Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

URLScan

urlscan

1

https://support.plas...

windows10-1703-x64

10

Resubmissions

30/09/2022, 08:06

220930-jzdtfadghm 1

29/09/2022, 12:38

220929-pvf1wsbhcj 10

29/09/2022, 11:14

220929-nccp3sbfbj 10

Analysis

  • max time kernel
    810s
  • max time network
    810s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    29/09/2022, 11:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://support.plassertheurer.com/ws/?097410b3-3921-45e6-9eba-9bf35de0b7c8

Score
10/10
qakbotobama2071664363417bankerstealertrojan

Malware Config

Extracted

Family

qakbot

Version

403.895

Botnet

obama207

Campaign

1664363417

C2

217.165.146.158:993

41.97.179.58:443

86.132.13.49:2078

197.203.50.195:443

85.245.143.94:443

86.196.181.62:2222

102.190.190.242:995

105.184.133.198:995

179.111.23.186:32101

179.251.119.206:995

84.3.85.30:443

39.44.5.104:995

197.41.235.69:995

193.3.19.137:443

186.81.122.168:443

103.173.121.17:443

41.104.80.233:443

102.189.184.12:995

156.199.90.139:443

14.168.180.223:443
Attributes
  • salt

    SoNuce]ugdiB3c[doMuce2s81*uXmcvP

Signatures

  • Qakbot/Qbot

    Qbot or Qakbot is a sophisticated worm with banking capabilities.

    trojanbankerstealerqakbot
  • Enumerates connected drives 3 TTPs 3 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 5 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 47 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 56 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://support.plassertheurer.com/ws/?097410b3-3921-45e6-9eba-9bf35de0b7c8
    1⤵
    • Modifies Internet Explorer Phishing Filter
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3668
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3668 CREDAT:82945 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2288
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:4272
  • C:\Windows\system32\browser_broker.exe
    C:\Windows\system32\browser_broker.exe -Embedding
    1⤵
    • Modifies Internet Explorer settings
    PID:3396
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3004
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:3964
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    PID:4364
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    1⤵
    • Modifies registry class
    PID:4688
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:288
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2076
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\REF_2339_Sep_28.html
        2⤵
        • Opens file in notepad (likely ransom note)
        PID:3056
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:4580
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      PID:3824
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\REF_2339_Sep_28.html"
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:4608
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -url C:\Users\Admin\Downloads\REF_2339_Sep_28.html
        2⤵
        • Checks processor information in registry
        • NTFS ADS
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:644
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="644.0.465472842\1276516386" -parentBuildID 20200403170909 -prefsHandle 1516 -prefMapHandle 1504 -prefsLen 1 -prefMapSize 220115 -appdir "C:\Program Files\Mozilla Firefox\browser" - 644 "\\.\pipe\gecko-crash-server-pipe.644" 1596 gpu
          3⤵
            PID:4544
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="644.3.1204281508\1083069934" -childID 1 -isForBrowser -prefsHandle 2000 -prefMapHandle 1436 -prefsLen 156 -prefMapSize 220115 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 644 "\\.\pipe\gecko-crash-server-pipe.644" 2296 tab
            3⤵
              PID:2728
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="644.13.143137281\447930266" -childID 2 -isForBrowser -prefsHandle 3236 -prefMapHandle 3360 -prefsLen 6938 -prefMapSize 220115 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 644 "\\.\pipe\gecko-crash-server-pipe.644" 3372 tab
              3⤵
                PID:4384
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="644.20.557673286\207018012" -childID 3 -isForBrowser -prefsHandle 4220 -prefMapHandle 4216 -prefsLen 7643 -prefMapSize 220115 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 644 "\\.\pipe\gecko-crash-server-pipe.644" 4204 tab
                3⤵
                  PID:360
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
              1⤵
              • Checks SCSI registry key(s)
              • Modifies data under HKEY_USERS
              PID:2948
            • C:\Windows\System32\WScript.exe
              "C:\Windows\System32\WScript.exe" "E:\gaffes\carafesAspect.js"
              1⤵
              • Enumerates connected drives
              PID:4648
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c ""E:\gaffes\agreedOverpricing.cmd" r32"
                2⤵
                • Enumerates connected drives
                PID:4488
                • C:\Windows\system32\regsvr32.exe
                  regsvr32 gaffes\closest.db
                  3⤵
                    PID:400
                    • C:\Windows\SysWOW64\regsvr32.exe
                      gaffes\closest.db
                      4⤵
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious behavior: MapViewOfSection
                      PID:3320
                      • C:\Windows\SysWOW64\wermgr.exe
                        C:\Windows\SysWOW64\wermgr.exe
                        5⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4576
              • C:\Windows\System32\NOTEPAD.EXE
                "C:\Windows\System32\NOTEPAD.EXE" E:\gaffes\agreedOverpricing.cmd
                1⤵
                  PID:4188
                • C:\Windows\System32\Notepad.exe
                  "C:\Windows\System32\Notepad.exe" E:\gaffes\carafesAspect.js
                  1⤵
                  • Suspicious use of FindShellTrayWindow
                  PID:1520
                • C:\Windows\system32\OpenWith.exe
                  C:\Windows\system32\OpenWith.exe -Embedding
                  1⤵
                  • Modifies registry class
                  • Suspicious use of SetWindowsHookEx
                  PID:1180
                  • C:\Windows\system32\NOTEPAD.EXE
                    "C:\Windows\system32\NOTEPAD.EXE" E:\gaffes\closest.db
                    2⤵
                      PID:2244
                  • C:\Windows\system32\mspaint.exe
                    "C:\Windows\system32\mspaint.exe" "E:\gaffes\chinked.png"
                    1⤵
                    • Enumerates connected drives
                    • Drops file in Windows directory
                    • Suspicious use of SetWindowsHookEx
                    PID:752
                  • \??\c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService
                    1⤵
                      PID:1528
                    • C:\Windows\system32\OpenWith.exe
                      C:\Windows\system32\OpenWith.exe -Embedding
                      1⤵
                      • Suspicious behavior: GetForegroundWindowSpam
                      • Suspicious use of SetWindowsHookEx
                      PID:4232
                      • C:\Windows\system32\NOTEPAD.EXE
                        "C:\Windows\system32\NOTEPAD.EXE" E:\gaffes\chinked.png
                        2⤵
                          PID:3272

                      Network

                      MITRE ATT&CK Enterprise v6

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
                        Filesize

                        471B

                        MD5

                        a042902dbdea921b2f46c7d0198c9ccd

                        SHA1

                        c8deb19ba5d251f44c2bbcbf52340123bc9f1da8

                        SHA256

                        abbd85d1c316255702f6a692c549a64ede98dc77b2db39c562ffcd34002345b7

                        SHA512

                        9a4863916f16fa2636cfdb46d7403b0d263db0b155c13264c9f95bcf87122fe5659edae41f2fb6cd7a440e0073c1a66fc12e65b1f9a6d7de3bb6825e0e6c5d9c

                        Download Submit

                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
                        Filesize

                        404B

                        MD5

                        6a8443d5b3e64508007957d57f058ab5

                        SHA1

                        081cf4a8aae063624d02feb134f9f09770cf2b05

                        SHA256

                        f375733ff8cbb9028329f2774d4a620b56ddac83cf4b4b8460e2c73938bca7ed

                        SHA512

                        d400dcd4c719a62a28bdb6af706a65a41a3980d983100a94a878da028420a113e2249fc311a3a679f9e019531d267bdef8bef69a1059de254e88aeca2a9f1022

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\09I0W0AJ.cookie
                        Filesize

                        615B

                        MD5

                        d41482ea4b2d619e0c81c0e4af51da26

                        SHA1

                        5da3a99a7a4c1b6489628bb25289e41f1d0be723

                        SHA256

                        163b79296aada02a1e7c3c6b53ebeb8b81c71ad1e2dffba892d8ea247353d035

                        SHA512

                        2d41544ed96df0e564f78046f4e8a85cc426e3e4158bee12e38d7dd0521e540946bca84b22f93def8ed4bf503930cf7217fe2934443f41ea08a79842de21dcf7

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\9AGM5YU0.cookie
                        Filesize

                        615B

                        MD5

                        6f5f105db61487deda79bc590ab921e7

                        SHA1

                        949e19cff65acd30fc1762426a02e6d7efe1d4cb

                        SHA256

                        c861209e10a8e358d9047c9fec4e6d311a0a4da52b42361e825c2dfed1cc155a

                        SHA512

                        91dee6dd9148558e054355ec1754f6cb139afecf8d6389e3997023570228e457dfaf55e4eafd2fa460241333f740f67ca058683a1c4f1d625d75d3427ba153f5

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!121\Microsoft\Windows\3720402701\2219095117.pri
                        Filesize

                        207KB

                        MD5

                        e2b88765ee31470114e866d939a8f2c6

                        SHA1

                        e0a53b8511186ff308a0507b6304fb16cabd4e1f

                        SHA256

                        523e419d2fa2e780239812d36caa37e92f8c3e6a5cd9f18f0d807c593effa45e

                        SHA512

                        462e8e6b4e63fc6781b6a9935b332a1dc77bfb88e1de49134f86fd46bd1598d2e842902dd9415a328e325bd7cdee766bd9473f2695acdfa769ffe7ba9ae1953d

                        Download Submit

                      • C:\Users\Admin\Downloads\REF_2339_Sep_28.html.wvirykj.partial
                        Filesize

                        819KB

                        MD5

                        573df5a77d5751db2efb22ad6568a063

                        SHA1

                        540e3692897e44661187eb10bdb8db18b65cf6ee

                        SHA256

                        af5bb2e8b6c6c3836f9e98ce9073ad0ce0d670c31f86512ffa5dbc9096d3bac7

                        SHA512

                        c234509d73ae7c7321c0cb03dcad28a0984387ca533b698f848ff2474d3367b2e40ee27c1c1b4ecf2eb96d4d499eca2a7442a34661fa472b03841bc23c79d1f5

                        Download Submit

                      • memory/3320-164-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-169-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-137-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-138-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-139-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-140-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-141-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-142-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-143-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-144-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-145-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-146-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-147-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-148-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-149-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-150-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-151-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-152-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-153-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-154-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-155-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-156-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-157-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-158-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-159-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-160-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-161-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-162-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-163-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-236-0x00000000044D0000-0x00000000044F2000-memory.dmp

                        Filesize

                        136KB

                        Download

                      • memory/3320-165-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-166-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-167-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-168-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-193-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-170-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-171-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-172-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-173-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-174-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-175-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-176-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-177-0x0000000000980000-0x0000000000A33000-memory.dmp

                        Filesize

                        716KB

                        Download

                      • memory/3320-178-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-179-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-180-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-181-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-182-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-183-0x00000000044D0000-0x00000000044F2000-memory.dmp

                        Filesize

                        136KB

                        Download

                      • memory/3320-184-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-185-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-186-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-187-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-190-0x00000000044D0000-0x00000000044F2000-memory.dmp

                        Filesize

                        136KB

                        Download

                      • memory/3320-189-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-188-0x0000000004460000-0x00000000044A2000-memory.dmp

                        Filesize

                        264KB

                        Download

                      • memory/3320-191-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3320-192-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/3964-125-0x00000293744E0000-0x00000293744E2000-memory.dmp

                        Filesize

                        8KB

                        Download

                      • memory/4272-120-0x0000022AB5520000-0x0000022AB5530000-memory.dmp

                        Filesize

                        64KB

                        Download

                      • memory/4272-119-0x0000022AB5420000-0x0000022AB5430000-memory.dmp

                        Filesize

                        64KB

                        Download

                      • memory/4576-195-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/4576-196-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/4576-197-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/4576-198-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/4576-199-0x0000000077A40000-0x0000000077BCE000-memory.dmp

                        Filesize

                        1.6MB

                        Download

                      • memory/4576-237-0x0000000000960000-0x0000000000982000-memory.dmp

                        Filesize

                        136KB

                        Download