infinitylock | cfa4daab47e6eb546323d4c976261aefba3947b4cce1a655dde9d9d6d725b527

Analysis

max time kernel
86s
max time network
86s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
31-08-2024 20:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

[email protected]
Size

211KB
MD5

b805db8f6a84475ef76b795b0d1ed6ae
SHA1

7711cb4873e58b7adcf2a2b047b090e78d10c75b
SHA256

f5d002bfe80b48386a6c99c41528931b7f5df736cd34094463c3f85dde0180bf
SHA512

62a2c329b43d186c4c602c5f63efc8d2657aa956f21184334263e4f6d0204d7c31f86bda6e85e65e3b99b891c1630d805b70997731c174f6081ecc367ccf9416
SSDEEP

1536:YoCFfC303p22fkZrRQpnqjoi7l832fbu9ZXILwVENbM:rCVC303p22sZrRQpnviB832Du9WMON

Score

10^/10

infinitylock discovery ransomware

Malware Config

Signatures

InfinityLock Ransomware
Also known as InfinityCrypt. Based on the open-source HiddenTear ransomware.
ransomware infinitylock

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00444_.WMF.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0293828.WMF.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR2F.GIF.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\WebKit.dll.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341554.JPG.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382967.JPG.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0195812.WMF.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14794_.GIF.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\FSTOCK.DLL.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382944.JPG.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PSSKETSM.WMF.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\EMAIL11.POC.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Internet Explorer\D3DCompiler_47.dll.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\MSPUB_K_COL.HXK.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\TAB_ON.GIF.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\MeetingIcon.jpg.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00555_.WMF.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR12F.GIF.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGSTORYVERT.XML.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.XML.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD01548_.WMF.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105386.WMF.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Aspect.thmx.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18193_.WMF.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\validation.js.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.CO.KR.XML.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN082.XML.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01629_.WMF.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105282.WMF.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0278702.WMF.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\TASKREQ.CFG.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME34.CSS.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\SMSL.ICO.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Americana.css.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsPreviewTemplate.html.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS01634_.WMF.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0301418.WMF.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\GKPowerPoint.dll.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR11F.GIF.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\UmOutlookAddin.dll.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14752_.GIF.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21298_.GIF.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\INTLDATE.DLL.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152414.WMF.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01130_.WMF.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSCOL11.INF.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\THMBNAIL.PNG.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107516.WMF.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107152.WMF.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\STSCOPY.DLL.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\WSSFilesToolIconImagesMask.bmp.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Biscay\TAB_OFF.GIF.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\ONENOTE_K_COL.HXK.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR3F.GIF.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\MMSS.ICO.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01357_.WMF.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0297551.WMF.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BDRTKFUL.POC.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\PREVIEW.GIF.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152626.WMF.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382950.JPG.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	[email protected]

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	[email protected]
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	[email protected]
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	[email protected]
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	[email protected]

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961_auto_file\shell\edit	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961_auto_file\shell\open\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961\ = "9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961_auto_file"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961_auto_file\shell\edit\command	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_Classes\Local Settings	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961_auto_file	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961_auto_file\	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961_auto_file\shell\open	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000_CLASSES\9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	rundll32.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2260	NOTEPAD.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3056	[email protected]
Token: SeDebugPrivilege	1244	[email protected]

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 2260	3036	rundll32.exe	37
PID 3036 wrote to memory of 2260	3036	rundll32.exe	37
PID 3036 wrote to memory of 2260	3036	rundll32.exe	37

C:\Users\Admin\AppData\Local\Temp\[email protected]
"C:\Users\Admin\AppData\Local\Temp\[email protected]"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1244

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2220

C:\Users\Admin\AppData\Local\Temp\[email protected]
"C:\Users\Admin\AppData\Local\Temp\[email protected]"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3056

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\Desktop\UseResolve.rtf.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\UseResolve.rtf.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961

Filesize
5KB

MD5
5afeb00499e1084a2470e02e99c54a92

SHA1
d27fe9b46157f04bf73064f2e61e6e7ea3b751ff

SHA256
f55c536b78d4ac9470cd139905a757b279ed234a392ae307b4e4b92f84b642cc

SHA512
666b8309d8b254a54481a9ccc95ab739eec3b53dba6189497737b76f211b2fce3c4268dd6ab7808f76bf96b719b53e83ce7ef21236c2ccd84bfc0826b214384e

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\helpmap.txt.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961

Filesize
17KB

MD5
b44a972eb32ced1fced0ccf673875bda

SHA1
585f965a6cd9867c2d45a1224be2cd656d661bed

SHA256
44acbe7a2b35ddf2b837de36bcc6839e1878b7f930736f1a92e586e5a2f53afc

SHA512
f15309400cc2fe10590a7b5fec077283a38b0525c6338851accc7155d7a9eaa44ddfc6a85effd3556e5ea53fea0d2ba40ff2b5fe6880eea3b1b413d24e8e04e9

Download Submit
C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\helpmap.txt.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961

Filesize
17KB

MD5
9537bffd5dffe230640d128d8d04a0f0

SHA1
1d12449b556a19e7b270143ad971766addf150b2

SHA256
af44e1ba62dc364265507072b68900d3b8ba972a46206605a545e60ae7cb0d76

SHA512
3565c09f4a79737b5ddf01a5700fd93a65eec5f7d47db889b6c8116a8cbb029acd0beb43134b8d70d7bfe13b1e1cfa94a924b6337148e69b952a30a8637c529e

Download Submit
C:\Program Files (x86)\Common Files\System\DirectDB.dll.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961

Filesize
23KB

MD5
111438993a3848dd79112b3ffbf8618b

SHA1
57bd2bd603cde2354c78515191ce2ca9e4a73ca4

SHA256
4988ccbd548c0292d333a42fc7b6433f6b5f268f3513d96f79446f7ff45f621b

SHA512
3f0234415f3b630180a2edf1713f54ee68d5ca70b4ffb7800f36f16930c9a53f38190375d83927e8bf597058a91a08604f81fe5b27b322ee4fe918aaba617811

Download Submit
C:\Program Files (x86)\Common Files\System\DirectDB.dll.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961

Filesize
23KB

MD5
22193ec01b34ab7579d4dd943380f96b

SHA1
f163f67c7ea9fde65b0afbe1fb052739bc9ac529

SHA256
b05e3135ab5cd39af13b99b70d0bc1d793e5bc29a5fd187689627db3c829675d

SHA512
c72696c04e6eb0eb80b5e5b00c62249ebcae309e6259f9fd46cf978cccf05728398c883cd26ee8b14574a80ff8b00db24d598971cc38c70537d9c7feb58b4ecf

Download Submit
C:\Program Files (x86)\Common Files\microsoft shared\DAO\dao360.dll.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961

Filesize
596KB

MD5
05d7f9a34d9ab99b8950528d3bdfc4d9

SHA1
22a7b4e733b0f87b6e53b5a9be043597ce91be63

SHA256
a96a63c761c9b8e7b537324ab3e5785c1bf2261b973dce031378723961023cef

SHA512
d1faa9169b827055f81c2e731fe0a7b87bb136f260a1152e0dc6e533f0f481ee077a528d781daf56e6dfd7f476b91f7b56f651d12e1f9cd7cecc16e329ff786f

Download Submit
C:\Program Files (x86)\Common Files\microsoft shared\DAO\dao360.dll.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961

Filesize
596KB

MD5
d5714724527c9140d58329361e553dee

SHA1
2d58a54918ff456a0c49ea1c0044c32db8e08c76

SHA256
e0f2b89fb9b38103cc604dc20e031adff57ad186c1821528c5e144e8f9012b89

SHA512
f2b1ddca8bc8ae142f86f4445809e40e56b34a096e69fc5fdb2639514e491129c813edaa16ec381dd51f9a061de3189d1c0ded9f9e0de25777f9fc7abad25db8

Download Submit
C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961

Filesize
296KB

MD5
2a420a07f0f53c358366d179e91a54b9

SHA1
c121efab20fb19c89642df5d07149d63f46baa47

SHA256
e7a570e6b4184ef57179123c5a3bf767f46cd83c701919619a49f120b83699ed

SHA512
09b94659ca6ee4d35a3cb1223c9d29057f92dc8a6255ce3ed88c2095f612c36c735c8789befbb6dbc53ccfc4a0aa37ab5b62cdfb7980fd6e41a517ad860edda6

Download Submit
C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961

Filesize
296KB

MD5
d55f0a88af27c84408a3636c3d251448

SHA1
c82ab1ef15ce4c2ada8fdf9a7e9d81b7246cc6fa

SHA256
bb405113a548bbcdb2705b3daac6d262ead72abeed907aeab85b37a350bc29a4

SHA512
12de3b7d446d55fc50146ed78d94f6e1a066a4ccfdcac136cc8d927e6b870638db125fc129b0dc123766f410738725f5ea81baac96254692371fc9d46aed9c78

Download Submit
C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Bears.htm.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961

Filesize
256B

MD5
1acfc8b06097a380868f9d94764937b8

SHA1
281a37dfe5c5dc9c9428b1f43031bc08125fab7a

SHA256
a5b03480a3645857147910a6fdcf0881f74fdf90abd85fe96913cec333bdf450

SHA512
c709a030da940edaa0987cfd0d9c0f5992b364f416f7e994f0571b84592ce7b1a9b85a22adad8c8d6264889d93c7a08e75197ccfc1ad44f76a400a4f7fd01dd4

Download Submit
C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Bears.htm.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961

Filesize
256B

MD5
b8d7dc430bc889cceb94ddbf938e146c

SHA1
3a4b1436696b7320cd838a85d51e2ff0f93d88a2

SHA256
3c764c4f76d7c87ff601b380d3c11d68ec432d37d954f5567be8fae44bd02021

SHA512
49140758e46f3b9d193fc9f2ec0ec53c0b386fa053f4196a1539fc162338a636fff1f339662448496ae5d64ef0335b833f6d9698f6f336a75ff93bcd3a6ea3da

Download Submit
C:\Program Files (x86)\Common Files\microsoft shared\VGX\VGX.dll.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961

Filesize
208KB

MD5
2ab26c5b1b91379d901656cf9869f071

SHA1
5a90cdbecb3a501601711054d5b3bb9467f9b1b5

SHA256
6154dbf44ae408c7ae398db41c1e0888df0c541b2e21d307b02058d2bb34538e

SHA512
ae6a3b5cda9a730296716b83fb811205fda6b1d1906ea12c4cabf5d4b9b5266e1fb3106e58448bfd9178c050637eb2fdbd2a802278f13838e414fdb04a26abd4

Download Submit
C:\Program Files (x86)\Common Files\microsoft shared\VGX\VGX.dll.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961

Filesize
735KB

MD5
2b78d056f042f829846d74b87cea7053

SHA1
966c760765d1585c2fd033e74518567ad2f62a7c

SHA256
da97bbff4772a6b3bb6dd3a9874644b822f41e5d803ab4d8a1edeeeb9e0d10a2

SHA512
7d96f8bf47f57f6eae69b5229c95f8ce49b278ce5a849b7e286ddfa753cdf36ae2dbd835077a2ab09da84d2b68a03a708cc92b6e739e4305020f61296876f728

Download Submit
C:\Program Files (x86)\Common Files\microsoft shared\ink\dicjp.dll.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961

Filesize
9KB

MD5
d3d8e9e3253d431020dc8d011adcd8d3

SHA1
955a7d5b4c2c16ac20e5994164d832be1fadd925

SHA256
dfbb995c0440058570cf90b41ffc3c383fbdf435a9c5aaa51a34220299419b4e

SHA512
9566cb28e6781320c20911e0d6f727ea5af252f032f8098ed5acb603eb367ce2ac3e27603e7a07741eed12dc4a891fe5c7d0672e4f6e571041fe840b61588e2a

Download Submit
C:\Program Files (x86)\Common Files\microsoft shared\ink\dicjp.dll.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961

Filesize
9KB

MD5
b4453d6ccb45d8b738269f8094867e09

SHA1
c9118a5a10d7e60d1bee205a5d66a36d90a8f47e

SHA256
15d34b9630e65a2b83be4a551280303deecf3884be83c31f085760e7f408f9e2

SHA512
01a13e11fced9f16d04fec0f6370f387e1a1be6f9abab8fbec9b528d4e08dcc17c62b2a125dde417549aa3cabfb4b2cdc4c564f5c21542f0f267f7f19bc3e514

Download Submit
C:\Program Files (x86)\Internet Explorer\D3DCompiler_47.dll.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961

Filesize
3.3MB

MD5
6da746f60e5e0ea4d66bb018d487b709

SHA1
dad0f6947e5458811d1efe8ba2c0718213126725

SHA256
e1b90d89498fb6fcb99aa4db362fc50a1a896fa90058b905e52eac3ec74a9ac0

SHA512
432e512da5a96df8a1206e0b594d990b4ed53beed767cb62760ac250b56e1ab8a08e649b4dffebabf215cbdc6cc2a6b8190759143922502407784b9eeca1ca1c

Download Submit
C:\Program Files (x86)\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961

Filesize
7KB

MD5
38be25278fb8ddaa189d97b885589247

SHA1
fc3350cf904b4a3afbd42bd203def041538083f9

SHA256
53a4589f3f88e0cf6a11ac9f7be9ce389be03652643145bb8a2033cf45f20476

SHA512
6bac8bf75d53a43d30f82c824bbc4f5a169d3e23c15bde44ffa04cf84a3cdcbe92ff017c2ac44df43c701cbf0fd13de82006360c5a33f0ab6bad269f2e7059d0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\TAB_OFF.GIF.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961

Filesize
352B

MD5
da151eb173c1be0518d41f690974f6e6

SHA1
acb4e1c300971a81d1d538f910d450ebb64b6c1c

SHA256
cc104764f9ed9e0a407e48a2a50e2b843873fbd4d701b50ee9e5d5824b491607

SHA512
95e0b129fe8a54bc0cd9ad8bdd5e4b1b986a7c657e574e4e63e4b278db48068c867e8ce44767d5d2b20fedd1bd8431509b1432cd8249f9087c3a191a1439625f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\TAB_ON.GIF.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961

Filesize
224B

MD5
7675851dd20e4070f7d22ea72ebf71f1

SHA1
820333fe081773f6d11c5b6118bf46f7a9cd51da

SHA256
1f1fc04957221878a2bbede5ad85e0f9ab56a5cb871b66e5f5c26cfccc1889a0

SHA512
2e52a109239e472df3f8f7d640ec477c592ea0592368bbb5cc375f1e47c4bb0192e0778bb9e6be4b69b54d49bf80ae0ff4173899e4048edd11e1920165340163

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATH_F_COL.HXK.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961

Filesize
128B

MD5
2b2026512a60b55750b91911f1c5c3a6

SHA1
b7d505912805f9cf25190d03f964fa862bae089a

SHA256
1b61260963877d96b5212b3f57011b200adf35a9ff2b2d833ff4a5a466c7d0aa

SHA512
3ea34e449635e33388117e59367b630262615325edbf758f3ea6637dc641f0a8a4a70d9b659010f9b010bb0ce3242391ce41495e11efba950ebb3bdf209291ac

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATH_K_COL.HXK.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961

Filesize
128B

MD5
6c579de7fa873dccd0bbdde7bbdacf90

SHA1
34643e0e13fd487b8f5d45abd1cb069d7445c2e3

SHA256
215384098c45fd4d10a60e9fffaf4a3846c8938a07d24d3d62ff35907e3fb789

SHA512
32e1be9c6025945ef50dca838bb971c3e6abda9a1508f09868ae1e7c7d06117f3cab544f88f46baf22e5fe7c09b0069b974445ac071a31c602a31653f752dca2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\BUTTON.GIF.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961

Filesize
192B

MD5
3f52ed947d6b823bec7653434e578c78

SHA1
e3347590067f5b4a674f12d0405feae3a3baf7af

SHA256
5f9043e837d46318f3c065609392af8e591e9af7ac47aeb1c6e42db7d7a8236c

SHA512
602b1db664037a98929057c36307f83fd3dbdd8343e6fd4723789e1457d4ad71f014fc0189c1cb261ce218bd67a1e94cd710d2db224d8bf5c0a7620ab8daa3b0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\TAB_OFF.GIF.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961

Filesize
512B

MD5
f6926a0b0009f37ce3d4717813ff4f46

SHA1
989efac3bafefb4d9258ef710bfbb10d8ed37008

SHA256
4df9e4db85c2f1f1b99b99bea6f34ea7e0c196c8a02d2ffa380d256d8d17e735

SHA512
c0a098972a54fa0c0ab83c7a0c93973ed92b0c36ecb46b53acc4881cbe958e856b69c2b0bad34c3a49dc5c048383de3d6ca4f0bb4a917cb01142b57ba186aa02

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\TAB_ON.GIF.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961

Filesize
1KB

MD5
1f9bfedfd9ac66c357c705288f46c860

SHA1
92388a8f9c07ec466894a575deec7835865355f3

SHA256
d5d59f57593f693492206da25ae9f70df3061cced8808d09480e6ac6490002ed

SHA512
ec52bd9394b0e08189e8bbd486026aef2e07df7f44bd5f7fe290413fea429a89063a91b63e36bf067e4bf552de3370a69c7be5ca2d6bfdf3708dc24e26700c59

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.NO.XML.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961

Filesize
816B

MD5
51409ffd4c2ba22e399e11ac16d60a5c

SHA1
7c6e8c44c767efbc0902403a61e57cee33c8e2e6

SHA256
80508b1eae6bb08bdc817746e199fdbce56bf2e0969b40cecfb5a4a05c5acbc1

SHA512
a268e027e66203f5e18e5445a1c94b7cf30a7ad4172089a376b6cf6130fd7024cbd8d73f5c5d397404c2570de63d4774ac811d7a7dd3e6ade2869c1fd4d83f66

Download Submit
C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_extended.xml.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961

Filesize
8KB

MD5
4738fd15999b357a5d102b154d38b430

SHA1
ee7fb5e35bafb2a5ddf4305eb0ce5dadc346250c

SHA256
779b4dbac30bf4ca519688e763eb66c84396dc5d47ead74aca63c9f919eb65aa

SHA512
7d3284ab48d1d15c1def2d3a08cd78aeabb2b17d7919961597c16b95908cfe345fabe2587027b7f7c62394bc9e19363d7a51a0ae11e17594660f03d7f4b7850b

Download Submit
C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Conversion.v3.5.dll.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961

Filesize
104KB

MD5
106bd256b3b1673547638c82a414b96c

SHA1
468d392632fbe5d578b2218739f4ddd0a8c92bb3

SHA256
9483b314459e88071d1656a34dfd8e8559d9a9dc625a088c74d88f98b668bc4f

SHA512
6b87084b6d7656ef5ccaebc6d6ac57c807703193d2ef10171c7b4ab03e813a3bc78dc3b9d5ba41ced95764ce7130cd511e8d3278cb245f79c6d146a371bade57

Download Submit
C:\Program Files (x86)\Windows Defender\MpAsDesc.dll.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961

Filesize
9KB

MD5
f76da51f10d7ede3dba1f5e35a9387e1

SHA1
1e74e1104effb5d95b33f96dbf6aef9bbbf15152

SHA256
3fde6e14a475a7c05e7e290f0199cf1c285d8bbd1018d335e3ae522ec26e3898

SHA512
d10e53aeab13d9c6422d815c56d11a50ee62f53231d7375d469e8ba7ea210200e88c60c92c005682cd6a8383ff217e24583f8d862944be20335d39c23bd2ee57

Download Submit
C:\Program Files (x86)\Windows Media Player\mpvis.DLL.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961

Filesize
150KB

MD5
b9b1e9ae8558f5ee22d1a41d555f1def

SHA1
673f4442aa8735af62cf17097ad49b801bb4001d

SHA256
b42fb6229b7f8f191c753ec7ec9943c027e153879205c5554ab4d82eaa11bb9d

SHA512
0918f768f8447477e7c7ac7befa78e9dcaab146d47ac14d40008ba423e355b44320451a0da3861f9c89fac6a8fc5f0b7b33c0e0d50f19d3067a6e5e549dfc84e

Download Submit
C:\Program Files (x86)\Windows NT\TableTextService\TableTextService.dll.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961

Filesize
317KB

MD5
3e7b574401dc76af4f7d2d5f0e44b2b8

SHA1
1ff043ff2a2ca4a2420e0b43457812d894a776df

SHA256
7c9c4cf609b3fda8d6a969db7a24d057f0adde00cb7d863e906cd9b995d38c2b

SHA512
d71129b1aeeebf51c1ddd8853fab4a79a97988759b687eb94e4098684c1a114f3a1aee597bccd7c1b875e06b6676a222de2fe8df282550cf7e6da3da39dd9558

Download Submit
C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961

Filesize
90KB

MD5
8bf1e3a3af9fec9737dd5b703019eff8

SHA1
ba9489c49995e18d3d7505c27928ea264ceda03b

SHA256
0aac7770f8cafe6e5c674d3ce20072426c40ebe8f98fdb7c959e0af349afb99c

SHA512
f07741ac3a566046b1fb2ef856fb9fc4b567a390c3246a9772ac2e3d18df25ba52b0b5a14bae16811cbb9fd67132e7e78b1965442349302a1f47c1697b25ea6b

Download Submit
C:\Program Files (x86)\Windows Portable Devices\sqmapi.dll.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961

Filesize
185KB

MD5
8e98ea4cf8b2b9d32f02c17d6ede825b

SHA1
966492f320d779b7be6ff1809443d60667b82461

SHA256
08ec513a93a320f1ee3a3fe74d5700c2ed277bc27ff9afbe41e883293850033d

SHA512
682b317cab51168d082b4e3bd997aae5bd3b230d95828fa50e0b926071ae5e08b420c6ca8735ba181499ce92f3356eee572c8d2b10187297bbbf3b7e08b10c80

Download Submit
C:\Program Files (x86)\Windows Sidebar\sbdrop.dll.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961

Filesize
81KB

MD5
d182c483956a13a295c2be661f69e1e3

SHA1
98996d2981a5c30dfb50ef74dc52ce2ebf499697

SHA256
7c6213c42253f3fde2336a168d037832b6ef57e3da2c0f135b4975655de2705f

SHA512
2e7da7ad35c8c7094eb537300ddeafa6f399b30958cca3c4ffd834e5688829ac4e4f2be05a4cf214f8d1fff1edbd207810fe51917eddac6755f0b620fd9e9314

Download Submit
C:\Users\Admin\Desktop\UseResolve.rtf.9009E89DC5A1DF84C0D82DC4090C39167A350ECABDCC5FCA04C0655F875A1961

Filesize
94KB

MD5
043a92dc0c0e815d6dc280d9f98cc130

SHA1
48d5925acd20fa6767498d29190f829013753306

SHA256
cd8ac0a15524db5671135351500a2a09c6fe303233a045e8223046fc3e46000d

SHA512
f946c99bf02fad117fe96419cff2f8097e96d3677f63a21825d5d7621b4c9e1d76e81ad01e7f966afb1c6748df4f36de9b28e0a40741ec850d7a9818149552f3

Download Submit
memory/1244-501-0x000000007466E000-0x000000007466F000-memory.dmp

Filesize
4KB

Download
memory/1244-0-0x000000007466E000-0x000000007466F000-memory.dmp

Filesize
4KB

Download
memory/1244-561-0x0000000074660000-0x0000000074D4E000-memory.dmp

Filesize
6.9MB

Download
memory/1244-2-0x0000000074660000-0x0000000074D4E000-memory.dmp

Filesize
6.9MB

Download
memory/1244-1-0x0000000000C50000-0x0000000000C8C000-memory.dmp

Filesize
240KB

Download
memory/3056-4857-0x0000000074660000-0x0000000074D4E000-memory.dmp

Filesize
6.9MB

Download
memory/3056-5136-0x0000000074660000-0x0000000074D4E000-memory.dmp

Filesize
6.9MB

Download