Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    174s
  • max time network
    177s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/09/2022, 21:47

General

  • Target

    8573d9e75f2c0ef4e69023fc07bee9cb.exe

  • Size

    91KB

  • MD5

    8573d9e75f2c0ef4e69023fc07bee9cb

  • SHA1

    4f3afbab31505056fd71f462bd52f98f3dd9f8ff

  • SHA256

    e5d590f782337416fe7f93aa7f488419f86802500d05ef2fced4ccca7f4e14ae

  • SHA512

    11bbaa8c41989d583ca1af59d8c51b80825634807dfcd8fc50f5e8d3190d224ca48139f70e10a2993b9ae1bca599ee0dd1422af5c716f5441c533c1dedef72e7

  • SSDEEP

    1536:dbRiQM/57SK3bUzZdQ1iIMvnZlbLxjV3AGq5gWlocT1wzySsd9NJ33B:dbRE57SKsstcnZTJQDgWPaySsdH5x

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{4e498bc7-105a-4838-9874-dcd808cf5910}\0.0.filtertrie.intermediate.txt

Ransom Note
0 0 ~ zoom~ zooming when you pinch with two fingers on the touchpad~ zoom mode~ zoom level~ zoom lens size~ zoom lens settings~ zoom in~ zoom increment~ zoom in:wux:zoom in~ zoom behavior~ zoom amount~ zone~ zones~ zone automatically~ ypdate~ your work or school~ your work or school domain~ your work or school cloud domain~ your windows mixed reality headset goes to sleep~ your wheel~ your voice~ your voice to improve speech services~ your voice to control your pc~ your videos library~ your update history~ your touchpad~ your touchpad to its default settings~ your timeline~ your sound output device~ your sound input device~ your settings~ your restart~ your recovery key~ your quick actions~ your profile~ your product id~ your picture~ your pictures library~ your phone~ your phone to timeline~ your personalization settings~ your pen's pressure sensitivity~ your pen shortcuts~ your pen settings~ your pc~ your pc recognizes your handwriting~ your pc name~ your pc and help you, or offer to help someone else~ your password~ your passwords on this pc~ your organization to manage your pc~ your offline files~ your notifications~ your network properties~ your network adapter~ your mouse~ your mouse to the end of the taskbar~ your mouse settings~ your microphone~ your lock screen background~ your language list~ your language and keyboard settings~ your info~ your homepage~ your hololens~ your headset sleeps~ your handwriting~ your fingertip~ your files with file history~ your eye tracker~ your email~ your drives~ your documents library~ your diagnostic data~ your device~ your device to your work or school domain~ your device to your work or school cloud domain~ your device password-less~ your device history~ your device from your work or school~ your device easier to hear~ your desktop background~ your country or region~ your cortana devices~ your contacts~ your computer~ your computer's status and resolve issues~ your computer's power settings~ your computer's memory problems~ your computer name~ your computer is on~ your cellular data connection with other devices~ your camera~ your call history~ your calendar~ your button flows as quick actions~ your braille display~ your advertising id~ your account~ your account picture~ your account info~ your accent color~ you, or offer to help someone else~ you use windows~ you use three finger taps on the touchpad~ you use the touchpad~ you use the mouse~ you use four finger taps on the touchpad~ you type~ you touch the screen~ you to enter tablet mode~ you tap with two fingers on the touchpad~ you store offline maps~ you speak with your device~ you sign in~ you send to microsoft~ you scroll with the mouse wheel~ you pinch with two fingers on the touchpad~ you open links~ you move your mouse to the end of the taskbar~ you have a 32-bit or 64-bit version of windows~ you drag with two fingers on the touchpad~ you drag three fingers on the touchpad~ you drag four fingers on the touchpad~ you double-tap the spacebar~ you double-tap shift~ you choose a text suggestion~ you can always say "hey cortana"~ you are right or left handed~ xdevice settings~ xbox performance~ xbox one settings~ xbox one controller settings~ xbox networking~ xbox networking settings~ xbox multiplayer settings~ xbox live~ xbox game bar~ x-device settings~ x menu~ wwin~ wwindows~ wwan~ wupdate~ wupdater~ wudo~ wuapp~ wsr~ writing~ write~ write in the handwriting panel with your fingertip~ workspace~ workspace when i remove my pen from storage~ workspace settings~ workplace settings~ workplace policies~ workplace network~ workplace access~ workgroup this computer is on~ workgroup name~ workflow~ work users~ work settings~ work remotely~ work or school~ work or school users~ work or school domain~ work or school cloud domain~ work network~ work hours~ work folders~ work email~ work account~ words~ words as you type~ words as i type~ word echo~ wondows~ wndows~ wndows update~ wlan~ wlan settings~ without sound~ without signing~ with your network adapter~ with your fingertip~ with your device~ with your computer~ with your computer's power settings~ with windows update~ with windows store apps~ with windows search~ with windows powershell in the win + x menu~ with windows mixed reality~ with windows firewall~ with two fingers on the touchpad~ with the touch keyboard~ with the screen when using the mouse~ with the mouse wheel~ with speech~ with shared folders~ with recording sound~ with quickstart~ with printing~ with playing sound~ with playing movies, tv shows, or videos~ with other devices~ with narrator~ with file history~ with directaccess~ with bluetooth devices~ with background downloads~ wireless~ wireless:wux:wireless~ wireless settings~ wireless display~ wireless display settings~ wireless devices on or off~ wireless controller settings~ wireless adapter problems~ wireless adapter issues~ wipe:wux:wipe~ winupdate~ winsows~ winows~ winows update~ winodws~ winodws update~ winf~ windws~ windws update~ windwos update~ windpws~ window~ windowupdate~ windows~ windowsupdate~ windowsupdates~ windows y~ windows x~ windows when i hover over them~ windows welcome notifications~ windows vpn~ windows version~ windows version:wux:windows version~ windows ups~ windows upo~ windows upgrade~ windows updte~ windows updatw~ windows updats~ windows updatre~ windows update~ windows updates~ windows updates:wux:windows updates~ windows updater~ windows updater:wux:windows updater~ windows updated~ windows update troubleshooter~ windows update settings~ windows update settings:wux:windows update settings~ windows update restart settings~ windows update problems~ windows update policies~ windows update options~ windows update not working~ windows update issues~ windows update history~ windows update delivery settings~ windows update delivery optimization~ windows update broken~ windows updare~ windows updae~ windows updaet~ windows upate~ windows upadte~ windows uop~ windows uodate~ windows uip~ windows udpate~ windows udate~ windows u[~ windows track app launches to improve start and search results~ windows to the sides or corners of the screen~ windows to go startup options~ windows to fill available space~ windows system:wux:windows system~ windows sync activities from this pc to the cloud~ windows suggest ease of access settings~ windows subscription~ windows store apps~ windows spotlight~ windows speech recognition~ windows specifications~ windows sonic~ windows show on the taskbar when using virtual desktops~ windows settings~ windows security settings~ windows search~ windows searches~ windows search:wux:windows search~ windows search settings~ windows s mode settings~ windows restore:wux:windows restore~ windows repair:wux:windows repair~ windows recovery:wux:windows recovery~ windows privacy~ windows powershell in the win + x menu~ windows permissions~ windows pdate~ windows password~ windows online personalization gallery~ windows on taskbar on secondary displays~ windows on taskbar on primary display~ windows mr settings~ windows mobility center~ windows mixed reality~ windows mixed reality settings~ windows mixed reality headset goes to sleep~ windows mixed reality audio settings~ windows manage my default printer~ windows logo key + c~ windows license~ windows is activated~ windows insider settings~ windows insider program settings~ windows ink workspace settings~ windows ink settings~ windows information:wux:windows information~ windows indexer~ windows hello~ windows hello:wux:windows hello~ windows hello setup~ windows hello settings~ windows hello pin~ windows hello fingerprint~ windows hello face~ windows hd color settings~ windows firewall~ windows firewall with advanced security~ windows firewall troubleshooter~ windows fire wall~ windows feedback frequency~ windows features on or off~ windows features appear in~ windows edition~ windows display language~ windows disk management~ windows diagnostics~ windows device manager~ windows defender~ windows defender firewall~ windows credentials~ windows credential manager~ windows collect activities from this pc~ windows cant hear me~ windows can't hear me~ windows backup:wux:windows backup~ windows background images~ windows anywhere settings~ windows animation~ windows and tabs appear when pressing alt+tab~ windows activation~ windows activation settings~ windows activate~ windows 8~ windows 8.1~ windows 7~ windows 64~ windows 32~ windows 10 update~ windows 10 updates:wux:windows 10 updates~ windows 10 restarts~ windows + x~ windown~ windowing~ windowes~ windowa update~ window, show what i can snap next to it~ window, resize any adjacent snapped window~ window version:wux:window version~ window update~ window updates~ window transparency~ window sup~ window supdate~ window layout~ window firewall~ window fill~ window features~ window de~ window color~ window arrangement~ windos update~ windoq~ windopws~ windoiws~ windoews~ windoes~ windoes update~ windiws~ windd~ winddows~ wind up~ win-x~ win-v~ win-c~ win+x~ win+v~ win+g~ win+c~ win x~ win update~ win updates~ win plus x~ win plus c~ win c~ win - x~ win - v~ win - c~ win + x menu~ win + v~ win + c~ wimd~ wimdows~ wiin~ wiindows~ wifi~ wifi settings~ width~ widows update~ widnows update~ wider cursor~ wider caret~ wide cursor~ wide caret~ wi-fi~ wi-fi:wux:wi-fi~ wi-fi settings~ wi-fi networks~ wi fi~ why an action can't be performed~ white theme~ white pointer~ white mouse pointer~ white mouse cursor~ white cursor~ while roaming~ while focus assist was on~ which workgroup this computer is on~ which icons appear on the taskbar~ which folders appear on start~ which files and folders are indexed~ which domain your computer is on~ which apps show notifications~ which apps should not be included in sets~ which apps can run in the background~ which apps can make phone calls~ which apps can control radios~ which apps can access your videos library~ which apps can access your pictures library~ which apps can access your notifications~ which apps can access your microphone~ which apps can access your eye tracker~ which apps can access your email~ which apps can access your documents library~ which apps can access your contacts~ which apps can access your camera~ which apps can access your call history~ which apps can access your calendar~ which apps can access your account info~ which apps can access diagnostic information~ which accounts appear in your timeline~ whether you are right or left handed~ whether to have a touchpad delay~ whether to enter tablet mode when you sign in~ whether the system asks you to enter tablet mode~ where you store offline maps~ where to install apps from~ where is the product key~ when your windows mixed reality headset goes to sleep~ when your headset sleeps~ when you use three finger taps on the touchpad~ when you use the touchpad~ when you use the mouse~ when you use four finger taps on the touchpad~ when you touch the screen~ when you tap with two fingers on the touchpad~ when you sign in~ when you pinch with two fingers on the touchpad~ when you move your mouse to the end of the taskbar~ when you drag with two fingers on the touchpad~ when you drag three fingers on the touchpad~ when you drag four fingers on the touchpad~ when you double-tap the spacebar~ when you double-tap shift~ when you choose a text suggestion~ when using virtual desktops~ when using the touchpad~ when using the mouse~ when using repeat keys~ when using captures~ when typing~ when two keys are pressed at the same time~ when turning on sticky, toggle, or filter keys~ when to turn off the screen~ when to turn off the screen when plugged in~ when to turn off the screen on battery power~ when the sticky keys modifier key is pressed~ when the screen is turned off~ when the pc sleeps~ when the pc sleeps when plugged in~ when the pc sleeps on battery power~ when pressing caps lock, num lock, or scroll lock~ when pressing alt+tab~ when possible~ when plugged in~ when pcs try to connect to my mobile device using usb~ when on battery~ when num lock is on~ when navigating~ when narrator is speaking~ when narrator is on~ when my device is locked~ when lighting changes~ when launching an app from another app~ when keys are pressed~ when i’m using my pen~ when it’s available~ when it's pressed twice in a row~ when it's moving~ when i turn on narrator~ when i snap a window, show what i can snap next to it~ when i resize a snapped window, resize any adjacent snapped window~ when i remove my pen from storage~ when i record~ when i record a game~ when i hover over them~ when enabling sticky keys, toggle keys, or filter keys~ when duplicating screen~ when closing tabs~ when apps access my location~ when a mouse is connected~ wheel~ wheels~ wheel vibration settings~ wheel vibrate~ wheel settings~ wheel haptics settings~ wheel defaults~ wheel default settings~ whats new~ what's new~ what windows show on the taskbar when using virtual desktops~ what windows and tabs appear when pressing alt+tab~ what version of windows do i have:wux:what version of windows do i have~ what is my computer name:wux:what is my computer name~ what i missed while focus assist was on~ what i can snap next to it~ what happens when you use three finger taps on the touchpad~ what happens when you use four finger taps on the touchpad~ what happens when you drag three fingers on the touchpad~ what happens when you drag four fingers on the touchpad~ what cortana can do, see, and use~ what closing the lid does~ what appears when pressing alt+tab~ what appears when launching an app from another app~ wfi~ well your pc recognizes your handwriting~ welcome screen~ welcome screen settings~ welcome notifications~ website~ websites~ websites can use your language list~ website apps~ weblinks~ webcame~ webcam:wux:webcam~ webcam settings~ webcam privacy~ webcam permissions~ web to app link~ web to app linking~ web pages are displayed in tabs~ web links~ web language~ web languages~ web credentials~ web content control~ web cam:wux:web cam~ web browser~ web browsers~ web browser settings~ web apps~ ways i can set up my device to get the most out of windows~ way measurements are displayed~ way currency is displayed~ was on~ warn~ warning~ warnings~ wallpaper~ wallpaper sync~ wallpaper settings~ wait for second keystroke~ wait for repeated keystrokes~ wait for new keystrokes~ wait for keystrokes~ wait for different keystrokes~ wait before accepting keystrokes~ w up~ vpnm~ vpn while roaming~ vpn settings~ vpn over metered networks~ vpn options~ vpn connection~ vpn advanced settings~ vpn advanced options~ vpmn~ volume~ volume settings~ volume of other apps when narrator is speaking~ volume mixer~ volume mixer:wux:volume mixer~ volume level~ volume control~ voice~ voices~ voiceover~ voice volume~ voice tone~ voice to improve speech services~ voice to control your pc~ voice timbre~ voice timber~ voice speed~ voice settings~ voice rate~ voice quality~ voice pitch~ voice for apps~ voice emphasize formatted text~ voice dictation~ voice data~ voice control~ voice agents~ voice agent settings~ voice activation settings~ voice activation privacy settings~ voice activation permissions~ vlue~ vivid~ visual~ visuals~ visual quality of windows mixed reality~ visual feedback when you touch the screen~ visual feedback touch settings~ visual feedback pen settings~ visual feedback on or off~ visual display~ visual cursor for narrator~ visual alerts for audio notifications~ visual alert for audio notifications~ vision~ vision settings~ visible alerts~ virus~ virtual private networks~ virtual private network settings~ virtual desktop~ virtual desktops~ virtual desktop settings~ view~ viewer

Extracted

Family

arrowrat

Botnet

TY

C2

91.134.207.23:5337

Mutex

DFDFrcvff45thfgh4t44gjahdfhhhhca

Signatures

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 22 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 49 IoCs
  • Suspicious use of SendNotifyMessage 21 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8573d9e75f2c0ef4e69023fc07bee9cb.exe
    "C:\Users\Admin\AppData\Local\Temp\8573d9e75f2c0ef4e69023fc07bee9cb.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3752
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:5108
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" TY 91.134.207.23 5337 DFDFrcvff45thfgh4t44gjahdfhhhhca
      2⤵
        PID:4300
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4944
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Enumerates system info in registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:3476
    • C:\Windows\system32\SearchIndexer.exe
      C:\Windows\system32\SearchIndexer.exe /Embedding
      1⤵
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1432
      • C:\Windows\system32\SearchProtocolHost.exe
        "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
        2⤵
        • Modifies data under HKEY_USERS
        PID:2824
      • C:\Windows\system32\SearchFilterHost.exe
        "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
        2⤵
        • Modifies data under HKEY_USERS
        PID:4396

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1432-205-0x000002100AFB0000-0x000002100AFC0000-memory.dmp

      Filesize

      64KB

    • memory/1432-207-0x000002100D5A0000-0x000002100D5A8000-memory.dmp

      Filesize

      32KB

    • memory/1432-206-0x000002100B1E0000-0x000002100B1F0000-memory.dmp

      Filesize

      64KB

    • memory/3476-178-0x0000029BED68D000-0x0000029BED690000-memory.dmp

      Filesize

      12KB

    • memory/3476-182-0x0000029BED660000-0x0000029BED663000-memory.dmp

      Filesize

      12KB

    • memory/3476-158-0x0000029BED66C000-0x0000029BED670000-memory.dmp

      Filesize

      16KB

    • memory/3476-159-0x0000029BED66C000-0x0000029BED670000-memory.dmp

      Filesize

      16KB

    • memory/3476-160-0x0000029BED66C000-0x0000029BED670000-memory.dmp

      Filesize

      16KB

    • memory/3476-161-0x0000029BED66C000-0x0000029BED670000-memory.dmp

      Filesize

      16KB

    • memory/3476-163-0x0000029BED671000-0x0000029BED674000-memory.dmp

      Filesize

      12KB

    • memory/3476-164-0x0000029BED671000-0x0000029BED674000-memory.dmp

      Filesize

      12KB

    • memory/3476-165-0x0000029BED671000-0x0000029BED674000-memory.dmp

      Filesize

      12KB

    • memory/3476-194-0x0000029BED760000-0x0000029BED766000-memory.dmp

      Filesize

      24KB

    • memory/3476-173-0x0000029BED689000-0x0000029BED68D000-memory.dmp

      Filesize

      16KB

    • memory/3476-171-0x0000029BED689000-0x0000029BED68D000-memory.dmp

      Filesize

      16KB

    • memory/3476-172-0x0000029BED689000-0x0000029BED68D000-memory.dmp

      Filesize

      16KB

    • memory/3476-174-0x0000029BED689000-0x0000029BED68D000-memory.dmp

      Filesize

      16KB

    • memory/3476-177-0x0000029BED68D000-0x0000029BED690000-memory.dmp

      Filesize

      12KB

    • memory/3476-179-0x0000029BED68D000-0x0000029BED690000-memory.dmp

      Filesize

      12KB

    • memory/3476-148-0x0000029BEA688000-0x0000029BEA690000-memory.dmp

      Filesize

      32KB

    • memory/3476-184-0x0000029BED660000-0x0000029BED663000-memory.dmp

      Filesize

      12KB

    • memory/3476-150-0x0000029BEB6B0000-0x0000029BEB6D0000-memory.dmp

      Filesize

      128KB

    • memory/3476-183-0x0000029BED660000-0x0000029BED663000-memory.dmp

      Filesize

      12KB

    • memory/3476-166-0x0000029BED671000-0x0000029BED674000-memory.dmp

      Filesize

      12KB

    • memory/3476-192-0x0000029BED760000-0x0000029BED766000-memory.dmp

      Filesize

      24KB

    • memory/3476-193-0x0000029BED760000-0x0000029BED766000-memory.dmp

      Filesize

      24KB

    • memory/3476-195-0x0000029BED760000-0x0000029BED766000-memory.dmp

      Filesize

      24KB

    • memory/3476-196-0x0000029BED760000-0x0000029BED766000-memory.dmp

      Filesize

      24KB

    • memory/3476-197-0x0000029BED760000-0x0000029BED766000-memory.dmp

      Filesize

      24KB

    • memory/3476-198-0x0000029BED760000-0x0000029BED766000-memory.dmp

      Filesize

      24KB

    • memory/3476-202-0x0000029BED769000-0x0000029BED76C000-memory.dmp

      Filesize

      12KB

    • memory/3476-201-0x0000029BED769000-0x0000029BED76C000-memory.dmp

      Filesize

      12KB

    • memory/3476-203-0x0000029BED769000-0x0000029BED76C000-memory.dmp

      Filesize

      12KB

    • memory/3476-152-0x0000029BEBF00000-0x0000029BEBF20000-memory.dmp

      Filesize

      128KB

    • memory/3476-157-0x0000029BED66C000-0x0000029BED670000-memory.dmp

      Filesize

      16KB

    • memory/3752-132-0x0000000000010000-0x000000000002E000-memory.dmp

      Filesize

      120KB

    • memory/3752-133-0x0000000004E90000-0x0000000005434000-memory.dmp

      Filesize

      5.6MB

    • memory/3752-134-0x0000000004AD0000-0x0000000004B6C000-memory.dmp

      Filesize

      624KB

    • memory/4300-137-0x0000000000400000-0x0000000000410000-memory.dmp

      Filesize

      64KB

    • memory/4300-138-0x00000000052D0000-0x0000000005362000-memory.dmp

      Filesize

      584KB

    • memory/4396-278-0x0000018E60140000-0x0000018E60150000-memory.dmp

      Filesize

      64KB

    • memory/4396-382-0x0000018E61420000-0x0000018E61430000-memory.dmp

      Filesize

      64KB

    • memory/4396-211-0x0000018E60140000-0x0000018E60150000-memory.dmp

      Filesize

      64KB

    • memory/4396-212-0x0000018E60140000-0x0000018E60150000-memory.dmp

      Filesize

      64KB

    • memory/4396-213-0x0000018E60140000-0x0000018E60150000-memory.dmp

      Filesize

      64KB

    • memory/4396-214-0x0000018E60140000-0x0000018E60150000-memory.dmp

      Filesize

      64KB

    • memory/4396-215-0x0000018E60140000-0x0000018E60150000-memory.dmp

      Filesize

      64KB

    • memory/4396-216-0x0000018E60140000-0x0000018E60150000-memory.dmp

      Filesize

      64KB

    • memory/4396-226-0x0000018E60140000-0x0000018E60150000-memory.dmp

      Filesize

      64KB

    • memory/4396-227-0x0000018E60150000-0x0000018E60160000-memory.dmp

      Filesize

      64KB

    • memory/4396-228-0x0000018E60160000-0x0000018E60170000-memory.dmp

      Filesize

      64KB

    • memory/4396-229-0x0000018E60C70000-0x0000018E60C80000-memory.dmp

      Filesize

      64KB

    • memory/4396-279-0x0000018E60CB0000-0x0000018E60CC0000-memory.dmp

      Filesize

      64KB

    • memory/4396-280-0x0000018E60CB0000-0x0000018E60CC0000-memory.dmp

      Filesize

      64KB

    • memory/4396-281-0x0000018E60CB0000-0x0000018E60CC0000-memory.dmp

      Filesize

      64KB

    • memory/4396-282-0x0000018E60CB0000-0x0000018E60CC0000-memory.dmp

      Filesize

      64KB

    • memory/4396-284-0x0000018E60CB0000-0x0000018E60CC0000-memory.dmp

      Filesize

      64KB

    • memory/4396-283-0x0000018E60CB0000-0x0000018E60CC0000-memory.dmp

      Filesize

      64KB

    • memory/4396-286-0x0000018E60CB0000-0x0000018E60CC0000-memory.dmp

      Filesize

      64KB

    • memory/4396-285-0x0000018E60CB0000-0x0000018E60CC0000-memory.dmp

      Filesize

      64KB

    • memory/4396-287-0x0000018E60CB0000-0x0000018E60CC0000-memory.dmp

      Filesize

      64KB

    • memory/4396-288-0x0000018E60CB0000-0x0000018E60CC0000-memory.dmp

      Filesize

      64KB

    • memory/4396-289-0x0000018E60CB0000-0x0000018E60CC0000-memory.dmp

      Filesize

      64KB

    • memory/4396-306-0x0000018E60140000-0x0000018E60150000-memory.dmp

      Filesize

      64KB

    • memory/4396-307-0x0000018E613D0000-0x0000018E613E0000-memory.dmp

      Filesize

      64KB

    • memory/4396-310-0x0000018E60140000-0x0000018E60150000-memory.dmp

      Filesize

      64KB

    • memory/4396-315-0x0000018E60140000-0x0000018E60150000-memory.dmp

      Filesize

      64KB

    • memory/4396-316-0x0000018E60140000-0x0000018E60150000-memory.dmp

      Filesize

      64KB

    • memory/4396-317-0x0000018E60140000-0x0000018E60150000-memory.dmp

      Filesize

      64KB

    • memory/4396-318-0x0000018E613D0000-0x0000018E613E0000-memory.dmp

      Filesize

      64KB

    • memory/4396-319-0x0000018E613D0000-0x0000018E613E0000-memory.dmp

      Filesize

      64KB

    • memory/4396-320-0x0000018E613D0000-0x0000018E613E0000-memory.dmp

      Filesize

      64KB

    • memory/4396-363-0x0000018E60140000-0x0000018E60150000-memory.dmp

      Filesize

      64KB

    • memory/4396-364-0x0000018E613D0000-0x0000018E613E0000-memory.dmp

      Filesize

      64KB

    • memory/4396-210-0x0000018E60140000-0x0000018E60150000-memory.dmp

      Filesize

      64KB

    • memory/4396-381-0x0000018E60140000-0x0000018E60150000-memory.dmp

      Filesize

      64KB

    • memory/4396-384-0x0000018E61420000-0x0000018E61430000-memory.dmp

      Filesize

      64KB

    • memory/4396-383-0x0000018E61420000-0x0000018E61430000-memory.dmp

      Filesize

      64KB

    • memory/4396-417-0x0000018E60140000-0x0000018E60150000-memory.dmp

      Filesize

      64KB

    • memory/4396-418-0x0000018E61420000-0x0000018E61430000-memory.dmp

      Filesize

      64KB

    • memory/4396-419-0x0000018E61420000-0x0000018E61430000-memory.dmp

      Filesize

      64KB

    • memory/4396-420-0x0000018E61420000-0x0000018E61430000-memory.dmp

      Filesize

      64KB

    • memory/4396-421-0x0000018E61420000-0x0000018E61430000-memory.dmp

      Filesize

      64KB

    • memory/4396-422-0x0000018E61420000-0x0000018E61430000-memory.dmp

      Filesize

      64KB

    • memory/4396-423-0x0000018E61420000-0x0000018E61430000-memory.dmp

      Filesize

      64KB

    • memory/4396-424-0x0000018E61420000-0x0000018E61430000-memory.dmp

      Filesize

      64KB

    • memory/4396-441-0x0000018E60140000-0x0000018E60150000-memory.dmp

      Filesize

      64KB

    • memory/4396-442-0x0000018E62410000-0x0000018E62420000-memory.dmp

      Filesize

      64KB

    • memory/4396-443-0x0000018E62410000-0x0000018E62420000-memory.dmp

      Filesize

      64KB

    • memory/4396-444-0x0000018E62410000-0x0000018E62420000-memory.dmp

      Filesize

      64KB

    • memory/4396-445-0x0000018E62410000-0x0000018E62420000-memory.dmp

      Filesize

      64KB

    • memory/4396-446-0x0000018E60160000-0x0000018E60170000-memory.dmp

      Filesize

      64KB

    • memory/4396-447-0x0000018E60C70000-0x0000018E60C80000-memory.dmp

      Filesize

      64KB

    • memory/4396-448-0x0000018E60CB0000-0x0000018E60CC0000-memory.dmp

      Filesize

      64KB

    • memory/4396-449-0x0000018E60CB0000-0x0000018E60CC0000-memory.dmp

      Filesize

      64KB

    • memory/4396-450-0x0000018E60CB0000-0x0000018E60CC0000-memory.dmp

      Filesize

      64KB

    • memory/4396-451-0x0000018E60CB0000-0x0000018E60CC0000-memory.dmp

      Filesize

      64KB

    • memory/4396-452-0x0000018E60CB0000-0x0000018E60CC0000-memory.dmp

      Filesize

      64KB

    • memory/4396-453-0x0000018E60CB0000-0x0000018E60CC0000-memory.dmp

      Filesize

      64KB

    • memory/4396-454-0x0000018E60CB0000-0x0000018E60CC0000-memory.dmp

      Filesize

      64KB

    • memory/4396-455-0x0000018E60CB0000-0x0000018E60CC0000-memory.dmp

      Filesize

      64KB

    • memory/4396-456-0x0000018E60CB0000-0x0000018E60CC0000-memory.dmp

      Filesize

      64KB

    • memory/4396-457-0x0000018E60CB0000-0x0000018E60CC0000-memory.dmp

      Filesize

      64KB

    • memory/4396-459-0x0000018E60CB0000-0x0000018E60CC0000-memory.dmp

      Filesize

      64KB

    • memory/4396-458-0x0000018E60CB0000-0x0000018E60CC0000-memory.dmp

      Filesize

      64KB

    • memory/4396-460-0x0000018E61420000-0x0000018E61430000-memory.dmp

      Filesize

      64KB

    • memory/4396-461-0x0000018E61420000-0x0000018E61430000-memory.dmp

      Filesize

      64KB