Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

JC_fb31bec...ff.exe

windows7-x64

10

JC_fb31bec...ff.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    97s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/10/2023, 14:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    JC_fb31becd251c87450afffbc194d4a93c87db29d40a5857fa13959124db68fdff.exe

  • Size

    215KB

  • MD5

    8ea351569502e25ccc2e22fe07de34de

  • SHA1

    ce3337bf8eff1f6ce9b269d876f685fa4e9da37d

  • SHA256

    fb31becd251c87450afffbc194d4a93c87db29d40a5857fa13959124db68fdff

  • SHA512

    833afac8de18ed09d57a0b4ae32223c101ccb58b4bc6d19f18775e89766a4b83322b033bd89795853780e81a48e0a89371d7e14d8611f663bed06ba81199450d

  • SSDEEP

    3072:dAXRhajNeLyTfK8U6sj/+aOZOEcJrcanXplEPmAZHI5TvpTJel:GRhkNeLsS8U6mOM1J5nZ6PJZH6vpTU

Score
10/10
smokeloaderup4backdoorpersistencetrojan

Malware Config

Extracted

Family

smokeloader

Botnet

up4

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-file0.com/

http://file-file-file1.com/
rc4.i32
rc4.i32

Signatures

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Modifies Installed Components in the registry 2 TTPs 2 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 39 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 19 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Suspicious use of FindShellTrayWindow 24 IoCs
  • Suspicious use of SendNotifyMessage 20 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\JC_fb31becd251c87450afffbc194d4a93c87db29d40a5857fa13959124db68fdff.exe
    "C:\Users\Admin\AppData\Local\Temp\JC_fb31becd251c87450afffbc194d4a93c87db29d40a5857fa13959124db68fdff.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2608
    • C:\Users\Admin\AppData\Local\Temp\JC_fb31becd251c87450afffbc194d4a93c87db29d40a5857fa13959124db68fdff.exe
      "C:\Users\Admin\AppData\Local\Temp\JC_fb31becd251c87450afffbc194d4a93c87db29d40a5857fa13959124db68fdff.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:5000
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies Installed Components in the registry
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3412
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:796
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
      PID:2056
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
        PID:4604
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
          PID:3744
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:824
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:972
            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
              1⤵
                PID:4832
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:960
                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                  1⤵
                    PID:1164
                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                    1⤵
                      PID:1872
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                        PID:2328
                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                        1⤵
                          PID:3720
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:728
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:3588
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                                PID:3640
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:1528
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:3816
                                  • C:\Windows\explorer.exe
                                    explorer.exe
                                    1⤵
                                      PID:3972
                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                      1⤵
                                        PID:3424
                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                        1⤵
                                          PID:4900
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                            PID:2252
                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                            1⤵
                                              PID:4020
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:3408
                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                1⤵
                                                  PID:2364
                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                  1⤵
                                                    PID:960
                                                  • C:\Windows\explorer.exe
                                                    explorer.exe
                                                    1⤵
                                                      PID:4336
                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                      1⤵
                                                        PID:3892
                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                        1⤵
                                                          PID:388

                                                        Network

                                                        MITRE ATT&CK Enterprise v15

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                          Filesize

                                                          471B

                                                          MD5

                                                          ecc3c9de4f6c2909d80c9a355c58a995

                                                          SHA1

                                                          205eb3c15c1e0338dee194e6b3de88fc61e8a503

                                                          SHA256

                                                          2d8dd41275cee7e1fc715eaab2e020c74e4d4640c5c7b25db31aa3a98519b966

                                                          SHA512

                                                          1e7138e5770573cf06796ffdd1811d9978c9d43dbfae2250c69b79b6a3b5d51b0f7e1e4c9fca5105629454586164e2c52b9624dbde93e21ebb69694a18a3bbd3

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                          Filesize

                                                          412B

                                                          MD5

                                                          08ab7ccbce162d0b9a296f633ef62401

                                                          SHA1

                                                          478b8bcbc72c62fa47b31962c9f101a4c2fe0f3a

                                                          SHA256

                                                          5e206582d4de5a05b209e34affdc8e1dcf4f4cb0dec2a2d336407d3841cbe6b5

                                                          SHA512

                                                          ac065c6010258111fb74936d332f70bd0d750f6b1189fca93e679017c5239188c688c0a9fa4f0777833c6e88659da3a57527c798103091576435753e859e0cc7

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
                                                          Filesize

                                                          97B

                                                          MD5

                                                          e403893cb1eff096a3a681a4e18bfc57

                                                          SHA1

                                                          2b77a9b05a98def1630f2d224077297c5aa719bc

                                                          SHA256

                                                          5a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066

                                                          SHA512

                                                          c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
                                                          Filesize

                                                          97B

                                                          MD5

                                                          e403893cb1eff096a3a681a4e18bfc57

                                                          SHA1

                                                          2b77a9b05a98def1630f2d224077297c5aa719bc

                                                          SHA256

                                                          5a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066

                                                          SHA512

                                                          c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
                                                          Filesize

                                                          97B

                                                          MD5

                                                          e403893cb1eff096a3a681a4e18bfc57

                                                          SHA1

                                                          2b77a9b05a98def1630f2d224077297c5aa719bc

                                                          SHA256

                                                          5a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066

                                                          SHA512

                                                          c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
                                                          Filesize

                                                          97B

                                                          MD5

                                                          e403893cb1eff096a3a681a4e18bfc57

                                                          SHA1

                                                          2b77a9b05a98def1630f2d224077297c5aa719bc

                                                          SHA256

                                                          5a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066

                                                          SHA512

                                                          c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
                                                          Filesize

                                                          97B

                                                          MD5

                                                          e403893cb1eff096a3a681a4e18bfc57

                                                          SHA1

                                                          2b77a9b05a98def1630f2d224077297c5aa719bc

                                                          SHA256

                                                          5a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066

                                                          SHA512

                                                          c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
                                                          Filesize

                                                          97B

                                                          MD5

                                                          e403893cb1eff096a3a681a4e18bfc57

                                                          SHA1

                                                          2b77a9b05a98def1630f2d224077297c5aa719bc

                                                          SHA256

                                                          5a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066

                                                          SHA512

                                                          c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564

                                                          Download Submit

                                                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\QVHQQQV3\microsoft.windows[1].xml
                                                          Filesize

                                                          97B

                                                          MD5

                                                          e403893cb1eff096a3a681a4e18bfc57

                                                          SHA1

                                                          2b77a9b05a98def1630f2d224077297c5aa719bc

                                                          SHA256

                                                          5a67e1471e50d3e01653afe33268399829528a3d7c0e41dcd2d1e0c66670d066

                                                          SHA512

                                                          c8da1987035c0ee26cf94ecac9436d2e4abe7a512471231666e7e1e25b48b9aa033ad4a68075e7f4a83c9a5229718906a15dec6a15c57d39a7e6d3bd99ecd564

                                                          Download Submit

                                                        • memory/824-142-0x00000000088E0000-0x00000000088F0000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/824-133-0x0000000007D30000-0x0000000007D40000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/824-152-0x0000000004420000-0x0000000004421000-memory.dmp

                                                          Filesize

                                                          4KB

                                                          Download

                                                        • memory/824-150-0x0000000007D30000-0x0000000007D40000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/824-149-0x0000000007D30000-0x0000000007D40000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/824-148-0x0000000007D30000-0x0000000007D40000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/824-147-0x0000000007D30000-0x0000000007D40000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/824-145-0x0000000007D30000-0x0000000007D40000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/824-143-0x0000000007D30000-0x0000000007D40000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/824-116-0x0000000007D30000-0x0000000007D40000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/824-139-0x0000000007D30000-0x0000000007D40000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/824-141-0x0000000007D30000-0x0000000007D40000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/824-140-0x0000000007D30000-0x0000000007D40000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/824-137-0x0000000007D30000-0x0000000007D40000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/824-135-0x0000000007D30000-0x0000000007D40000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/824-118-0x0000000007D30000-0x0000000007D40000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/824-131-0x0000000007D30000-0x0000000007D40000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/824-130-0x00000000088E0000-0x00000000088F0000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/824-128-0x00000000088E0000-0x00000000088F0000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/824-129-0x0000000007D30000-0x0000000007D40000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/824-126-0x0000000007D30000-0x0000000007D40000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/824-127-0x0000000007D30000-0x0000000007D40000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/824-124-0x0000000007D30000-0x0000000007D40000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/824-121-0x0000000007D30000-0x0000000007D40000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/824-122-0x0000000007D30000-0x0000000007D40000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/824-120-0x0000000007D30000-0x0000000007D40000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/824-119-0x0000000007D30000-0x0000000007D40000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/960-178-0x0000000008290000-0x00000000082A0000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/960-176-0x0000000008380000-0x0000000008390000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/960-175-0x0000000008290000-0x00000000082A0000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/2056-79-0x0000000003230000-0x0000000003240000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/2056-81-0x0000000003220000-0x0000000003230000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/2056-60-0x0000000003220000-0x0000000003230000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/2056-64-0x0000000003220000-0x0000000003230000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/2056-66-0x0000000003220000-0x0000000003230000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/2056-65-0x0000000003220000-0x0000000003230000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/2056-68-0x0000000003220000-0x0000000003230000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/2056-70-0x0000000003220000-0x0000000003230000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/2056-69-0x0000000003220000-0x0000000003230000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/2056-71-0x0000000003220000-0x0000000003230000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/2056-72-0x0000000003240000-0x0000000003250000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/2056-73-0x0000000003220000-0x0000000003230000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/2056-74-0x0000000003220000-0x0000000003230000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/2056-75-0x0000000003220000-0x0000000003230000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/2056-78-0x0000000003220000-0x0000000003230000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/2056-61-0x0000000003230000-0x0000000003240000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/2056-77-0x0000000003220000-0x0000000003230000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/2056-59-0x0000000003220000-0x0000000003230000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/2056-85-0x0000000003220000-0x0000000003230000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/2056-87-0x0000000003220000-0x0000000003230000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/2056-86-0x0000000003220000-0x0000000003230000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/2056-84-0x0000000003220000-0x0000000003230000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/2056-83-0x0000000003220000-0x0000000003230000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/2056-89-0x0000000003220000-0x0000000003230000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/2056-88-0x0000000003220000-0x0000000003230000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/2056-91-0x0000000003220000-0x0000000003230000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/2056-92-0x0000000003220000-0x0000000003230000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/2056-94-0x0000000002E30000-0x0000000002E31000-memory.dmp

                                                          Filesize

                                                          4KB

                                                          Download

                                                        • memory/2056-62-0x0000000003220000-0x0000000003230000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/2056-63-0x0000000003220000-0x0000000003230000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/2056-114-0x0000000003240000-0x0000000003250000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/2572-5-0x00000000031F0000-0x0000000003206000-memory.dmp

                                                          Filesize

                                                          88KB

                                                          Download

                                                        • memory/2572-14-0x0000000001440000-0x0000000001441000-memory.dmp

                                                          Filesize

                                                          4KB

                                                          Download

                                                        • memory/2608-4-0x0000000002090000-0x00000000020A5000-memory.dmp

                                                          Filesize

                                                          84KB

                                                          Download

                                                        • memory/2608-1-0x0000000000490000-0x0000000000499000-memory.dmp

                                                          Filesize

                                                          36KB

                                                          Download

                                                        • memory/2608-0-0x0000000002090000-0x00000000020A5000-memory.dmp

                                                          Filesize

                                                          84KB

                                                          Download

                                                        • memory/3412-53-0x0000000003690000-0x00000000036A0000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/3412-33-0x0000000003690000-0x00000000036A0000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/3412-54-0x0000000003690000-0x00000000036A0000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/3412-50-0x0000000003690000-0x00000000036A0000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/3412-48-0x0000000003690000-0x00000000036A0000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/3412-45-0x00000000036A0000-0x00000000036B0000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/3412-46-0x0000000003690000-0x00000000036A0000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/3412-44-0x0000000003690000-0x00000000036A0000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/3412-43-0x0000000003690000-0x00000000036A0000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/3412-37-0x0000000003690000-0x00000000036A0000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/3412-38-0x0000000003690000-0x00000000036A0000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/3412-41-0x0000000003690000-0x00000000036A0000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/3412-39-0x0000000007C30000-0x0000000007C40000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/3412-36-0x0000000003690000-0x00000000036A0000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/3412-35-0x0000000003690000-0x00000000036A0000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/3412-32-0x0000000003690000-0x00000000036A0000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/3412-34-0x0000000007C30000-0x0000000007C40000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/3412-55-0x0000000003690000-0x00000000036A0000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/3412-30-0x0000000003690000-0x00000000036A0000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/3412-28-0x0000000003690000-0x00000000036A0000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/3412-26-0x0000000003690000-0x00000000036A0000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/3412-21-0x0000000003690000-0x00000000036A0000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/3412-25-0x0000000003690000-0x00000000036A0000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/3412-24-0x0000000003690000-0x00000000036A0000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/3412-52-0x0000000003690000-0x00000000036A0000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/3412-23-0x00000000036A0000-0x00000000036B0000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/3412-20-0x0000000003690000-0x00000000036A0000-memory.dmp

                                                          Filesize

                                                          64KB

                                                          Download

                                                        • memory/3744-105-0x000001694A600000-0x000001694A620000-memory.dmp

                                                          Filesize

                                                          128KB

                                                          Download

                                                        • memory/3744-103-0x0000016949F60000-0x0000016949F80000-memory.dmp

                                                          Filesize

                                                          128KB

                                                          Download

                                                        • memory/3744-100-0x0000016949FA0000-0x0000016949FC0000-memory.dmp

                                                          Filesize

                                                          128KB

                                                          Download

                                                        • memory/4832-159-0x000002AD72940000-0x000002AD72960000-memory.dmp

                                                          Filesize

                                                          128KB

                                                          Download

                                                        • memory/5000-6-0x0000000000400000-0x0000000000409000-memory.dmp

                                                          Filesize

                                                          36KB

                                                          Download

                                                        • memory/5000-3-0x0000000000400000-0x0000000000409000-memory.dmp

                                                          Filesize

                                                          36KB

                                                          Download

                                                        • memory/5000-2-0x0000000000400000-0x0000000000409000-memory.dmp

                                                          Filesize

                                                          36KB

                                                          Download