explorer.exe on startup
                          • Executes dropped EXE
                          • Drops file in System32 directory
                          • System Location Discovery: System Language Discovery
                          • Modifies registry class
                          • Suspicious use of WriteProcessMemory
                          PID:4448
                          • C:\Windows\SysWOW64\Bnmcjg32.exe
                            C:\Windows\system32\Bnmcjg32.exe
                            13⤵
                            • Adds autorun key to be loaded by Explorer.exe on startup
                            • Executes dropped EXE
                            • Drops file in System32 directory
                            • System Location Discovery: System Language Discovery
                            • Modifies registry class
                            • Suspicious use of WriteProcessMemory
                            PID:4436
                            • C:\Windows\SysWOW64\Balpgb32.exe
                              C:\Windows\system32\Balpgb32.exe
                              14⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Modifies registry class
                              • Suspicious use of WriteProcessMemory
                              PID:4788
                              • C:\Windows\SysWOW64\Bgehcmmm.exe
                                C:\Windows\system32\Bgehcmmm.exe
                                15⤵
                                • Adds autorun key to be loaded by Explorer.exe on startup
                                • Executes dropped EXE
                                • Drops file in System32 directory
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:4056
                                • C:\Windows\SysWOW64\Bfhhoi32.exe
                                  C:\Windows\system32\Bfhhoi32.exe
                                  16⤵
                                  • Adds autorun key to be loaded by Explorer.exe on startup
                                  • Executes dropped EXE
                                  • Drops file in System32 directory
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry class
                                  • Suspicious use of WriteProcessMemory
                                  PID:4272
                                  • C:\Windows\SysWOW64\Bmbplc32.exe
                                    C:\Windows\system32\Bmbplc32.exe
                                    17⤵
                                    • Adds autorun key to be loaded by Explorer.exe on startup
                                    • Executes dropped EXE
                                    • Drops file in System32 directory
                                    • System Location Discovery: System Language Discovery
                                    • Modifies registry class
                                    • Suspicious use of WriteProcessMemory
                                    PID:4384
                                    • C:\Windows\SysWOW64\Beihma32.exe
                                      C:\Windows\system32\Beihma32.exe
                                      18⤵
                                      • Adds autorun key to be loaded by Explorer.exe on startup
                                      • Executes dropped EXE
                                      • Drops file in System32 directory
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry class
                                      • Suspicious use of WriteProcessMemory
                                      PID:2968
                                      • C:\Windows\SysWOW64\Bhhdil32.exe
                                        C:\Windows\system32\Bhhdil32.exe
                                        19⤵
                                        • Adds autorun key to be loaded by Explorer.exe on startup
                                        • Executes dropped EXE
                                        • Drops file in System32 directory
                                        • System Location Discovery: System Language Discovery
                                        • Modifies registry class
                                        • Suspicious use of WriteProcessMemory
                                        PID:2280
                                        • C:\Windows\SysWOW64\Bjfaeh32.exe
                                          C:\Windows\system32\Bjfaeh32.exe
                                          20⤵
                                          • Adds autorun key to be loaded by Explorer.exe on startup
                                          • Executes dropped EXE
                                          • Drops file in System32 directory
                                          • System Location Discovery: System Language Discovery
                                          • Modifies registry class
                                          • Suspicious use of WriteProcessMemory
                                          PID:2468
                                          • C:\Windows\SysWOW64\Bapiabak.exe
                                            C:\Windows\system32\Bapiabak.exe
                                            21⤵
                                            • Adds autorun key to be loaded by Explorer.exe on startup
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            • Modifies registry class
                                            • Suspicious use of WriteProcessMemory
                                            PID:4424
                                            • C:\Windows\SysWOW64\Bcoenmao.exe
                                              C:\Windows\system32\Bcoenmao.exe
                                              22⤵
                                              • Adds autorun key to be loaded by Explorer.exe on startup
                                              • Executes dropped EXE
                                              • Drops file in System32 directory
                                              • System Location Discovery: System Language Discovery
                                              • Modifies registry class
                                              • Suspicious use of WriteProcessMemory
                                              PID:3432
                                              • C:\Windows\SysWOW64\Cfmajipb.exe
                                                C:\Windows\system32\Cfmajipb.exe
                                                23⤵
                                                • Adds autorun key to be loaded by Explorer.exe on startup
                                                • Executes dropped EXE
                                                • Drops file in System32 directory
                                                • System Location Discovery: System Language Discovery
                                                • Modifies registry class
                                                PID:524
                                                • C:\Windows\SysWOW64\Cndikf32.exe
                                                  C:\Windows\system32\Cndikf32.exe
                                                  24⤵
                                                  • Adds autorun key to be loaded by Explorer.exe on startup
                                                  • Executes dropped EXE
                                                  • System Location Discovery: System Language Discovery
                                                  • Modifies registry class
                                                  PID:3184
                                                  • C:\Windows\SysWOW64\Cmgjgcgo.exe
                                                    C:\Windows\system32\Cmgjgcgo.exe
                                                    25⤵
                                                    • Adds autorun key to be loaded by Explorer.exe on startup
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Modifies registry class
                                                    PID:2908
                                                    • C:\Windows\SysWOW64\Cenahpha.exe
                                                      C:\Windows\system32\Cenahpha.exe
                                                      26⤵
                                                      • Executes dropped EXE
                                                      • Drops file in System32 directory
                                                      • System Location Discovery: System Language Discovery
                                                      PID:4156
                                                      • C:\Windows\SysWOW64\Chmndlge.exe
                                                        C:\Windows\system32\Chmndlge.exe
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in System32 directory
                                                        • System Location Discovery: System Language Discovery
                                                        PID:1336
                                                        • C:\Windows\SysWOW64\Cnffqf32.exe
                                                          C:\Windows\system32\Cnffqf32.exe
                                                          28⤵
                                                          • Adds autorun key to be loaded by Explorer.exe on startup
                                                          • Executes dropped EXE
                                                          • Drops file in System32 directory
                                                          • System Location Discovery: System Language Discovery
                                                          PID:3872
                                                          • C:\Windows\SysWOW64\Caebma32.exe
                                                            C:\Windows\system32\Caebma32.exe
                                                            29⤵
                                                            • Adds autorun key to be loaded by Explorer.exe on startup
                                                            • Executes dropped EXE
                                                            • Drops file in System32 directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Modifies registry class
                                                            PID:4484
                                                            • C:\Windows\SysWOW64\Cdcoim32.exe
                                                              C:\Windows\system32\Cdcoim32.exe
                                                              30⤵
                                                              • Adds autorun key to be loaded by Explorer.exe on startup
                                                              • Executes dropped EXE
                                                              • Drops file in System32 directory
                                                              • System Location Discovery: System Language Discovery
                                                              • Modifies registry class
                                                              PID:4160
                                                              • C:\Windows\SysWOW64\Cjmgfgdf.exe
                                                                C:\Windows\system32\Cjmgfgdf.exe
                                                                31⤵
                                                                • Adds autorun key to be loaded by Explorer.exe on startup
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Modifies registry class
                                                                PID:4020
                                                                • C:\Windows\SysWOW64\Cagobalc.exe
                                                                  C:\Windows\system32\Cagobalc.exe
                                                                  32⤵
                                                                  • Adds autorun key to be loaded by Explorer.exe on startup
                                                                  • Executes dropped EXE
                                                                  • Drops file in System32 directory
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Modifies registry class
                                                                  PID:3048
                                                                  • C:\Windows\SysWOW64\Chagok32.exe
                                                                    C:\Windows\system32\Chagok32.exe
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in System32 directory
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Modifies registry class
                                                                    PID:4576
                                                                    • C:\Windows\SysWOW64\Cjpckf32.exe
                                                                      C:\Windows\system32\Cjpckf32.exe
                                                                      34⤵
                                                                      • Adds autorun key to be loaded by Explorer.exe on startup
                                                                      • Executes dropped EXE
                                                                      • System Location Discovery: System Language Discovery
                                                                      • Modifies registry class
                                                                      PID:4104
                                                                      • C:\Windows\SysWOW64\Cmnpgb32.exe
                                                                        C:\Windows\system32\Cmnpgb32.exe
                                                                        35⤵
                                                                        • Adds autorun key to be loaded by Explorer.exe on startup
                                                                        • Executes dropped EXE
                                                                        • Drops file in System32 directory
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Modifies registry class
                                                                        PID:3508
                                                                        • C:\Windows\SysWOW64\Cdhhdlid.exe
                                                                          C:\Windows\system32\Cdhhdlid.exe
                                                                          36⤵
                                                                          • Adds autorun key to be loaded by Explorer.exe on startup
                                                                          • Executes dropped EXE
                                                                          • Drops file in System32 directory
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Modifies registry class
                                                                          PID:4212
                                                                          • C:\Windows\SysWOW64\Cffdpghg.exe
                                                                            C:\Windows\system32\Cffdpghg.exe
                                                                            37⤵
                                                                            • Adds autorun key to be loaded by Explorer.exe on startup
                                                                            • Executes dropped EXE
                                                                            • Drops file in System32 directory
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Modifies registry class
                                                                            PID:4504
                                                                            • C:\Windows\SysWOW64\Cmqmma32.exe
                                                                              C:\Windows\system32\Cmqmma32.exe
                                                                              38⤵
                                                                              • Adds autorun key to be loaded by Explorer.exe on startup
                                                                              • Executes dropped EXE
                                                                              • Drops file in System32 directory
                                                                              • System Location Discovery: System Language Discovery
                                                                              • Modifies registry class
                                                                              PID:5032
                                                                              • C:\Windows\SysWOW64\Ddjejl32.exe
                                                                                C:\Windows\system32\Ddjejl32.exe
                                                                                39⤵
                                                                                • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                • Executes dropped EXE
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:1328
                                                                                • C:\Windows\SysWOW64\Dfiafg32.exe
                                                                                  C:\Windows\system32\Dfiafg32.exe
                                                                                  40⤵
                                                                                  • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                  • Executes dropped EXE
                                                                                  • Drops file in System32 directory
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Modifies registry class
                                                                                  PID:1808
                                                                                  • C:\Windows\SysWOW64\Dopigd32.exe
                                                                                    C:\Windows\system32\Dopigd32.exe
                                                                                    41⤵
                                                                                    • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                    • Executes dropped EXE
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Modifies registry class
                                                                                    PID:4252
                                                                                    • C:\Windows\SysWOW64\Danecp32.exe
                                                                                      C:\Windows\system32\Danecp32.exe
                                                                                      42⤵
                                                                                      • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                      • Executes dropped EXE
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Modifies registry class
                                                                                      PID:4108
                                                                                      • C:\Windows\SysWOW64\Dejacond.exe
                                                                                        C:\Windows\system32\Dejacond.exe
                                                                                        43⤵
                                                                                        • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in System32 directory
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        • Modifies registry class
                                                                                        PID:5016
                                                                                        • C:\Windows\SysWOW64\Dhhnpjmh.exe
                                                                                          C:\Windows\system32\Dhhnpjmh.exe
                                                                                          44⤵
                                                                                          • Executes dropped EXE
                                                                                          • Drops file in System32 directory
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Modifies registry class
                                                                                          PID:3524
                                                                                          • C:\Windows\SysWOW64\Djgjlelk.exe
                                                                                            C:\Windows\system32\Djgjlelk.exe
                                                                                            45⤵
                                                                                            • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in System32 directory
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:4824
                                                                                            • C:\Windows\SysWOW64\Dmefhako.exe
                                                                                              C:\Windows\system32\Dmefhako.exe
                                                                                              46⤵
                                                                                              • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                              • Executes dropped EXE
                                                                                              • Drops file in System32 directory
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              • Modifies registry class
                                                                                              PID:2832
                                                                                              • C:\Windows\SysWOW64\Delnin32.exe
                                                                                                C:\Windows\system32\Delnin32.exe
                                                                                                47⤵
                                                                                                • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in System32 directory
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Modifies registry class
                                                                                                PID:4852
                                                                                                • C:\Windows\SysWOW64\Ddonekbl.exe
                                                                                                  C:\Windows\system32\Ddonekbl.exe
                                                                                                  48⤵
                                                                                                  • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                  • Executes dropped EXE
                                                                                                  • Drops file in System32 directory
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Modifies registry class
                                                                                                  PID:432
                                                                                                  • C:\Windows\SysWOW64\Dfnjafap.exe
                                                                                                    C:\Windows\system32\Dfnjafap.exe
                                                                                                    49⤵
                                                                                                    • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                    • Executes dropped EXE
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    • Modifies registry class
                                                                                                    PID:4392
                                                                                                    • C:\Windows\SysWOW64\Dodbbdbb.exe
                                                                                                      C:\Windows\system32\Dodbbdbb.exe
                                                                                                      50⤵
                                                                                                      • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                      • Executes dropped EXE
                                                                                                      • Drops file in System32 directory
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Modifies registry class
                                                                                                      PID:3708
                                                                                                      • C:\Windows\SysWOW64\Deokon32.exe
                                                                                                        C:\Windows\system32\Deokon32.exe
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        • Modifies registry class
                                                                                                        PID:700
                                                                                                        • C:\Windows\SysWOW64\Dhmgki32.exe
                                                                                                          C:\Windows\system32\Dhmgki32.exe
                                                                                                          52⤵
                                                                                                          • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                          • Executes dropped EXE
                                                                                                          • Drops file in System32 directory
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Modifies registry class
                                                                                                          PID:4048
                                                                                                          • C:\Windows\SysWOW64\Dkkcge32.exe
                                                                                                            C:\Windows\system32\Dkkcge32.exe
                                                                                                            53⤵
                                                                                                            • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                            • Executes dropped EXE
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            • Modifies registry class
                                                                                                            PID:1320
                                                                                                            • C:\Windows\SysWOW64\Dmjocp32.exe
                                                                                                              C:\Windows\system32\Dmjocp32.exe
                                                                                                              54⤵
                                                                                                              • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                              • Executes dropped EXE
                                                                                                              • Drops file in System32 directory
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Modifies registry class
                                                                                                              PID:3852
                                                                                                              • C:\Windows\SysWOW64\Deagdn32.exe
                                                                                                                C:\Windows\system32\Deagdn32.exe
                                                                                                                55⤵
                                                                                                                • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in System32 directory
                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                • Modifies registry class
                                                                                                                PID:2536
                                                                                                                • C:\Windows\SysWOW64\Dhocqigp.exe
                                                                                                                  C:\Windows\system32\Dhocqigp.exe
                                                                                                                  56⤵
                                                                                                                  • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Drops file in System32 directory
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:620
                                                                                                                  • C:\Windows\SysWOW64\Dknpmdfc.exe
                                                                                                                    C:\Windows\system32\Dknpmdfc.exe
                                                                                                                    57⤵
                                                                                                                    • Adds autorun key to be loaded by Explorer.exe on startup
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in System32 directory
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Modifies registry class
                                                                                                                    PID:1480
                                                                                                                    • C:\Windows\SysWOW64\Dmllipeg.exe
                                                                                                                      C:\Windows\system32\Dmllipeg.exe
                                                                                                                      58⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:2176
                                                                                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 396
                                                                                                                        59⤵
                                                                                                                        • Program crash
                                                                                                                        PID:1004
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2176 -ip 2176
    1⤵
      PID:2300

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\SysWOW64\Aepefb32.exe

      Filesize

      64KB

      MD5

      117721d977768a0d7d73e15693844761

      SHA1

      bd097a55aa098f5f9f33d72e69dd963388dee3dd

      SHA256

      56b744bde48c945033958c708e211a2e5a16d2ab6fcb9c9d08a7174a9c048c56

      SHA512

      18d6ec282bd1216ae4e93d12a7abf04c6a7df75e1127c593b6fa45c3df88dde786c51524178957f8677d156b3541cd1e876e8ae98239045182810456a45c7e9b

    • C:\Windows\SysWOW64\Afoeiklb.exe

      Filesize

      64KB

      MD5

      e79d14852e07fff047b1996e0c88c855

      SHA1

      7998a8c97c7101ba84bb65f18f0555aa4acd87f0

      SHA256

      4614147c6e18a3c5970d51aa63be8472acc2ba4d4054c8ab253265330260779a

      SHA512

      fc2aa5f298be5a3a7e9eea6f1095ab433c740d3901b881a2aa3ed27d6fb783412c03e143a2593270de536bf5a81cc4b255f1eff87e61d5a97f7813cdfd3e096c

    • C:\Windows\SysWOW64\Agoabn32.exe

      Filesize

      64KB

      MD5

      865fdc754f1db5d299fd49a4f4535ba6

      SHA1

      33fec3bf318e3ee7c1f61afc4c52626212f102f5

      SHA256

      077319f0916fcdc9a672c5e33caeca595b7e5c6e46f38b80c913d1371c9e3fd6

      SHA512

      75e57307eb404f37c565218aae47e1d741b9f38101c290adee5d5a4f979b9da5c6a28801b72171a877c3a67134307d823789c3c0df4b2108639b5445ed595f65

    • C:\Windows\SysWOW64\Anfmjhmd.exe

      Filesize

      64KB

      MD5

      4629177ac27aca5e87ed5b245b905c51

      SHA1

      77da8d9acb5706a48bc3f3a1894a17097d5e74b9

      SHA256

      f1a555cf3d4b760075ee45c726d3376ff19d7ddb32c7e5e2aef2e520f4b62d22

      SHA512

      bf37022f95a4c246595e617aa06bf3b2caab7e2ad89bd7a8dec2957c40655a890f203732af354d68a364fae3f2859ec37cb778c3ed593e81653a11d32e590abf

    • C:\Windows\SysWOW64\Bagflcje.exe

      Filesize

      64KB

      MD5

      10c25b16b3b18162ba66993895ae959f

      SHA1

      e846b65fee63ce7ca6d8b5c56eb525271c345991

      SHA256

      d815790f6e7061629a13af9472cc8cebef3eae7210d98795bec27aec1cee3eee

      SHA512

      032bcd3cd72cc7d1829b7124051b4f6deacb4ffa7b5154d34efea016ecc73d6b7e88e847febef03354e8dcc9b8a8b539fb4d9fb28cd7c3c87ff9f119fd85cb74

    • C:\Windows\SysWOW64\Balpgb32.exe

      Filesize

      64KB

      MD5

      995c6fc57e8ce62e2a09720ccc956858

      SHA1

      021fc2602977a7f0458be7fa9f737f7231930cb8

      SHA256

      57c5b18d0717c5008aa5f457be2ab32599fec689b5761d9cb6329af9c9319846

      SHA512

      01dedd88f2c9de29425b2dcfef592869a8a0b396f903768c39dfb78bdda2eb839f1421faf6abd4b5d640f813709a0f76e4753a5de27e2dc6d2879c4438360b79

    • C:\Windows\SysWOW64\Bapiabak.exe

      Filesize

      64KB

      MD5

      d2740565a20c13cbee3d33eef2b8cdbc

      SHA1

      4ea32546367048609eece21900a852730e66da40

      SHA256

      4ee59290664848330f52e270bd296f640f5a668f4904a1d97ddb9e86cd437164

      SHA512

      b7c4149bbc8708cc4e56623c1fcfb55e2c5c71e17590c36e6e3ab52bd2fd427970bd4d10f0f3cdffbf92fd7228044d877fc111766cde3f4c99d1a784670d958b

    • C:\Windows\SysWOW64\Bcoenmao.exe

      Filesize

      64KB

      MD5

      78ba539cd5e65ea5a69fea4e86f159e8

      SHA1

      7f8bf79fbd5d7e6ba603836b8feb1d239419d669

      SHA256

      3d4d83421b246b50fc4e4e45fb3415ddd4fafe2e5da5840799c1fdd8192e10f0

      SHA512

      fbc426a93a2d2c817fda3f77368b622c878a538289cf1f5938e6d271d918d5dd95ad37e6f31aecd8df57ee0bf5c92366fd73ea5979254a22381042bae22e7148

    • C:\Windows\SysWOW64\Beeoaapl.exe

      Filesize

      64KB

      MD5

      7bd20177fcd1ae65ce615441ead124f2

      SHA1

      7e1b2bb8d40018926d8ecbb51118d54339e5f989

      SHA256

      01bfeb78abb0cc48c69941771aa8163321803e37933d6602b828ab4c197ff1ee

      SHA512

      556d9fd62c7606923ff1b97c6528ab627ddc0b868641c28cd2536107b96076d2e61c7e7b6e9372aa0f4779d81688b3e946a8fd0845a55556288c0a110d69fb3e

    • C:\Windows\SysWOW64\Beihma32.exe

      Filesize

      64KB

      MD5

      69cf8f093270149f728b6ad8b5974185

      SHA1

      a091ecc679692124481cfcf4cfbfb2ef5b375bbf

      SHA256

      fd6c6662fdf072249f670822ed261cff041223773113d775b6e5c43780594428

      SHA512

      8e4771f16ba5f0e2da3b832542bb05da61653bcf9bb87e44adbe88fa4a34357af2bff4c29d0cb2fcad227ab6cfa0637ae6e0d2fdbfbd3aa2f6566aaad2baad6e

    • C:\Windows\SysWOW64\Bfhhoi32.exe

      Filesize

      64KB

      MD5

      eb92f78151b64a98855711233f3c1062

      SHA1

      eec9cf9f906b59b69fed9490f384019033227eac

      SHA256

      95037b155feb0feef5dab678d3365822044966eaf52db13c174a2b5e82e8e816

      SHA512

      793a2c46a05183ff2adb48569ab502449832edd7932948a5d783349601c7fa9d807e7bf2ffcb0f911a314cd7fd7f2e574ff2829b6b1c1fe5b10ecc851cf39743

    • C:\Windows\SysWOW64\Bganhm32.exe

      Filesize

      64KB

      MD5

      406107a3fad077c614cef840b980c61b

      SHA1

      00bb6a7031eb6b27e94243521d4628fafe890d74

      SHA256

      7b9646482948271d65fb603fc15bc1e8307dc226638a2240d958ef31b119db7a

      SHA512

      ef71235f4ca9da95b8590cd59a0658c4c079f5d3b53ee49c0bdd18532d7db83e41e1a95a525fe6aaadcc5f9f316f89ce4fb25fc5902bdbce5cb9a33c6bb831bd

    • C:\Windows\SysWOW64\Bgcknmop.exe

      Filesize

      64KB

      MD5

      db20f109a7c857a1d8889535b20d3296

      SHA1

      4985d24b50d312c2ad849bdb097c34b2885a942a

      SHA256

      3a9377adab980d2e12f7a9a395a8805cc01345117bd429888fb33257f9715274

      SHA512

      a9f1558a33a57bb1eab7c01a3247548535db894d533202b720e4514809dfe151bc0a51771ea2f2de2689ad447177b1236bc447dcbbe6c376057ad738c432d3b7

    • C:\Windows\SysWOW64\Bgehcmmm.exe

      Filesize

      64KB

      MD5

      9dd7464ecce6e2b106b62123dc8ab118

      SHA1

      93cab3e9a22033d745ec4b2d645cc24d47a3180a

      SHA256

      f63eb729b78d7b0d182bdc67d38bd27657f9aac9e01ea7088900a22d34e419c6

      SHA512

      11a2471824c89a76e3ada7f5629915930c7fc77cefa48b05d0b35c2e2ecfc81575688e12eba8197af44faf0a221c40d376d437cc912eb3f68b7d0c36454e6ff6

    • C:\Windows\SysWOW64\Bhhdil32.exe

      Filesize

      64KB

      MD5

      66b6ff7ade84ce896c5e9d3a115d5d3f

      SHA1

      bdd10527d150249c3b1a76ff5c10f3165c3b6c39

      SHA256

      8f0e4a873ed1b4690e1156a1dc630eb9ff1f0fe91eb6e70ceb353d91e67e65de

      SHA512

      42adcc98ee688994c4245e4f1c21a89587f948f69f9647b80bd8f7e9fb4644d0728f3e6c7a3ac76ca4c53236c025d823e4518b1163c10e7df1b13a28ef695b59

    • C:\Windows\SysWOW64\Bjfaeh32.exe

      Filesize

      64KB

      MD5

      0294f01af3dfd09ae6a5e5a6805092c2

      SHA1

      47da3276b434b616929381827dc89654f9e725b3

      SHA256

      b30da591504555f9684efc5e1c1eff746cf1108e6487abe03c50ed00a4eb7263

      SHA512

      94f0c717b80686595e36b0c9fe6822e95825fdb84315ff69ad01ac8f316d031641c29b314378fb624a93cc8948bca9ae5941ce71ed3114e3b47826a606eedd33

    • C:\Windows\SysWOW64\Bjokdipf.exe

      Filesize

      64KB

      MD5

      14e845db106e8c325c93479d246ffb3e

      SHA1

      155a904807d3a58fec44725d271c56bdd4d2eb86

      SHA256

      9e486b2f5d6d827f645bd761d49cb4528a24947dcc048ceff399603b43ff4405

      SHA512

      54db06b95498de7ebbeb7900fe4d3a629d03ce6881d21381e1802e207035a8350cf44fc06e6a6c66713744bfe6a77fb6bc2e183626c511727590a064b7a74349

    • C:\Windows\SysWOW64\Bmbplc32.exe

      Filesize

      64KB

      MD5

      80299a98ab61f09cc27ff47e91032a89

      SHA1

      486029144d6d3f0e0225ae273aea09511ff5b31b

      SHA256

      9a25e58ed3996a001c25f25a0ab7b19a29858b3d627789c4faf1d9e957050109

      SHA512

      819bbd749da17124b903afbba09b6711ae24c571fc4e106489f3b2364aadd059464c9ff9e315582aec012bf5772fa43c0468dd3d40fcd36b93f201eeafab3bfb

    • C:\Windows\SysWOW64\Bmngqdpj.exe

      Filesize

      64KB

      MD5

      4001e97bcd5b223049d4b8f20717bea9

      SHA1

      92bcb01fcc3fc824fc0821fdd5e0d7b970e12db0

      SHA256

      b885dd028816e33b1decf84784500215f89923ba14677eb64e1a795bbc10ce0c

      SHA512

      608b93494b1eac9ba29c9dbcb1731ddd1222941467e0de948b9fcba67a151d23073110665876eaef71412f083881411b9313ef809f625d9d3e02473276edbafc

    • C:\Windows\SysWOW64\Bnhjohkb.exe

      Filesize

      64KB

      MD5

      299ab0441e514548bf19d3a0f091f204

      SHA1

      0da13c6ec78fe244b6bbfe2c33ee0aa7ca9e8202

      SHA256

      35dd41e738f806105d82363c107e62f518e26782a876e3cde26098c5024d0365

      SHA512

      b67664316480db802c48b3cbac7ea595d29cba2b00f9a03d5ec7e1942e82b09759412cf4821e51b0e65227f48f802148c375034b9847492cc9bd3171e80b589e

    • C:\Windows\SysWOW64\Bnmcjg32.exe

      Filesize

      64KB

      MD5

      ab54669cded6c96b2edc24fe070dc13a

      SHA1

      2d3cc408d5b3011a026c3e71dc133cf18d2d9a80

      SHA256

      90b7bc083fc65431cb325b3cb70b8f765857d2d06f9e491072df92ab8ee6a725

      SHA512

      1399ee3733385359f72d24c88c3003aa0ff20f5f6b1efea2bedbee9d32b89e661b70707c7fb977b2791954ce7a7c38ecdccff1c156043d4bbc1f0904b81fac90

    • C:\Windows\SysWOW64\Caebma32.exe

      Filesize

      64KB

      MD5

      f4b30dbee493ff6dbab8549a52f351f7

      SHA1

      53c989ab47f5ef38597a4292b5d52256b324bb5b

      SHA256

      a84c7fc62c68bf5a656dd4ce758ad1d7573e57f98eb426a2fc1802161052804f

      SHA512

      51cccfda354a1058572a28461fa69f7d62680bf51d01bdaf73034b2db9984c4aa094c77867113de491d5e7535c72d4c6679fe57cff11b9d2d6d272096f7a569c

    • C:\Windows\SysWOW64\Cagobalc.exe

      Filesize

      64KB

      MD5

      f4cebc2e050285704a0716b0e2e0e0d0

      SHA1

      e9bd2b8b2d19b5e81ac591d5d99fe5327925f0f3

      SHA256

      043344ed202d25ddb66b001c93760c62c79f8416b56f2a69d69cb274a325b9b7

      SHA512

      cd8b1d87e68bf6fbf21c89edb6f2c9e16960fa3fcfea4e8771bb4db183817461774319828821210c728ad58124be654e22f86f35abe8ca039246a91d376c372d

    • C:\Windows\SysWOW64\Cdcoim32.exe

      Filesize

      64KB

      MD5

      0a75e0e581b35281dc0f419a4e93444f

      SHA1

      b1214e819b8f1cb8bc8c40993e184d3964e7fbd1

      SHA256

      2de7768058e1a2f7465a48bb5b4a43afcf425965b79e102d394138bdc186a2df

      SHA512

      ac888e182c78040d2836e0627263357cbc558cb5c8d4f4ea309c416817584a886912f92e23b561cb92a2b0a3bace1b4c6bf4b1a0cc853b2c2b15a25e45a8562e

    • C:\Windows\SysWOW64\Cdhhdlid.exe

      Filesize

      64KB

      MD5

      8b7137531fcbaa7eab608a14dbefe499

      SHA1

      1ec785c40162b39c81e5303b4d3aabb5d65e8779

      SHA256

      57f080eccddb6b711d6becb3a1ffd9145d4c8f884d3be151ddb0ce0d74a13418

      SHA512

      c91bfebb3d502f1d2ba248a1b00f53887903ff8994784aab444be41aa9f271c1e405179a2f90ae6bcabc28213200a0c2beffeb1f42671535ffb53c40a921def2

    • C:\Windows\SysWOW64\Cenahpha.exe

      Filesize

      64KB

      MD5

      1ee75442cf239d2090f88fa75f3bd5f8

      SHA1

      f47131798c8847242ca7da90d5f238a6a9b91863

      SHA256

      67e6ca915022f1a69786767c8f9540fa34940f1f9ff96d576d4528077a78952a

      SHA512

      569a8892ebac2ef045e8ea381900562c5b62c7e4df2a45be657f0a41efb00d74691d96fc02d931b8e0aed6e31ddd195f47b0f08cc260d39805e058808ff55dbe

    • C:\Windows\SysWOW64\Cfmajipb.exe

      Filesize

      64KB

      MD5

      0b4df919d86794df2c1f41864518eb0d

      SHA1

      5d20c2d336fef98ff479cdffaca287594a02d418

      SHA256

      f93e3207658bf6afb234f8f556ed6ac6ac0ce892ca7be34f7669887311871ee6

      SHA512

      5daa6d639db19b58b5b6f6c668bb8813ca497bd516f9fec00a788916e045d3492686b0ec099ddc61111cfb2a99cce228241b9fffd00a80e1df7c51adbea94bb9

    • C:\Windows\SysWOW64\Chagok32.exe

      Filesize

      64KB

      MD5

      cf3dfd09462655284311a22ade5768f1

      SHA1

      9bb15183c52d0e9b0e5dc18d3b8ad4afed8f03ea

      SHA256

      e2c6b111748d16f4c3368cbae5229d197afe427a340b6ceccdcb93b01ab04e70

      SHA512

      ea8db8cca2c204381d1e7f8959b3d8195eea759b84a55cde8f28056774d5fe0d6546c13f31c7c78327a61b788f1d9c1c29e4ea4e33e2c6f4ee2c7c16394b1696

    • C:\Windows\SysWOW64\Chmndlge.exe

      Filesize

      64KB

      MD5

      e74fe97a435ddfef9348f22e3b06b46d

      SHA1

      d4d88198009a2110da39428dce7ebf5b84e9e37c

      SHA256

      656de12dd60acb2048d9af562e4905e39b7987f6e9fc80444d4106da2d56a762

      SHA512

      2d292e71aed06bc44eb1b6c76c67079a82d7a082a7193c18761ec9fc210826dee5358e49129d2160221c9d897c9ffcdfc73d051dc12f53a72dbdfabf88372713

    • C:\Windows\SysWOW64\Cjmgfgdf.exe

      Filesize

      64KB

      MD5

      c932ebd554ba69de4ec3335ca39a4078

      SHA1

      287cb5ee31307abe13549561c603d1d59d047257

      SHA256

      53a57ce9abbd9cf99f374012c2e4189127108e0d1e30e795a641baa17fb5ec9e

      SHA512

      9e41ee90a1fbac13ac867ff8201601b0a07f82e0884e80cf57a01cb2945ec100d6a0d941fbbc6bea1388bff74aabfe0b96c4efd4d027569986215ed63387e1fc

    • C:\Windows\SysWOW64\Cmgjgcgo.exe

      Filesize

      64KB

      MD5

      2dc26af63dc44cec8019eb91edf5e091

      SHA1

      d3190d51c457a4afe9b397c5373f8775e161a4cf

      SHA256

      7cc3b61201ba47406cf31734c2431c161b9d78e515403bdc6a5c3a03da8e34ab

      SHA512

      476a061a49c70a49c46c0f6b2e9b00f3904d0a54c17b88f169c965d8fd52a3e6566898bb2d29de44009b460670692593006c6a00e46d3c6b82e9d5c7dc69fa6a

    • C:\Windows\SysWOW64\Cndikf32.exe

      Filesize

      64KB

      MD5

      b12f73a0f5587120826043cb05d0a66e

      SHA1

      eed764137115124cf3e2a8eb6727dcafce884d7d

      SHA256

      67a936e1dc6134ad08073082376a0ad184babda0cad310fdee2bb3e4aaa68e1f

      SHA512

      e06403fad48cb649e37c95460dd5b5f58f6824bd5d12bbcc22167a4d8ba190e4674b346c69a2bb1fd607fcda39c1ca660027bb5244c335169a128b9afdea323e

    • C:\Windows\SysWOW64\Cnffqf32.exe

      Filesize

      64KB

      MD5

      e6766ce8cb3145d12cd610a2f6228ce7

      SHA1

      3873f96b7fd249d0332fe048a626b9003fca7671

      SHA256

      5b53adf6594e9a1254420d06a961333fb8e3d6e87a8143137ace6054a6c418b3

      SHA512

      256c697339b2238d090b27982d772ffbf6f8ef04e165fad9ce15f8467e2ed1cfa30a5fe2c283e6245a5ff08fb3ebb9dec332615ab0e0bd4647fa3370cbc2d8b0

    • C:\Windows\SysWOW64\Ddjejl32.exe

      Filesize

      64KB

      MD5

      2623cc79c812ee05d8d76f4fd5a51fea

      SHA1

      a7d18662f877fa434dcf7ba987aa0100754057d9

      SHA256

      5abdbf26e74b8e121b0fae9cb7cc74c625d2f92900040adaa06b03f5bb105aee

      SHA512

      5d3fde3654578802efdb449a52a15d77cd0ba72f8578c8f720276971f9b75e6df23d733c9741a2ae1f12c313dfc44affa8b805a0b10c4fcb4fa0728922cb3c42

    • C:\Windows\SysWOW64\Dopigd32.exe

      Filesize

      64KB

      MD5

      0d3f030b0a63d9bd297c37a7166de559

      SHA1

      4c0bd3fab5d5bac1b797d170b88663a7cfa84f2d

      SHA256

      dda74b027e6a09c4bb52d62c4f2f7bfc7efe463e028db5ff159e37df52895c2a

      SHA512

      60c08bb05be90e46186cc66ad0910c5866b7c5de1903e34d1334b8d1339393e6d5aef6a97b9a95d1b795ed16f9d7f82fe2738ae3416744c026fb9e981546ec5a

    • memory/432-347-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/432-428-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/524-176-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/524-478-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/620-413-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/620-395-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/700-365-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/700-423-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/1284-72-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/1320-419-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/1320-377-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/1328-293-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/1328-446-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/1336-208-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/1336-470-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/1480-411-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/1480-401-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/1488-48-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/1808-444-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/1808-299-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2176-409-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2176-407-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2280-144-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2332-56-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2468-152-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2536-389-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2536-415-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2832-432-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2832-335-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2908-474-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2908-192-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/2968-136-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/3048-248-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/3048-460-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/3116-32-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/3184-185-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/3184-476-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/3236-40-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/3376-24-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/3432-480-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/3432-168-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/3508-269-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/3508-454-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/3524-436-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/3524-323-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/3708-425-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/3708-359-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/3852-383-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/3852-417-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/3872-216-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/3872-468-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4020-240-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4020-462-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4048-371-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4048-421-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4056-113-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4104-456-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4104-263-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4108-311-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4108-440-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4156-472-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4156-200-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4160-464-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4160-232-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4212-275-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4212-452-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4252-305-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4252-442-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4272-121-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4292-9-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4384-128-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4392-427-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4392-353-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4424-482-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4424-160-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4436-96-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4444-64-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4448-89-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4456-80-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4484-466-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4484-224-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4504-281-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4504-450-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4576-458-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4576-257-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4768-1-0x0000000000431000-0x0000000000432000-memory.dmp

      Filesize

      4KB

    • memory/4768-0-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4788-104-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4820-16-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4824-434-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4824-329-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4852-430-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/4852-345-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/5016-438-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/5016-317-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/5032-287-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB

    • memory/5032-448-0x0000000000400000-0x0000000000433000-memory.dmp

      Filesize

      204KB