Overview

overview

7

Static

static

3

BuzzSetup1503.exe

windows10-2004-x64

7

BuzzSetup1503.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    129s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 21:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    BuzzSetup1503.exe
  • Size 7.9MB
  • Sample260930-zzmpcayakh
  • SHA256 40c68819dde811b95160243be633ef5e9d4a9384dedfe3458f4a9fca4a8eb59f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryinstaller

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

    Inno Setup installer

    installer
  • Modifies registry class 25 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BuzzSetup1503.exe
    "C:\Users\Admin\AppData\Local\Temp\BuzzSetup1503.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3732
    • C:\Users\Admin\AppData\Local\Temp\is-R468F.tmp\BuzzSetup1503.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-R468F.tmp\BuzzSetup1503.tmp" /SL5="$400B8,7923332,54272,C:\Users\Admin\AppData\Local\Temp\BuzzSetup1503.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1372
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" install "C:\Program Files (x86)\Jeskola\Buzz\BuzzGUI.dll"
        3⤵
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:3960
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 0 -NGENProcess 234 -Pipe 240 -Comment "NGen Worker Process"
          4⤵
          • Loads dropped DLL
          PID:3196
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 0 -NGENProcess 2fc -Pipe 304 -Comment "NGen Worker Process"
          4⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          PID:2172
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 0 -NGENProcess 30c -Pipe 314 -Comment "NGen Worker Process"
          4⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:3480
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 0 -NGENProcess 33c -Pipe 318 -Comment "NGen Worker Process"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3044
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 0 -NGENProcess 2cc -Pipe 2dc -Comment "NGen Worker Process"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4768
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 0 -NGENProcess 2d0 -Pipe 2fc -Comment "NGen Worker Process"
          4⤵
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:4644
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 0 -NGENProcess 33c -Pipe 2d8 -Comment "NGen Worker Process"
          4⤵
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:4708
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 0 -NGENProcess 2e4 -Pipe 354 -Comment "NGen Worker Process"
          4⤵
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:4364
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 0 -NGENProcess 2d0 -Pipe 2e8 -Comment "NGen Worker Process"
          4⤵
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:2596
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 0 -NGENProcess 358 -Pipe 300 -Comment "NGen Worker Process"
          4⤵
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:3668
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 0 -NGENProcess 2d0 -Pipe 33c -Comment "NGen Worker Process"
          4⤵
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:1332
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 0 -NGENProcess 31c -Pipe 2cc -Comment "NGen Worker Process"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4640
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 0 -NGENProcess 384 -Pipe 2d4 -Comment "NGen Worker Process"
          4⤵
          • Drops file in Windows directory
          PID:3292
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 0 -NGENProcess 380 -Pipe 370 -Comment "NGen Worker Process"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:408
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 0 -NGENProcess 384 -Pipe 308 -Comment "NGen Worker Process"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4652
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 0 -NGENProcess 348 -Pipe 380 -Comment "NGen Worker Process"
          4⤵
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:5928
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 0 -NGENProcess 37c -Pipe 38c -Comment "NGen Worker Process"
          4⤵
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:1104
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 0 -NGENProcess 374 -Pipe 390 -Comment "NGen Worker Process"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2896
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 0 -NGENProcess 36c -Pipe 34c -Comment "NGen Worker Process"
          4⤵
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:4908
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 0 -NGENProcess 398 -Pipe 320 -Comment "NGen Worker Process"
          4⤵
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:1592
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 0 -NGENProcess 384 -Pipe 31c -Comment "NGen Worker Process"
          4⤵
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:936
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 0 -NGENProcess 3a8 -Pipe 3a0 -Comment "NGen Worker Process"
          4⤵
            PID:5436
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 0 -NGENProcess 36c -Pipe 3ac -Comment "NGen Worker Process"
            4⤵
            • Drops file in Windows directory
            PID:4896
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 0 -NGENProcess 310 -Pipe 360 -Comment "NGen Worker Process"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:2388
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 0 -NGENProcess 35c -Pipe 378 -Comment "NGen Worker Process"
            4⤵
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            PID:3300
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 0 -NGENProcess 398 -Pipe 394 -Comment "NGen Worker Process"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:2752
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 0 -NGENProcess 384 -Pipe 2e4 -Comment "NGen Worker Process"
            4⤵
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            PID:4760
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 0 -NGENProcess 3a8 -Pipe 35c -Comment "NGen Worker Process"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:2792
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 0 -NGENProcess 3a8 -Pipe 364 -Comment "NGen Worker Process"
            4⤵
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            PID:2776
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 0 -NGENProcess 338 -Pipe 3a8 -Comment "NGen Worker Process"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:5548
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 0 -NGENProcess 374 -Pipe 2d0 -Comment "NGen Worker Process"
            4⤵
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            PID:4456
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 0 -NGENProcess 350 -Pipe 338 -Comment "NGen Worker Process"
            4⤵
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            PID:3952
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 0 -NGENProcess 358 -Pipe 36c -Comment "NGen Worker Process"
            4⤵
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            PID:5284
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 0 -NGENProcess 350 -Pipe 374 -Comment "NGen Worker Process"
            4⤵
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            PID:5660
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 0 -NGENProcess 3a4 -Pipe 39c -Comment "NGen Worker Process"
            4⤵
            • Drops file in Windows directory
            PID:4820
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 0 -NGENProcess 358 -Pipe 30c -Comment "NGen Worker Process"
            4⤵
            • Drops file in Windows directory
            PID:5900
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 0 -NGENProcess 358 -Pipe 368 -Comment "NGen Worker Process"
            4⤵
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            PID:1012
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 0 -NGENProcess 3c4 -Pipe 350 -Comment "NGen Worker Process"
            4⤵
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            PID:5032
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 0 -NGENProcess 3c8 -Pipe 384 -Comment "NGen Worker Process"
            4⤵
            • Drops file in Windows directory
            PID:2632
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 0 -NGENProcess 3d0 -Pipe 3bc -Comment "NGen Worker Process"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:1804
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 0 -NGENProcess 3b4 -Pipe 3c4 -Comment "NGen Worker Process"
            4⤵
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            PID:2068
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 0 -NGENProcess 398 -Pipe 3cc -Comment "NGen Worker Process"
            4⤵
            • Drops file in Windows directory
            PID:1644
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 0 -NGENProcess 3b8 -Pipe 37c -Comment "NGen Worker Process"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:4888
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 0 -NGENProcess 3b0 -Pipe 398 -Comment "NGen Worker Process"
            4⤵
            • Drops file in Windows directory
            PID:4252
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c0 -InterruptEvent 0 -NGENProcess 3ec -Pipe 310 -Comment "NGen Worker Process"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:1728
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f8 -InterruptEvent 0 -NGENProcess 3e8 -Pipe 3f4 -Comment "NGen Worker Process"
            4⤵
            • System Location Discovery: System Language Discovery
            PID:2108
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 0 -NGENProcess 3e4 -Pipe 3d4 -Comment "NGen Worker Process"
            4⤵
              PID:3100
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 0 -NGENProcess 3e8 -Pipe 3f0 -Comment "NGen Worker Process"
              4⤵
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:4692
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3ec -InterruptEvent 0 -NGENProcess 3dc -Pipe 3a4 -Comment "NGen Worker Process"
              4⤵
              • System Location Discovery: System Language Discovery
              PID:4832
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 0 -NGENProcess 3c8 -Pipe 3ec -Comment "NGen Worker Process"
              4⤵
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:5412
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e8 -InterruptEvent 0 -NGENProcess 3b8 -Pipe 3c0 -Comment "NGen Worker Process"
              4⤵
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:3164
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 0 -NGENProcess 3b4 -Pipe 3b0 -Comment "NGen Worker Process"
              4⤵
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:2836
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3fc -InterruptEvent 0 -NGENProcess 3dc -Pipe 3c8 -Comment "NGen Worker Process"
              4⤵
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:5300
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 0 -NGENProcess 404 -Pipe 3b4 -Comment "NGen Worker Process"
              4⤵
              • System Location Discovery: System Language Discovery
              PID:2824
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f8 -InterruptEvent 0 -NGENProcess 408 -Pipe 3e4 -Comment "NGen Worker Process"
              4⤵
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:4356
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 420 -InterruptEvent 0 -NGENProcess 434 -Pipe 424 -Comment "NGen Worker Process"
              4⤵
              • System Location Discovery: System Language Discovery
              PID:2976
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 440 -InterruptEvent 0 -NGENProcess 428 -Pipe 438 -Comment "NGen Worker Process"
              4⤵
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:2980
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 440 -InterruptEvent 0 -NGENProcess 420 -Pipe 448 -Comment "NGen Worker Process"
              4⤵
              • System Location Discovery: System Language Discovery
              PID:5936
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 0 -NGENProcess 3d0 -Pipe 3d8 -Comment "NGen Worker Process"
              4⤵
              • Drops file in Windows directory
              PID:2728
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 0 -NGENProcess 430 -Pipe 3e0 -Comment "NGen Worker Process"
              4⤵
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:4924
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" install "C:\Program Files (x86)\Jeskola\Buzz\Gear\Generators\Jeskola Pianoroll.GUI.dll"
            3⤵
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            PID:5556
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 0 -NGENProcess 234 -Pipe 240 -Comment "NGen Worker Process"
              4⤵
              • System Location Discovery: System Language Discovery
              PID:5356
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 0 -NGENProcess 268 -Pipe 234 -Comment "NGen Worker Process"
              4⤵
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:1316
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" install "C:\Program Files (x86)\Jeskola\Buzz\Gear\Generators\Jeskola Relativion.GUI.dll"
            3⤵
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            PID:3260
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 0 -NGENProcess 234 -Pipe 248 -Comment "NGen Worker Process"
              4⤵
                PID:2388
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 0 -NGENProcess 2f0 -Pipe 2f4 -Comment "NGen Worker Process"
                4⤵
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:4676
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" install "C:\Program Files (x86)\Jeskola\Buzz\Gear\Generators\Jeskola Qsamo.GUI.dll"
              3⤵
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:2620
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 0 -NGENProcess 234 -Pipe 240 -Comment "NGen Worker Process"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:4760
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 0 -NGENProcess 2d8 -Pipe 2e4 -Comment "NGen Worker Process"
                4⤵
                • Drops file in Windows directory
                PID:1016
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" install "C:\Program Files (x86)\Jeskola\Buzz\Gear\Generators\Jeskola Loop Recorder.GUI.dll"
              3⤵
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:1012
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 0 -NGENProcess 234 -Pipe 240 -Comment "NGen Worker Process"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:3292
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 0 -NGENProcess 2d0 -Pipe 2e4 -Comment "NGen Worker Process"
                4⤵
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:5900
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe" install "C:\Program Files (x86)\Jeskola\Buzz\Gear\Effects\Jeskola Limiter.GUI.dll"
              3⤵
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              PID:4432
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 0 -NGENProcess 234 -Pipe 240 -Comment "NGen Worker Process"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:2956
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 0 -NGENProcess 270 -Pipe 2cc -Comment "NGen Worker Process"
                4⤵
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                PID:2996
            • C:\Program Files (x86)\Jeskola\Buzz\buzz.exe
              "C:\Program Files (x86)\Jeskola\Buzz\buzz.exe"
              3⤵
              • Executes dropped EXE
              • Enumerates connected drives
              • Reads the TCP/IP host and domain name from the registry
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:5440

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              BuzzGUI.BuzzUpdate.dll
              • Path C:\Program Files (x86)\Jeskola\Buzz\BuzzGUI.BuzzUpdate.dll
              • Size 22KB
              • SHA256 0db4b4d4763a358d6ca28d143511c83c6cab8205b2d471b5ec7b1a1de16e1197
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              BuzzGUI.Common.dll
              • Path C:\Program Files (x86)\Jeskola\Buzz\BuzzGUI.Common.dll
              • Size 662KB
              • SHA256 dfea3702e94a75fd21e954b3f530292e5747e67fc3d8e5bf54c5088892def479
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              BuzzGUI.EnvelopeControl.dll
              • Path C:\Program Files (x86)\Jeskola\Buzz\BuzzGUI.EnvelopeControl.dll
              • Size 19KB
              • SHA256 1af9f4599fd1f96987275816b427b0c2a34293ef917ad3f6e19e2e922ccc8f49
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              BuzzGUI.FileBrowser.dll
              • Path C:\Program Files (x86)\Jeskola\Buzz\BuzzGUI.FileBrowser.dll
              • Size 64KB
              • SHA256 52701ebde6b0687a7ed2b2297110a866e341ee6ef9f74aa14b226c3e4af8357b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              BuzzGUI.Interfaces.dll
              • Path C:\Program Files (x86)\Jeskola\Buzz\BuzzGUI.Interfaces.dll
              • Size 37KB
              • SHA256 f943f771498bf8185638f3a77ee323d57b41afbc88c535a46b39a632532f3323
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              BuzzGUI.MachineView.dll
              • Path C:\Program Files (x86)\Jeskola\Buzz\BuzzGUI.MachineView.dll
              • Size 174KB
              • SHA256 b886f539843d39c81a3c20d35cdc1ec4a642340375679a2ae382c62c8cb9fbf2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              BuzzGUI.ParameterWindow.dll
              • Path C:\Program Files (x86)\Jeskola\Buzz\BuzzGUI.ParameterWindow.dll
              • Size 38KB
              • SHA256 bd3d819877b62c2bece7664da458e6369572701ae63a7b2acf807ce171401921
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              BuzzGUI.PatternEditor.dll
              • Path C:\Program Files (x86)\Jeskola\Buzz\BuzzGUI.PatternEditor.dll
              • Size 905KB
              • SHA256 582ae490bc27e52f9f895b0958731b0c2e50cfeb29b4eb6cf700d0184d864f3c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              BuzzGUI.PianoKeyboard.dll
              • Path C:\Program Files (x86)\Jeskola\Buzz\BuzzGUI.PianoKeyboard.dll
              • Size 22KB
              • SHA256 0eab57fbedf465f20874702f14925eed0b7cb5a8282dee9b0735783459018bb3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              BuzzGUI.SequenceEditor.dll
              • Path C:\Program Files (x86)\Jeskola\Buzz\BuzzGUI.SequenceEditor.dll
              • Size 77KB
              • SHA256 edb8f58c84b1c3c16565e49a739ee52ba57be3c92e43d4232806d7540d7d6aa8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              BuzzGUI.ToolBar.dll
              • Path C:\Program Files (x86)\Jeskola\Buzz\BuzzGUI.ToolBar.dll
              • Size 30KB
              • SHA256 a37a2bcbb5f4b715360ff6de4ca44bf0343490f6edcb3a89c1b638291f45b542
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              BuzzGUI.WaveformControl.dll
              • Path C:\Program Files (x86)\Jeskola\Buzz\BuzzGUI.WaveformControl.dll
              • Size 61KB
              • SHA256 a68b3b148862765b4708c68d2f2a09e667d4e6d77bf82170225e5c980f477921
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              BuzzGUI.WavetableView.dll
              • Path C:\Program Files (x86)\Jeskola\Buzz\BuzzGUI.WavetableView.dll
              • Size 28KB
              • SHA256 7d554482a99ef494004b530348ae9c0c1a39680076468bcc97a07df0b537da97
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              BuzzGUI.dll
              • Path C:\Program Files (x86)\Jeskola\Buzz\BuzzGUI.dll
              • Size 225KB
              • SHA256 4ebc67c3dd6eac49c2fed425cc26fd5c4e4b06b3c6be17a207ff83e71f4a01ef
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ICSharpCode.SharpZipLib.dll
              • Path C:\Program Files (x86)\Jeskola\Buzz\ICSharpCode.SharpZipLib.dll
              • Size 196KB
              • SHA256 40b3d590f95191f3e33e5d00e534fa40f823d9b1bb2a9afe05f139c4e0a3af8d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ManagedEngine.dll
              • Path C:\Program Files (x86)\Jeskola\Buzz\ManagedEngine.dll
              • Size 26KB
              • SHA256 581aa128a206688d3a8da8295d596b3bf00f587dc3ddc4b61f8d8d4335132db2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Newtonsoft.Json.dll
              • Path C:\Program Files (x86)\Jeskola\Buzz\Newtonsoft.Json.dll
              • Size 419KB
              • SHA256 32e61c80742f3437a02dbe63f91f18e573c924bdc56246dd77e2d6d537d69572
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              System.CoreEx.dll
              • Path C:\Program Files (x86)\Jeskola\Buzz\System.CoreEx.dll
              • Size 32KB
              • SHA256 f49861e869e466411e10046af5b9ba6e9cfa44ff19a461506bca2d1cf43bfab0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              System.Reactive.dll
              • Path C:\Program Files (x86)\Jeskola\Buzz\System.Reactive.dll
              • Size 525KB
              • SHA256 82b82ea3b63dc63318d42314ad9c738e94f46322d4ba4556f3c0bd9f710d7adb
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              is-LQQLK.tmp
              • Path C:\Program Files (x86)\Jeskola\Buzz\Themes\iLKke machines (extended)\MachineView\gfx\is-LQQLK.tmp
              • Size 933B
              • SHA256 405e2889b2146b7258852a325f6471be06c59a53171ec069f4354fd953377167
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              is-NU4TC.tmp
              • Path C:\Program Files (x86)\Jeskola\Buzz\Themes\iLKke pixelplast (new)\MachineView\gfx\is-NU4TC.tmp
              • Size 14KB
              • SHA256 c1a922bba438ea8d4fbe19ceb9ef96e5bec1962fc32d8229b2f42e8eef37d944
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              is-41IJP.tmp
              • Path C:\Program Files (x86)\Jeskola\Buzz\Themes\iLKke pixelplast (new)\gfx\is-41IJP.tmp
              • Size 640B
              • SHA256 de759a08d6c53682ed833f6ed0914431305b5ab83ba8892f4e8e30b412b4c0fd
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              is-A5R33.tmp
              • Path C:\Program Files (x86)\Jeskola\Buzz\Themes\iLKke pixelplast (new)\gfx\is-A5R33.tmp
              • Size 3KB
              • SHA256 7f7743f6ea0915f853eee0d980cadce1deb7631921bf1a17295cd4a260690cab
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              is-J39HL.tmp
              • Path C:\Program Files (x86)\Jeskola\Buzz\Themes\iLKke pixelplast (new)\gfx\is-J39HL.tmp
              • Size 636B
              • SHA256 ecaf43da3210d3d4e664e7b35259a306392584bbad897aab0893281d453c18c3
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              is-LUOGF.tmp
              • Path C:\Program Files (x86)\Jeskola\Buzz\Themes\iLKke pixelplast (new)\gfx\is-LUOGF.tmp
              • Size 559B
              • SHA256 7ff119d42b9c48bbc7b73e8e3061df1bd43fd820497ebacf73e070486a3e4e26
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              is-Q1MJM.tmp
              • Path C:\Program Files (x86)\Jeskola\Buzz\Themes\iLKke pixelplast (new)\gfx\is-Q1MJM.tmp
              • Size 3KB
              • SHA256 41408a609e919b4262add68ab2d8c1d80f103c7c7d00bf88fd3793d0e26f8d88
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              is-VVO48.tmp
              • Path C:\Program Files (x86)\Jeskola\Buzz\Themes\iLKke pixelplast (new)\gfx\is-VVO48.tmp
              • Size 3KB
              • SHA256 62c7a98f67c78b0a84c39062a5d83b53061d098c3b89b05d853022a025d3e5e9
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              BuzzSetup1503.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\is-R468F.tmp\BuzzSetup1503.tmp
              • Size 692KB
              • SHA256 97108defbfb4a6ffe7a98209a1ea69b400dc8903524b16594649ce819eb82d8e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ngen.log
              • Path C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log
              • Size 150KB
              • SHA256 e98f115cd73f6ff1f5ec17d42f5ffc881db6722e9d0a9deb47c5f20c5b02917c
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/408-1515-0x0000000064CC0000-0x0000000064D11000-memory.dmp
              Download

              memory/936-1622-0x0000000031000000-0x0000000031088000-memory.dmp
              Download

              memory/1012-1872-0x0000000064BC0000-0x0000000064BD9000-memory.dmp
              Download

              memory/1104-1561-0x0000000057A40000-0x0000000057BEB000-memory.dmp
              Download

              memory/1332-1489-0x0000000062990000-0x0000000062C31000-memory.dmp
              Download

              memory/1372-1654-0x0000000000400000-0x00000000004BD000-memory.dmp
              Download

              memory/1372-2587-0x0000000000400000-0x00000000004BD000-memory.dmp
              Download

              memory/1372-19-0x0000000000400000-0x00000000004BD000-memory.dmp
              Download

              memory/1372-17-0x0000000000400000-0x00000000004BD000-memory.dmp
              Download

              memory/1372-1963-0x0000000000400000-0x00000000004BD000-memory.dmp
              Download

              memory/1372-8-0x0000000000400000-0x00000000004BD000-memory.dmp
              Download

              memory/1372-21-0x0000000000400000-0x00000000004BD000-memory.dmp
              Download

              memory/1372-1363-0x0000000000400000-0x00000000004BD000-memory.dmp
              Download

              memory/1372-15-0x0000000000400000-0x00000000004BD000-memory.dmp
              Download

              memory/1372-14-0x0000000000400000-0x00000000004BD000-memory.dmp
              Download

              memory/1592-1651-0x0000000010000000-0x00000000102E6000-memory.dmp
              Download

              memory/1644-1978-0x0000000064A10000-0x0000000064BF6000-memory.dmp
              Download

              memory/1728-2008-0x0000000064BE0000-0x0000000064C22000-memory.dmp
              Download

              memory/1804-1931-0x0000000064DA0000-0x0000000064DDC000-memory.dmp
              Download

              memory/2068-1947-0x0000000010000000-0x0000000010028000-memory.dmp
              Download

              memory/2108-2039-0x000000005C000000-0x000000005C386000-memory.dmp
              Download

              memory/2172-1365-0x0000000010040000-0x00000000100D5000-memory.dmp
              Download

              memory/2388-2290-0x0000000005560000-0x000000000556C000-memory.dmp
              Download

              memory/2388-1683-0x0000000006940000-0x0000000006C9B000-memory.dmp
              Download

              memory/2388-1712-0x0000000010000000-0x00000000101E3000-memory.dmp
              Download

              memory/2596-1455-0x0000000058070000-0x000000005809B000-memory.dmp
              Download

              memory/2632-1917-0x0000000063B10000-0x0000000063B86000-memory.dmp
              Download

              memory/2752-1699-0x0000000053270000-0x000000005333C000-memory.dmp
              Download

              memory/2776-1746-0x0000000006B00000-0x0000000006B22000-memory.dmp
              Download

              memory/2776-1747-0x0000000010050000-0x0000000010108000-memory.dmp
              Download

              memory/2792-1729-0x0000000006560000-0x00000000065AC000-memory.dmp
              Download

              memory/2792-1728-0x0000000004F60000-0x00000000052BB000-memory.dmp
              Download

              memory/2792-1794-0x0000000010360000-0x0000000010B81000-memory.dmp
              Download

              memory/2824-2145-0x0000000010000000-0x0000000010018000-memory.dmp
              Download

              memory/2836-2114-0x0000000010000000-0x0000000010015000-memory.dmp
              Download

              memory/2896-1588-0x0000000063A40000-0x0000000063B6C000-memory.dmp
              Download

              memory/2956-2546-0x0000000003420000-0x0000000003428000-memory.dmp
              Download

              memory/2976-2174-0x0000000031000000-0x0000000031022000-memory.dmp
              Download

              memory/3044-1440-0x00000000628D0000-0x0000000062B5D000-memory.dmp
              Download

              memory/3100-2024-0x000000005E430000-0x000000005E612000-memory.dmp
              Download

              memory/3164-2097-0x0000000010000000-0x000000001016A000-memory.dmp
              Download

              memory/3196-1326-0x00000000079B0000-0x0000000007A7E000-memory.dmp
              Download

              memory/3196-1323-0x0000000007810000-0x0000000007830000-memory.dmp
              Download

              memory/3196-1294-0x0000000006A80000-0x0000000006C08000-memory.dmp
              Download

              memory/3196-1293-0x00000000065E0000-0x00000000065EA000-memory.dmp
              Download

              memory/3196-1292-0x0000000006730000-0x000000000679C000-memory.dmp
              Download

              memory/3196-1291-0x0000000006810000-0x00000000068E4000-memory.dmp
              Download

              memory/3196-1290-0x0000000006680000-0x0000000006728000-memory.dmp
              Download

              memory/3196-1289-0x0000000006110000-0x0000000006118000-memory.dmp
              Download

              memory/3196-1288-0x0000000006590000-0x00000000065CE000-memory.dmp
              Download

              memory/3196-1287-0x00000000060F0000-0x00000000060FE000-memory.dmp
              Download

              memory/3196-1286-0x0000000006230000-0x000000000658B000-memory.dmp
              Download

              memory/3196-1285-0x0000000006080000-0x000000000608E000-memory.dmp
              Download

              memory/3196-1296-0x00000000069B0000-0x0000000006A62000-memory.dmp
              Download

              memory/3196-1281-0x0000000005F50000-0x0000000005F5E000-memory.dmp
              Download

              memory/3196-1297-0x00000000068F0000-0x0000000006912000-memory.dmp
              Download

              memory/3196-1277-0x0000000006090000-0x00000000060A6000-memory.dmp
              Download

              memory/3196-1298-0x0000000006650000-0x0000000006662000-memory.dmp
              Download

              memory/3196-1273-0x0000000005F40000-0x0000000005F4E000-memory.dmp
              Download

              memory/3196-1299-0x00000000071D0000-0x000000000778A000-memory.dmp
              Download

              memory/3196-1269-0x0000000006050000-0x000000000606A000-memory.dmp
              Download

              memory/3196-1300-0x0000000006CB0000-0x0000000006D42000-memory.dmp
              Download

              memory/3196-1265-0x0000000005F30000-0x0000000005F3C000-memory.dmp
              Download

              memory/3196-1301-0x0000000006C10000-0x0000000006C32000-memory.dmp
              Download

              memory/3196-1225-0x0000000072982000-0x0000000072983000-memory.dmp
              Download

              memory/3196-1302-0x0000000006D50000-0x0000000006DB6000-memory.dmp
              Download

              memory/3196-1261-0x0000000006140000-0x0000000006228000-memory.dmp
              Download

              memory/3196-1306-0x0000000006DC0000-0x0000000006DF4000-memory.dmp
              Download

              memory/3196-1257-0x0000000005F20000-0x0000000005F30000-memory.dmp
              Download

              memory/3196-1310-0x0000000006E00000-0x0000000006E70000-memory.dmp
              Download

              memory/3196-1253-0x0000000006010000-0x0000000006042000-memory.dmp
              Download

              memory/3196-1311-0x0000000006F10000-0x0000000006FAC000-memory.dmp
              Download

              memory/3196-1249-0x0000000005EE0000-0x0000000005EF0000-memory.dmp
              Download

              memory/3196-1245-0x0000000005F00000-0x0000000005F16000-memory.dmp
              Download

              memory/3196-1312-0x0000000006E70000-0x0000000006EAC000-memory.dmp
              Download

              memory/3196-1241-0x0000000005ED0000-0x0000000005EDC000-memory.dmp
              Download

              memory/3196-1313-0x0000000006C60000-0x0000000006C72000-memory.dmp
              Download

              memory/3196-1237-0x0000000005F60000-0x000000000600C000-memory.dmp
              Download

              memory/3196-1314-0x0000000006EB0000-0x0000000006EFC000-memory.dmp
              Download

              memory/3196-1233-0x0000000005EA0000-0x0000000005EAC000-memory.dmp
              Download

              memory/3196-1315-0x0000000006C80000-0x0000000006C9E000-memory.dmp
              Download

              memory/3196-1317-0x00000000070F0000-0x000000000712C000-memory.dmp
              Download

              memory/3196-1228-0x0000000003D30000-0x0000000003D6E000-memory.dmp
              Download

              memory/3196-1342-0x0000000008790000-0x000000000881A000-memory.dmp
              Download

              memory/3196-1318-0x0000000007790000-0x00000000077E6000-memory.dmp
              Download

              memory/3196-1338-0x0000000007920000-0x000000000792E000-memory.dmp
              Download

              memory/3196-1319-0x0000000007D20000-0x000000000824C000-memory.dmp
              Download

              memory/3196-1334-0x0000000008850000-0x000000000890A000-memory.dmp
              Download

              memory/3196-1320-0x00000000070D0000-0x00000000070EC000-memory.dmp
              Download

              memory/3196-1333-0x0000000008720000-0x0000000008786000-memory.dmp
              Download

              memory/3196-1321-0x0000000008250000-0x000000000871C000-memory.dmp
              Download

              memory/3196-1322-0x00000000077F0000-0x0000000007802000-memory.dmp
              Download

              memory/3196-1332-0x0000000007980000-0x000000000799A000-memory.dmp
              Download

              memory/3196-1295-0x00000000067A0000-0x00000000067F0000-memory.dmp
              Download

              memory/3196-1331-0x0000000007900000-0x0000000007920000-memory.dmp
              Download

              memory/3196-1324-0x0000000007870000-0x00000000078A2000-memory.dmp
              Download

              memory/3196-1330-0x0000000007A80000-0x0000000007AFD000-memory.dmp
              Download

              memory/3196-1325-0x00000000078B0000-0x00000000078D2000-memory.dmp
              Download

              memory/3196-1329-0x0000000007BB0000-0x0000000007CD2000-memory.dmp
              Download

              memory/3196-1328-0x0000000007850000-0x000000000786A000-memory.dmp
              Download

              memory/3196-1327-0x0000000007930000-0x0000000007974000-memory.dmp
              Download

              memory/3292-2468-0x0000000005CE0000-0x0000000005CEC000-memory.dmp
              Download

              memory/3292-1576-0x000000007B050000-0x000000007BEF7000-memory.dmp
              Download

              memory/3300-1684-0x0000000031000000-0x00000000310A1000-memory.dmp
              Download

              memory/3480-1349-0x0000000010000000-0x000000001000D000-memory.dmp
              Download

              memory/3668-1468-0x0000000058450000-0x0000000058468000-memory.dmp
              Download

              memory/3732-16-0x0000000000400000-0x0000000000414000-memory.dmp
              Download

              memory/3732-0-0x000000000040D000-0x000000000040E000-memory.dmp
              Download

              memory/3732-2-0x0000000000400000-0x0000000000414000-memory.dmp
              Download

              memory/3952-1825-0x0000000008410000-0x0000000008432000-memory.dmp
              Download

              memory/3952-1839-0x0000000065D60000-0x0000000066B30000-memory.dmp
              Download

              memory/4252-1993-0x000000005C000000-0x000000005C069000-memory.dmp
              Download

              memory/4356-2157-0x0000000010000000-0x0000000010033000-memory.dmp
              Download

              memory/4364-1425-0x0000000058480000-0x000000005850F000-memory.dmp
              Download

              memory/4456-1779-0x0000000064C20000-0x0000000064CF0000-memory.dmp
              Download

              memory/4640-1485-0x000000007AEA0000-0x000000007B041000-memory.dmp
              Download

              memory/4644-1395-0x0000000061F60000-0x0000000061FA7000-memory.dmp
              Download

              memory/4652-1530-0x0000000057CB0000-0x0000000058000000-memory.dmp
              Download

              memory/4692-2053-0x0000000063C00000-0x0000000063D30000-memory.dmp
              Download

              memory/4708-1410-0x0000000010000000-0x000000001000D000-memory.dmp
              Download

              memory/4760-1731-0x0000000050160000-0x0000000050180000-memory.dmp
              Download

              memory/4760-2361-0x00000000030B0000-0x00000000030C2000-memory.dmp
              Download

              memory/4768-1381-0x0000000064D10000-0x0000000064DE8000-memory.dmp
              Download

              memory/4820-1856-0x0000000005180000-0x00000000051FD000-memory.dmp
              Download

              memory/4820-1891-0x0000000005470000-0x0000000005599000-memory.dmp
              Download

              memory/4832-2084-0x000000005E620000-0x000000005E882000-memory.dmp
              Download

              memory/4888-1965-0x000000005C000000-0x000000005C0CF000-memory.dmp
              Download

              memory/4896-1667-0x0000000010000000-0x0000000010029000-memory.dmp
              Download

              memory/4908-1607-0x0000000010000000-0x0000000010018000-memory.dmp
              Download

              memory/5032-1902-0x0000000060310000-0x0000000060352000-memory.dmp
              Download

              memory/5284-1809-0x00000000649A0000-0x00000000649E2000-memory.dmp
              Download

              memory/5300-2128-0x0000000010000000-0x000000001006A000-memory.dmp
              Download

              memory/5356-2249-0x0000000005A90000-0x0000000005AA6000-memory.dmp
              Download

              memory/5412-2069-0x0000000010000000-0x0000000010021000-memory.dmp
              Download

              memory/5436-1637-0x0000000010000000-0x000000001001E000-memory.dmp
              Download

              memory/5440-2591-0x000000000D3B0000-0x000000000D3E2000-memory.dmp
              Download

              memory/5440-2592-0x0000000005870000-0x0000000005878000-memory.dmp
              Download

              memory/5440-2583-0x0000000007E80000-0x0000000007E88000-memory.dmp
              Download

              memory/5440-2582-0x0000000003040000-0x000000000307E000-memory.dmp
              Download

              memory/5548-1763-0x0000000066E60000-0x0000000066F24000-memory.dmp
              Download

              memory/5660-1824-0x00000000075C0000-0x000000000763D000-memory.dmp
              Download

              memory/5660-1827-0x0000000062B30000-0x00000000635FA000-memory.dmp
              Download

              memory/5900-1857-0x0000000063B80000-0x0000000063BCE000-memory.dmp
              Download

              memory/5928-1546-0x0000000010000000-0x0000000010130000-memory.dmp
              Download

              memory/5936-2189-0x0000000010000000-0x000000001001A000-memory.dmp
              Download