Overview

overview

10

Static

static

3

b55bbba152...3a.exe

windows10-2004-x64

10

b55bbba152...3a.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    103s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250502-en
  • resource tags

    arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    04/11/2025, 14:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
  • Size 2.1MB
  • Sample251104-rcljrsdj4x
  • SHA256 b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
discoverydownloaderdropperbanloadtrojan

Malware Config

Signatures

  • Banload

    Banload variants download malicious files, then install and execute the files.

    trojandropperdownloaderbanload
  • Banload family
    banload
  • Checks BIOS information in registry 2 TTPs 64 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 9 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 64 IoCs
  • NTFS ADS 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
    "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:552
    • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
      "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
      2⤵
      • Checks BIOS information in registry
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • NTFS ADS
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:6076
      • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
        "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
        3⤵
        • Checks BIOS information in registry
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • NTFS ADS
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4424
        • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
          "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
          4⤵
          • Checks BIOS information in registry
          • System Location Discovery: System Language Discovery
          • NTFS ADS
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:4444
          • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
            "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • NTFS ADS
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4940
            • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
              "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
              6⤵
              • Checks BIOS information in registry
              • System Location Discovery: System Language Discovery
              • NTFS ADS
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1944
              • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                7⤵
                • Checks BIOS information in registry
                • System Location Discovery: System Language Discovery
                • NTFS ADS
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:5144
                • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                  "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                  8⤵
                  • Checks BIOS information in registry
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • NTFS ADS
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:3400
                  • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                    "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                    9⤵
                    • Checks BIOS information in registry
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    • NTFS ADS
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:1860
                    • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                      "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                      10⤵
                      • Checks BIOS information in registry
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      • NTFS ADS
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:1436
                      • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                        "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                        11⤵
                        • Checks BIOS information in registry
                        • System Location Discovery: System Language Discovery
                        • Modifies registry class
                        • NTFS ADS
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:2648
                        • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                          "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                          12⤵
                          • Checks BIOS information in registry
                          • System Location Discovery: System Language Discovery
                          • Modifies registry class
                          • NTFS ADS
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:4684
                          • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                            "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                            13⤵
                            • Checks BIOS information in registry
                            • System Location Discovery: System Language Discovery
                            • Modifies registry class
                            • NTFS ADS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1076
                            • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                              "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                              14⤵
                              • Checks BIOS information in registry
                              • System Location Discovery: System Language Discovery
                              • Modifies registry class
                              • NTFS ADS
                              • Suspicious use of AdjustPrivilegeToken
                              PID:5668
                              • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                                "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                                15⤵
                                • Checks BIOS information in registry
                                • System Location Discovery: System Language Discovery
                                • NTFS ADS
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3460
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3460 -s 1356
                                  16⤵
                                  • Program crash
                                  PID:2164
                    • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                      "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                      10⤵
                      • Checks BIOS information in registry
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      • NTFS ADS
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:2912
                      • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                        "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                        11⤵
                        • Checks BIOS information in registry
                        • System Location Discovery: System Language Discovery
                        • NTFS ADS
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:5940
                        • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                          "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                          12⤵
                          • Checks BIOS information in registry
                          • System Location Discovery: System Language Discovery
                          • NTFS ADS
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:4652
                          • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                            "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                            13⤵
                            • Checks BIOS information in registry
                            • System Location Discovery: System Language Discovery
                            • NTFS ADS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3840
                            • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                              "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                              14⤵
                              • Checks BIOS information in registry
                              • System Location Discovery: System Language Discovery
                              • Modifies registry class
                              • NTFS ADS
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1924
                              • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                                "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                                15⤵
                                • System Location Discovery: System Language Discovery
                                • NTFS ADS
                                • Suspicious use of AdjustPrivilegeToken
                                PID:6016
                                • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                                  "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                                  16⤵
                                  • Checks BIOS information in registry
                                  • System Location Discovery: System Language Discovery
                                  • NTFS ADS
                                  PID:4080
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 4080 -s 1348
                                    17⤵
                                    • Program crash
                                    PID:3108
                              • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                                "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                                15⤵
                                • Checks BIOS information in registry
                                • System Location Discovery: System Language Discovery
                                • NTFS ADS
                                PID:3816
                                • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                                  "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                                  16⤵
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry class
                                  • NTFS ADS
                                  PID:2016
                                  • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                                    "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                                    17⤵
                                    • System Location Discovery: System Language Discovery
                                    • NTFS ADS
                                    PID:2352
                              • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                                "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                                15⤵
                                • System Location Discovery: System Language Discovery
                                • Modifies registry class
                                • NTFS ADS
                                PID:3524
                                • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                                  "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                                  16⤵
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry class
                                  • NTFS ADS
                                  PID:1868
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 1344
                                    17⤵
                                    • Program crash
                                    PID:3260
                                • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                                  "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                                  16⤵
                                  • Checks BIOS information in registry
                                  • System Location Discovery: System Language Discovery
                                  • NTFS ADS
                                  PID:4796
                                  • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                                    "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                                    17⤵
                                    • Checks BIOS information in registry
                                    • System Location Discovery: System Language Discovery
                                    • Modifies registry class
                                    • NTFS ADS
                                    PID:324
                                    • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                                      "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                                      18⤵
                                      • Checks BIOS information in registry
                                      • Modifies registry class
                                      • NTFS ADS
                                      PID:5884
                                      • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                                        "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                                        19⤵
                                          PID:5216
                                • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                                  "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                                  15⤵
                                  • Checks BIOS information in registry
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry class
                                  • NTFS ADS
                                  PID:5404
                      • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                        "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                        10⤵
                        • System Location Discovery: System Language Discovery
                        • Modifies registry class
                        • NTFS ADS
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:1388
                        • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                          "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                          11⤵
                          • Checks BIOS information in registry
                          • System Location Discovery: System Language Discovery
                          • NTFS ADS
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3520
                          • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                            "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                            12⤵
                            • Checks BIOS information in registry
                            • System Location Discovery: System Language Discovery
                            • Modifies registry class
                            • NTFS ADS
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2352
                            • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                              "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                              13⤵
                              • Checks BIOS information in registry
                              • System Location Discovery: System Language Discovery
                              • NTFS ADS
                              • Suspicious use of AdjustPrivilegeToken
                              PID:440
                              • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                                "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                                14⤵
                                • System Location Discovery: System Language Discovery
                                • NTFS ADS
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2004
                                • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                                  "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                                  15⤵
                                  • Checks BIOS information in registry
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry class
                                  • NTFS ADS
                                  PID:4996
                                  • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                                    "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                                    16⤵
                                    • Checks BIOS information in registry
                                    • System Location Discovery: System Language Discovery
                                    • Modifies registry class
                                    • NTFS ADS
                                    PID:2612
                                    • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                                      "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                                      17⤵
                                      • Checks BIOS information in registry
                                      • System Location Discovery: System Language Discovery
                                      • NTFS ADS
                                      PID:5668
                                      • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                                        "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                                        18⤵
                                        • Checks BIOS information in registry
                                        • Modifies registry class
                                        PID:2852
                                        • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                                          "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                                          19⤵
                                          • Checks BIOS information in registry
                                          • System Location Discovery: System Language Discovery
                                          • Modifies registry class
                                          PID:5284
                                          • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                                            "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                                            20⤵
                                            • Checks BIOS information in registry
                                            • System Location Discovery: System Language Discovery
                                            • NTFS ADS
                                            PID:5568
                                            • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                                              "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                                              21⤵
                                                PID:1820
                                        • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                                          "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                                          18⤵
                                          • System Location Discovery: System Language Discovery
                                          • Modifies registry class
                                          • NTFS ADS
                                          PID:5324
                                          • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                                            "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                                            19⤵
                                            • Checks BIOS information in registry
                                            • System Location Discovery: System Language Discovery
                                            • Modifies registry class
                                            • NTFS ADS
                                            PID:1992
                                            • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                                              "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                                              20⤵
                                                PID:5556
                                        • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                                          "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                                          17⤵
                                          • Checks BIOS information in registry
                                          • System Location Discovery: System Language Discovery
                                          • Modifies registry class
                                          • NTFS ADS
                                          PID:5352
                                          • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                                            "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                                            18⤵
                                            • System Location Discovery: System Language Discovery
                                            • Modifies registry class
                                            • NTFS ADS
                                            PID:4980
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 1348
                                              19⤵
                                              • Program crash
                                              PID:3116
                                        • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                                          "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                                          17⤵
                                          • System Location Discovery: System Language Discovery
                                          • Modifies registry class
                                          • NTFS ADS
                                          PID:4676
                                          • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                                            "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                                            18⤵
                                            • Checks BIOS information in registry
                                            • System Location Discovery: System Language Discovery
                                            • Modifies registry class
                                            • NTFS ADS
                                            PID:3548
                                            • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                                              "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                                              19⤵
                                                PID:5512
                            • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                              "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                              10⤵
                              • System Location Discovery: System Language Discovery
                              • NTFS ADS
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3724
                              • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                                "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                                11⤵
                                • Checks BIOS information in registry
                                • System Location Discovery: System Language Discovery
                                • Modifies registry class
                                • NTFS ADS
                                • Suspicious use of AdjustPrivilegeToken
                                PID:5952
                                • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                                  "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                                  12⤵
                                  • Checks BIOS information in registry
                                  • System Location Discovery: System Language Discovery
                                  • NTFS ADS
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:6068
                                  • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                                    "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                                    13⤵
                                    • Checks BIOS information in registry
                                    • System Location Discovery: System Language Discovery
                                    • Modifies registry class
                                    • NTFS ADS
                                    PID:960
                                    • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                                      "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                                      14⤵
                                      • Checks BIOS information in registry
                                      • System Location Discovery: System Language Discovery
                                      • NTFS ADS
                                      PID:5116
                                      • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                                        "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                                        15⤵
                                        • System Location Discovery: System Language Discovery
                                        • NTFS ADS
                                        PID:5036
                                        • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                                          "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                                          16⤵
                                          • Checks BIOS information in registry
                                          • System Location Discovery: System Language Discovery
                                          • NTFS ADS
                                          PID:1116
                                          • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                                            "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                                            17⤵
                                            • Checks BIOS information in registry
                                            • System Location Discovery: System Language Discovery
                                            • Modifies registry class
                                            • NTFS ADS
                                            PID:3060
                                            • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                                              "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                                              18⤵
                                              • Checks BIOS information in registry
                                              • System Location Discovery: System Language Discovery
                                              • Modifies registry class
                                              • NTFS ADS
                                              PID:1388
                                              • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                                                "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                                                19⤵
                                                • Checks BIOS information in registry
                                                • System Location Discovery: System Language Discovery
                                                • NTFS ADS
                                                PID:3052
                                                • C:\Windows\SysWOW64\WerFault.exe
                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 3052 -s 1092
                                                  20⤵
                                                  • Program crash
                                                  PID:4708
                                            • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                                              "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                                              18⤵
                                              • Checks BIOS information in registry
                                              • System Location Discovery: System Language Discovery
                                              • Modifies registry class
                                              • NTFS ADS
                                              PID:5332
                                              • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                                                "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                                                19⤵
                                                  PID:5236
                                              • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                                                "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                                                18⤵
                                                  PID:864
                                          • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                                            "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                                            15⤵
                                            • Checks BIOS information in registry
                                            • System Location Discovery: System Language Discovery
                                            • Modifies registry class
                                            • NTFS ADS
                                            PID:2656
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -u -p 2656 -s 1100
                                              16⤵
                                              • Program crash
                                              PID:6000
                                        • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                                          "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                                          14⤵
                                          • Checks BIOS information in registry
                                          • System Location Discovery: System Language Discovery
                                          • NTFS ADS
                                          PID:5180
                                          • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                                            "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                                            15⤵
                                            • Checks BIOS information in registry
                                            • System Location Discovery: System Language Discovery
                                            • Modifies registry class
                                            • NTFS ADS
                                            PID:5196
                                            • C:\Windows\SysWOW64\WerFault.exe
                                              C:\Windows\SysWOW64\WerFault.exe -u -p 5196 -s 1344
                                              16⤵
                                              • Program crash
                                              PID:5436
                                        • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                                          "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                                          14⤵
                                          • Checks BIOS information in registry
                                          • System Location Discovery: System Language Discovery
                                          • NTFS ADS
                                          PID:4940
                                          • C:\Windows\SysWOW64\WerFault.exe
                                            C:\Windows\SysWOW64\WerFault.exe -u -p 4940 -s 1340
                                            15⤵
                                            • Program crash
                                            PID:3892
                            • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                              "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                              8⤵
                              • System Location Discovery: System Language Discovery
                              • NTFS ADS
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:5460
                              • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                                "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                                9⤵
                                • System Location Discovery: System Language Discovery
                                • NTFS ADS
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of WriteProcessMemory
                                PID:5200
                                • C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe
                                  "C:\Users\Admin\AppData\Local\Temp\b55bbba152acab105936f1ef2fa13d06fedd0a8973cf4318793c5dd62860e13a.exe"
                                  10⤵
                                  • Checks BIOS information in registry
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry class
                                  • NTFS ADS
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3376
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 1092
                                    11⤵
                                    • Program crash
                                    PID:4080
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3376 -ip 3376
                1⤵
                  PID:3560
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 3460 -ip 3460
                  1⤵
                    PID:4028
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4080 -ip 4080
                    1⤵
                      PID:2680
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1868 -ip 1868
                      1⤵
                        PID:5240
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5196 -ip 5196
                        1⤵
                          PID:1196
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2656 -ip 2656
                          1⤵
                            PID:4924
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2352 -ip 2352
                            1⤵
                              PID:2760
                            • C:\Windows\SysWOW64\WerFault.exe
                              C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4940 -ip 4940
                              1⤵
                                PID:5708
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 5404 -ip 5404
                                1⤵
                                  PID:5688
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4980 -ip 4980
                                  1⤵
                                    PID:3424
                                  • C:\Windows\SysWOW64\WerFault.exe
                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3052 -ip 3052
                                    1⤵
                                      PID:3376

                                    Network

                                          MITRE ATT&CK Enterprise v16

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          0DA2E2EA47B016EA3.Lic
                                          • Path C:\ProgramData\Licenses\0DA2E2EA47B016EA3.Lic
                                          • Size 132B
                                          • SHA256 82d44e1d0e5460475c29d3cb6730ee9d62e2bb10ab76f6f4a122232fa842d8bf
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          0DA2E2EA47B016EA3.Lic
                                          • Path C:\ProgramData\Licenses\0DA2E2EA47B016EA3.Lic
                                          • Size 132B
                                          • SHA256 614fb6bd372fad2c6e6fbd2cd411636bcfb3aa008cf85a7f51605f36b5d3bec1
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          0DA2E2EA47B016EA3.Lic
                                          • Path C:\ProgramData\Licenses\0DA2E2EA47B016EA3.Lic
                                          • Size 132B
                                          • SHA256 5f9472b055334ba3aa43ed6aee86367fd3023807702dabc9282f0baa34fcfb3f
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          0DA2E2EA47B016EA3.Lic
                                          • Path C:\ProgramData\Licenses\0DA2E2EA47B016EA3.Lic
                                          • Size 132B
                                          • SHA256 16f1ce09c79518464d85add8343940e904032f77448ddf38bf8d14544273e64d
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          0DA2E2EA47B016EA3.Lic
                                          • Path C:\ProgramData\Licenses\0DA2E2EA47B016EA3.Lic
                                          • Size 132B
                                          • SHA256 4633250b50b332ff8f86be633e22c88a522ca34761a099c59d9734b053a306fa
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          0DA2E2EA47B016EA3.Lic
                                          • Path C:\ProgramData\Licenses\0DA2E2EA47B016EA3.Lic
                                          • Size 132B
                                          • SHA256 e960e7e2531b9d9faae6d4b45aea01efe33bc658d412a6a29d200a257d2069f9
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          0DA2E2EA47B016EA3.Lic
                                          • Path C:\ProgramData\Licenses\0DA2E2EA47B016EA3.Lic
                                          • Size 132B
                                          • SHA256 1a80fc6b50d0dd0fc427d8022e0dc34e71af26b8aa52f090dbcbbed6079ec924
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          0DA2E2EA47B016EA3.Lic
                                          • Path C:\ProgramData\Licenses\0DA2E2EA47B016EA3.Lic
                                          • Size 132B
                                          • SHA256 b03534dd525c7839079944781276a907f5c2180f4b45d98e1edc2c4707ce891a
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          0DA2E2EA47B016EA3.Lic
                                          • Path C:\ProgramData\Licenses\0DA2E2EA47B016EA3.Lic
                                          • Size 132B
                                          • SHA256 d7870e6bdad7dde96a150724d2aeff323a5ecef08a7a47cf0ce1c7f05615e53b
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          0DA2E2EA47B016EA3.Lic
                                          • Path C:\ProgramData\Licenses\0DA2E2EA47B016EA3.Lic
                                          • Size 132B
                                          • SHA256 fb0f033790acfba5353717719cd47e81ce581004178daad1f50c6dd0f6ba174f
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          0DA2E2EA47B016EA3.Lic
                                          • Path C:\ProgramData\Licenses\0DA2E2EA47B016EA3.Lic
                                          • Size 132B
                                          • SHA256 1902bbde2a674883c7e74ae5d9acd090d7d4dbcec6d28cffa5d28148b51c5169
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          0DA2E2EA47B016EA3.Lic
                                          • Path C:\ProgramData\Licenses\0DA2E2EA47B016EA3.Lic
                                          • Size 132B
                                          • SHA256 0357ac684ae60cdfc79f8b5c3b972660a6a7d4f6504180bd099c1774066e7734
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          0DA2E2EA47B016EA3.Lic
                                          • Path C:\ProgramData\Licenses\0DA2E2EA47B016EA3.Lic
                                          • Size 132B
                                          • SHA256 664cdc5bdc996449bb5aa179e3faeb52d95de1b2d2f885da6f9cfdc2f03d797a
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          0DA2E2EA47B016EA3.Lic
                                          • Path C:\ProgramData\Licenses\0DA2E2EA47B016EA3.Lic
                                          • Size 132B
                                          • SHA256 ef570933787eac497a80561f61bcdc82eaac029e8212634d3ae7a5ce0afc9b40
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          0DA2E2EA47B016EA3.Lic
                                          • Path C:\ProgramData\Licenses\0DA2E2EA47B016EA3.Lic
                                          • Size 132B
                                          • SHA256 54c020729884f23a648267a5b4eaf0f6f39d961c4c68b83eafafe6b8ae81703f
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          0DA2E2EA47B016EA3.Lic
                                          • Path C:\ProgramData\Licenses\0DA2E2EA47B016EA3.Lic
                                          • Size 132B
                                          • SHA256 79206e3e5463f322683e4900f6d2a437169449969989b92d2b98c0cb6a7d8a15
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          0DA2E2EA47B016EA3.Lic
                                          • Path C:\ProgramData\Licenses\0DA2E2EA47B016EA3.Lic
                                          • Size 132B
                                          • SHA256 d4651f883bf0f508fc9fc677aad62513c019a013f99d82dee1a1ed38914e250f
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          0DA2E2EA47B016EA3.Lic
                                          • Path C:\ProgramData\Licenses\0DA2E2EA47B016EA3.Lic
                                          • Size 132B
                                          • SHA256 bc5a379eeee2100d048f4eee0a3aad86d417b0a786364b92f0dd82ebfce7ae73
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          0DA2E2EA47B016EA3.Lic
                                          • Path C:\ProgramData\Licenses\0DA2E2EA47B016EA3.Lic
                                          • Size 132B
                                          • SHA256 60f00b23343715c48228f8f79cf873371836118ccc236d6c97e48b2d2e5c88e6
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          0DA2E2EA47B016EA3.Lic
                                          • Path C:\ProgramData\Licenses\0DA2E2EA47B016EA3.Lic
                                          • Size 132B
                                          • SHA256 4a3da7deb6d5ee8cda32c87e57603b81c2a844f695352f181bb96d2ef3c970fc
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          0DA2E2EA47B016EA3.Lic
                                          • Path C:\ProgramData\Licenses\0DA2E2EA47B016EA3.Lic
                                          • Size 132B
                                          • SHA256 e016cefe27721d765287c3a35ee5b13d8beeef842a582158ff1621372d031bb3
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          0DA2E2EA47B016EA3.Lic
                                          • Path C:\ProgramData\Licenses\0DA2E2EA47B016EA3.Lic
                                          • Size 132B
                                          • SHA256 9120a063345f7a358a2b33461e741a24178bc126d6e3df7eafd0ae2b15ae873c
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          0DA2E2EA47B016EA3.Lic
                                          • Path C:\ProgramData\Licenses\0DA2E2EA47B016EA3.Lic
                                          • Size 132B
                                          • SHA256 1027374e15cbc82e61467ac338523c223f08d9fd658e5e720147a144fa74dc30
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          0DA2E2EA47B016EA3.Lic
                                          • Path C:\ProgramData\Licenses\0DA2E2EA47B016EA3.Lic
                                          • Size 132B
                                          • SHA256 f1b00c29ac78821a370ea7ac47cff9f95b3560e90702fc90b79ce9a450ad2398
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          0DA2E2EA47B016EA3.Lic
                                          • Path C:\ProgramData\Licenses\0DA2E2EA47B016EA3.Lic
                                          • Size 132B
                                          • SHA256 9889f79265d4dc40a94bbfd0569638befae74e936763094878d7d96bf6600546
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          0DA2E2EA47B016EA3.Lic
                                          • Path C:\ProgramData\Licenses\0DA2E2EA47B016EA3.Lic
                                          • Size 132B
                                          • SHA256 c515809d9ada8fa5d5a20a5c22b5e6cad54c2983d957fd99f123225521186a0b
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          0DA2E2EA47B016EA3.Lic
                                          • Path C:\ProgramData\Licenses\0DA2E2EA47B016EA3.Lic
                                          • Size 132B
                                          • SHA256 31879dfaae66da7037fc6a1c6b19b92d4471d070aa8d2031a7c0ff554097b1fb
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          0DA2E2EA47B016EA3.Lic
                                          • Path C:\ProgramData\Licenses\0DA2E2EA47B016EA3.Lic
                                          • Size 132B
                                          • SHA256 ee7b35b3235af6cbf5c30c544bde5b80dbc9be4b234fef148a8532a8b926f218
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          0DA2E2EA47B016EA3.Lic
                                          • Path C:\ProgramData\Licenses\0DA2E2EA47B016EA3.Lic
                                          • Size 132B
                                          • SHA256 fda31398db27edbc425bec966c3deba49c8644e478eed8252da12b4b38da68e3
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          0DA2E2EA47B016EA3.Lic
                                          • Path C:\ProgramData\Licenses\0DA2E2EA47B016EA3.Lic
                                          • Size 132B
                                          • SHA256 e7d5738d2461cc13d2b4a62498f5be7d0efbdd946a2fc3290ab8ea5d7b124a68
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          0DA2E2EA47B016EA3.Lic
                                          • Path C:\ProgramData\Licenses\0DA2E2EA47B016EA3.Lic
                                          • Size 132B
                                          • SHA256 57162854d1b6066a2c773032038985cd82952b835e0fd6a38020551dbabac0a5
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          0DA2E2EA47B016EA3.Lic
                                          • Path C:\ProgramData\Licenses\0DA2E2EA47B016EA3.Lic
                                          • Size 132B
                                          • SHA256 ca710d0f23c16c7ffe97570811c0b03f0e0e8a7db7d3fd03ba0c3c51b78cdc34
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          0DA2E2EA47B016EA3.Lic
                                          • Path C:\ProgramData\Licenses\0DA2E2EA47B016EA3.Lic
                                          • Size 132B
                                          • SHA256 c42f2a2aa873146ec9c95831bacf2e061164ffc993d93e31c6baff2c086818e9
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          TEMP:BD132264
                                          • Path C:\ProgramData\TEMP:BD132264
                                          • Size 132B
                                          • SHA256 3445c202a84144aa176d3c3437e99dbb2e8d28db45c14044bce56c489bf613e1
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          TEMP:BD132264
                                          • Path C:\ProgramData\TEMP:BD132264
                                          • Size 132B
                                          • SHA256 7b93d92e539a28b03cd5ffbfc3193d3ec9b4361f3f831cc0892d9ce0610b428e
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          TEMP:BD132264
                                          • Path C:\ProgramData\TEMP:BD132264
                                          • Size 132B
                                          • SHA256 f6e195ae29722a61c48c8c31f03500e34089266adfd769ac00d66319710977ec
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          TEMP:BD132264
                                          • Path C:\ProgramData\TEMP:BD132264
                                          • Size 132B
                                          • SHA256 b3c983cbceb586598b9c2b749ba0f3233dc20c123dc3e9f34cc52ad02ae3bc93
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          TEMP:BD132264
                                          • Path C:\ProgramData\TEMP:BD132264
                                          • Size 132B
                                          • SHA256 82f0ff0f3d48a20db0958c95db1ea3904fe6d382c9331933231206cf522c96c8
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          TEMP:BD132264
                                          • Path C:\ProgramData\TEMP:BD132264
                                          • Size 132B
                                          • SHA256 ee75b13262d01fb864b2009594fc9c4fbf148754fe425f295c7a52eecd9fce50
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          TEMP:BD132264
                                          • Path C:\ProgramData\TEMP:BD132264
                                          • Size 132B
                                          • SHA256 3f1c5a9e5c08f48cfceeb610df5b80556651263319d37d0fa1e3426685f8c4ae
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          TEMP:BD132264
                                          • Path C:\ProgramData\TEMP:BD132264
                                          • Size 132B
                                          • SHA256 2ce7bbf2b70224609f18317e5a0e3ce74e572bbee4f343cbc04d157123d4c807
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          TEMP:BD132264
                                          • Path C:\ProgramData\TEMP:BD132264
                                          • Size 132B
                                          • SHA256 c1810a6a1be3a1dc5e60cb24fd0a54eadcda0c7f6eefe89c01a6c47d6792ccb8
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          TEMP:BD132264
                                          • Path C:\ProgramData\TEMP:BD132264
                                          • Size 132B
                                          • SHA256 fb91720e1e8ff17ac5fba1693c55ebc8130ffaf25ce2a0caf973c9a2a244dec9
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          TEMP:BD132264
                                          • Path C:\ProgramData\TEMP:BD132264
                                          • Size 132B
                                          • SHA256 5c6d24baa8278f4925fa8183a73a7ba624fb44c551584346875021441c358060
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          TEMP:BD132264
                                          • Path C:\ProgramData\TEMP:BD132264
                                          • Size 132B
                                          • SHA256 b34be8d11afef9a0c532cd246ec680174c67e8f46fb4bba304a9baf74bba8488
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          TEMP:BD132264
                                          • Path C:\ProgramData\TEMP:BD132264
                                          • Size 132B
                                          • SHA256 0022a25fd78abee3d41ceb3df818667fecec71c01b2c87331854ed2beb4b5a3b
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          TEMP:BD132264
                                          • Path C:\ProgramData\TEMP:BD132264
                                          • Size 132B
                                          • SHA256 0296230eeabe2d5be3a35a8c2c577e95884cc65c8c10bcb35fce15cf48bec50e
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          TEMP:BD132264
                                          • Path C:\ProgramData\TEMP:BD132264
                                          • Size 132B
                                          • SHA256 632c6b669a16cf916b880f399c963ad966ee03b1f28acba1aaf91f28ceddfdf5
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          TEMP:BD132264
                                          • Path C:\ProgramData\TEMP:BD132264
                                          • Size 132B
                                          • SHA256 d2a7afa441ded08923a3a0c159e4819b11547d2a17b3fcb773814c568e56c9f5
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          TEMP:BD132264
                                          • Path C:\ProgramData\TEMP:BD132264
                                          • Size 132B
                                          • SHA256 a466677fc02b79eb5a0ade8b3a9e3d0498d7f55b2cc572c68d002311052f1f2c
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          TEMP:BD132264
                                          • Path C:\ProgramData\TEMP:BD132264
                                          • Size 132B
                                          • SHA256 4ffe3a94ceb0a29339c948b257f619f30d93143a4938be3270a57ea595b4bb94
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          TEMP:BD132264
                                          • Path C:\ProgramData\TEMP:BD132264
                                          • Size 132B
                                          • SHA256 eb122187e3018da68e645d117314f26bc635d69584ed7dfee7b35dae09ac3a12
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          TEMP:BD132264
                                          • Path C:\ProgramData\TEMP:BD132264
                                          • Size 132B
                                          • SHA256 380dba189617bf605b439428fc9dafe4ae64453d4a97832a2b20b3073579837d
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          TEMP:BD132264
                                          • Path C:\ProgramData\TEMP:BD132264
                                          • Size 132B
                                          • SHA256 06f5dd7a1809302b9158acb6577b5777945b729b2decf5606bbadb363c4ad7f4
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          TEMP:BD132264
                                          • Path C:\ProgramData\TEMP:BD132264
                                          • Size 132B
                                          • SHA256 71f44adaf6f760608164945c4ce9a9fd4c47ab0b7b62ae4f24ec7ba484afed71
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          TEMP:BD132264
                                          • Path C:\ProgramData\TEMP:BD132264
                                          • Size 132B
                                          • SHA256 002a604abec29a65f07da341b2d52eb3e720036de029833da8ccf2dcca7b92b9
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          TEMP:BD132264
                                          • Path C:\ProgramData\TEMP:BD132264
                                          • Size 132B
                                          • SHA256 b08c2e03b6d4407daaadd22fa1b8aef31ed5239fdd0ae4e1d8a1dafb1a632e73
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          TEMP:BD132264
                                          • Path C:\ProgramData\TEMP:BD132264
                                          • Size 132B
                                          • SHA256 9b9878dab2aa49c97f7da769eb90a5ec24aecb6fdf595a2defc367de053373b2
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          TEMP:BD132264
                                          • Path C:\ProgramData\TEMP:BD132264
                                          • Size 132B
                                          • SHA256 5b8acea254ff4f58615a2b354e2b1fa9d663c20d866946eeca1373df2ab42555
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          TEMP:BD132264
                                          • Path C:\ProgramData\TEMP:BD132264
                                          • Size 132B
                                          • SHA256 ec864819ed038aa321d6da50fd3f0cdfb4ee1fe5bef7f7e11a17b80687f616f2
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          TEMP:BD132264
                                          • Path C:\ProgramData\TEMP:BD132264
                                          • Size 132B
                                          • SHA256 984e41d5bfc8f7c0ae08aabd99c52bda0f85e2f3c39e6d8ebb13d5cfae6ba7f7
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          TEMP:BD132264
                                          • Path C:\ProgramData\TEMP:BD132264
                                          • Size 132B
                                          • SHA256 809279e83ac5b33302186527f1d6a01ffcef8234b2da86912c79627fa81cc9c1
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          TEMP:BD132264
                                          • Path C:\ProgramData\TEMP:BD132264
                                          • Size 132B
                                          • SHA256 0a71883a25ba9e6cc1be7f96dc28cba173aac33b548e432e1519b7b013adf7e3
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          configuration.xml
                                          • Path C:\Users\Admin\AppData\Roaming\OneNoteGem\NoteFavorites\configuration.xml
                                          • Size 281B
                                          • SHA256 4a16fb3e65d55a42b4332f71ca5cdb914ff88b87c0384e50ef850556d2f6ef5b
                                          • MD5 SHA1 SHA512
                                          Submit Download

                                          memory/440-741-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/440-838-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/440-845-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/552-14-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/552-24-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/552-17-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/552-16-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/552-21-0x0000000002AB0000-0x0000000002CB1000-memory.dmp
                                          Download

                                          memory/552-19-0x0000000002AB0000-0x0000000002CB1000-memory.dmp
                                          Download

                                          memory/552-18-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/552-0-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/552-56-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/552-15-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/552-9-0x0000000002AB0000-0x0000000002CB1000-memory.dmp
                                          Download

                                          memory/552-2-0x000000000053C000-0x000000000053D000-memory.dmp
                                          Download

                                          memory/552-3-0x0000000002AB0000-0x0000000002CB1000-memory.dmp
                                          Download

                                          memory/960-948-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/960-1323-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/1076-653-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/1076-729-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/1388-622-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/1388-426-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/1388-523-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/1436-368-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/1436-375-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/1860-239-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/1860-343-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/1860-618-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/1924-1313-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/1924-742-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/1924-860-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/1944-166-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/1944-168-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/1944-155-0x0000000002860000-0x0000000002A61000-memory.dmp
                                          Download

                                          memory/1944-151-0x0000000002860000-0x0000000002A61000-memory.dmp
                                          Download

                                          memory/1944-167-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/1944-164-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/1944-169-0x0000000002860000-0x0000000002A61000-memory.dmp
                                          Download

                                          memory/1944-165-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/1944-172-0x0000000002860000-0x0000000002A61000-memory.dmp
                                          Download

                                          memory/1944-182-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/2004-942-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/2004-946-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/2352-643-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/2352-735-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/2648-369-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/2648-450-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/2912-438-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/2912-515-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/3376-449-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/3376-358-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/3376-504-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/3400-241-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/3460-763-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/3460-867-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/3520-537-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/3520-645-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/3724-522-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/3724-727-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/3724-637-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/3816-916-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/3816-1120-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/3816-1138-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/3840-635-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/3840-719-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/3840-834-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/4080-944-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/4080-1049-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/4424-74-0x0000000002A80000-0x0000000002C81000-memory.dmp
                                          Download

                                          memory/4424-112-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/4424-73-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/4424-58-0x0000000002A80000-0x0000000002C81000-memory.dmp
                                          Download

                                          memory/4424-62-0x0000000002A80000-0x0000000002C81000-memory.dmp
                                          Download

                                          memory/4424-69-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/4424-119-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/4424-72-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/4424-78-0x0000000002A80000-0x0000000002C81000-memory.dmp
                                          Download

                                          memory/4424-71-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/4424-70-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/4444-104-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/4444-111-0x00000000028A0000-0x0000000002AA1000-memory.dmp
                                          Download

                                          memory/4444-125-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/4444-103-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/4444-90-0x00000000028A0000-0x0000000002AA1000-memory.dmp
                                          Download

                                          memory/4444-107-0x00000000028A0000-0x0000000002AA1000-memory.dmp
                                          Download

                                          memory/4444-106-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/4444-105-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/4444-102-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/4444-89-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/4444-94-0x00000000028A0000-0x0000000002AA1000-memory.dmp
                                          Download

                                          memory/4652-634-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/4684-451-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/4684-617-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/4684-599-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/4940-139-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/4940-146-0x00000000029A0000-0x0000000002BA1000-memory.dmp
                                          Download

                                          memory/4940-142-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/4940-130-0x00000000029A0000-0x0000000002BA1000-memory.dmp
                                          Download

                                          memory/4940-143-0x00000000029A0000-0x0000000002BA1000-memory.dmp
                                          Download

                                          memory/4940-141-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/4940-126-0x00000000029A0000-0x0000000002BA1000-memory.dmp
                                          Download

                                          memory/4940-156-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/4940-140-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/4940-138-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/4996-1136-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/4996-943-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/4996-1122-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/5116-1326-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/5116-947-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/5116-1121-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/5144-194-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/5144-280-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/5144-181-0x0000000002960000-0x0000000002B61000-memory.dmp
                                          Download

                                          memory/5144-177-0x0000000002960000-0x0000000002B61000-memory.dmp
                                          Download

                                          memory/5144-223-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/5144-198-0x0000000002960000-0x0000000002B61000-memory.dmp
                                          Download

                                          memory/5144-190-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/5144-192-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/5144-191-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/5144-195-0x0000000002960000-0x0000000002B61000-memory.dmp
                                          Download

                                          memory/5144-193-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/5200-355-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/5200-294-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/5460-287-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/5668-765-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/5668-762-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/5668-654-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/5940-439-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/5940-538-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/5940-620-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/5952-820-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/5952-655-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/5952-832-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/6016-853-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/6016-1014-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/6016-949-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/6068-847-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/6068-913-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/6076-42-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/6076-27-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/6076-25-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/6076-33-0x00000000029E0000-0x0000000002BE1000-memory.dmp
                                          Download

                                          memory/6076-40-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/6076-26-0x00000000029E0000-0x0000000002BE1000-memory.dmp
                                          Download

                                          memory/6076-44-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/6076-45-0x00000000029E0000-0x0000000002BE1000-memory.dmp
                                          Download

                                          memory/6076-41-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/6076-43-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/6076-50-0x00000000029E0000-0x0000000002BE1000-memory.dmp
                                          Download

                                          memory/6076-79-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download

                                          memory/6076-87-0x0000000000400000-0x00000000006AA000-memory.dmp
                                          Download