Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

08/02/2024, 20:06 UTC

240208-yvqprsbh98 7

08/02/2024, 20:04 UTC

240208-ytg18sbh89 7

08/02/2024, 20:02 UTC

240208-ysb4laac9y 1

08/02/2024, 20:02 UTC

240208-yr4r8abh77 1

08/02/2024, 19:58 UTC

240208-yqcbksbh63 3

08/02/2024, 19:54 UTC

240208-ymx4wabh38 7

08/02/2024, 19:52 UTC

240208-ylw57abh26 1

08/02/2024, 19:51 UTC

240208-yk2z2sac4v 1

08/02/2024, 19:50 UTC

240208-yklytsbg95 1

08/02/2024, 19:46 UTC

240208-yg8y7abg62 3

Analysis

  • max time kernel
    143s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/02/2024, 19:58 UTC

General

  • Target

    AnyDesk.exe

  • Size

    5.0MB

  • MD5

    a21768190f3b9feae33aaef660cb7a83

  • SHA1

    24780657328783ef50ae0964b23288e68841a421

  • SHA256

    55e4ce3fe726043070ecd7de5a74b2459ea8bed19ef2a36ce7884b2ab0863047

  • SHA512

    ca6da822072cb0d3797221e578780b19c8953e4207729a002a64a00ced134059c0ed21b02572c43924e4ba3930c0e88cd2cdb309259e3d0dcfb0c282f1832d62

  • SSDEEP

    98304:NzTZ3cINQscs0m++LNkT6OpwDGUUH57yvZ/49Mr8EO3QhA9Kq:Nzt3cINQscNmvLCwDkHEvZ/4R79x

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
    "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"
    1⤵
    • Checks processor information in registry
    • Suspicious use of WriteProcessMemory
    PID:3004
    • C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
      "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-control
      2⤵
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2680
    • C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
      "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-service
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:2192
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4664

    Network

    • flag-us
      DNS
      13.86.106.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      13.86.106.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      65.178.17.96.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      65.178.17.96.in-addr.arpa
      IN PTR
      Response
      65.178.17.96.in-addr.arpa
      IN PTR
      a96-17-178-65deploystaticakamaitechnologiescom
    • flag-us
      DNS
      73.31.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      73.31.126.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      boot.net.anydesk.com
      AnyDesk.exe
      Remote address:
      8.8.8.8:53
      Request
      boot.net.anydesk.com
      IN A
      Response
      boot.net.anydesk.com
      IN A
      37.59.29.33
    • flag-us
      DNS
      relay-0135ac48.net.anydesk.com
      AnyDesk.exe
      Remote address:
      8.8.8.8:53
      Request
      relay-0135ac48.net.anydesk.com
      IN A
      Response
      relay-0135ac48.net.anydesk.com
      IN A
      57.128.141.165
    • flag-us
      DNS
      33.29.59.37.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      33.29.59.37.in-addr.arpa
      IN PTR
      Response
      33.29.59.37.in-addr.arpa
      IN PTR
      relay-825f3084netanydeskcom
    • flag-us
      DNS
      165.141.128.57.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      165.141.128.57.in-addr.arpa
      IN PTR
      Response
      165.141.128.57.in-addr.arpa
      IN PTR
      relay-0135ac48netanydeskcom
    • flag-us
      DNS
      104.219.191.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      104.219.191.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      16.234.44.23.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      16.234.44.23.in-addr.arpa
      IN PTR
      Response
      16.234.44.23.in-addr.arpa
      IN PTR
      a23-44-234-16deploystaticakamaitechnologiescom
    • flag-us
      DNS
      26.165.165.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      26.165.165.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      18.31.95.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      18.31.95.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      32.71.91.104.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      32.71.91.104.in-addr.arpa
      IN PTR
      Response
      32.71.91.104.in-addr.arpa
      IN PTR
      a104-91-71-32deploystaticakamaitechnologiescom
    • flag-us
      DNS
      10.160.77.104.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      10.160.77.104.in-addr.arpa
      IN PTR
      Response
      10.160.77.104.in-addr.arpa
      IN PTR
      a104-77-160-10deploystaticakamaitechnologiescom
    • flag-us
      DNS
      22.236.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      22.236.111.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      56.178.17.96.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      56.178.17.96.in-addr.arpa
      IN PTR
      Response
      56.178.17.96.in-addr.arpa
      IN PTR
      a96-17-178-56deploystaticakamaitechnologiescom
    • 37.59.29.33:443
      boot.net.anydesk.com
      tls
      AnyDesk.exe
      1.9kB
      3.3kB
      9
      9
    • 57.128.141.165:443
      relay-0135ac48.net.anydesk.com
      tls
      AnyDesk.exe
      18.0kB
      416.8kB
      294
      369
    • 8.8.8.8:53
      13.86.106.20.in-addr.arpa
      dns
      71 B
      157 B
      1
      1

      DNS Request

      13.86.106.20.in-addr.arpa

    • 8.8.8.8:53
      65.178.17.96.in-addr.arpa
      dns
      71 B
      135 B
      1
      1

      DNS Request

      65.178.17.96.in-addr.arpa

    • 8.8.8.8:53
      73.31.126.40.in-addr.arpa
      dns
      71 B
      157 B
      1
      1

      DNS Request

      73.31.126.40.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      73 B
      144 B
      1
      1

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      boot.net.anydesk.com
      dns
      AnyDesk.exe
      66 B
      82 B
      1
      1

      DNS Request

      boot.net.anydesk.com

      DNS Response

      37.59.29.33

    • 8.8.8.8:53
      relay-0135ac48.net.anydesk.com
      dns
      AnyDesk.exe
      76 B
      92 B
      1
      1

      DNS Request

      relay-0135ac48.net.anydesk.com

      DNS Response

      57.128.141.165

    • 8.8.8.8:53
      33.29.59.37.in-addr.arpa
      dns
      70 B
      114 B
      1
      1

      DNS Request

      33.29.59.37.in-addr.arpa

    • 8.8.8.8:53
      165.141.128.57.in-addr.arpa
      dns
      73 B
      117 B
      1
      1

      DNS Request

      165.141.128.57.in-addr.arpa

    • 8.8.8.8:53
      104.219.191.52.in-addr.arpa
      dns
      73 B
      147 B
      1
      1

      DNS Request

      104.219.191.52.in-addr.arpa

    • 8.8.8.8:53
      16.234.44.23.in-addr.arpa
      dns
      71 B
      135 B
      1
      1

      DNS Request

      16.234.44.23.in-addr.arpa

    • 8.8.8.8:53
      26.165.165.52.in-addr.arpa
      dns
      72 B
      146 B
      1
      1

      DNS Request

      26.165.165.52.in-addr.arpa

    • 8.8.8.8:53
      18.31.95.13.in-addr.arpa
      dns
      70 B
      144 B
      1
      1

      DNS Request

      18.31.95.13.in-addr.arpa

    • 8.8.8.8:53
      32.71.91.104.in-addr.arpa
      dns
      71 B
      135 B
      1
      1

      DNS Request

      32.71.91.104.in-addr.arpa

    • 8.8.8.8:53
      10.160.77.104.in-addr.arpa
      dns
      72 B
      137 B
      1
      1

      DNS Request

      10.160.77.104.in-addr.arpa

    • 8.8.8.8:53
      22.236.111.52.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      22.236.111.52.in-addr.arpa

    • 8.8.8.8:53
      56.178.17.96.in-addr.arpa
      dns
      71 B
      135 B
      1
      1

      DNS Request

      56.178.17.96.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\gcapi.dll

      Filesize

      385KB

      MD5

      1ce7d5a1566c8c449d0f6772a8c27900

      SHA1

      60854185f6338e1bfc7497fd41aa44c5c00d8f85

      SHA256

      73170761d6776c0debacfbbc61b6988cb8270a20174bf5c049768a264bb8ffaf

      SHA512

      7e3411be8614170ae91db1626c452997dc6db663d79130872a124af982ee1d457cefba00abd7f5269adce3052403be31238aecc3934c7379d224cb792d519753

    • C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

      Filesize

      9KB

      MD5

      6b4a2da79cf1f8f0d8d4a1650ef2830c

      SHA1

      c299c893d353351c4657ae1eb8546c2b57eefa84

      SHA256

      374a5691fcaf325aa2471717be5bf554dac27fd560c62a427f21a9806587d92e

      SHA512

      9907ad71b95fcc32c3423eaa271020e20d47b9c8a97697cd0068a1e57a4f152f5c62dbd0fb5e2b8cd397c743dc8bc458d46a6f2998622d0a800ed19720be9f07

    • C:\Users\Admin\AppData\Roaming\AnyDesk\ad.trace

      Filesize

      7KB

      MD5

      88df187c112579fa24e48aefc4ef04ac

      SHA1

      97c1ce6d67757a435caab435176f872b607eb050

      SHA256

      7e462fc547328fd5167aa0c066df7f83881b616fc3420ea769c081d63d1d01fe

      SHA512

      f0c2e43dc348e304ddfcbb43ffcb41a33b603132437431e3ab307da2f70b2ae3cfcecb4820367b31e8044620d740384479a34583b8a8d9eb203aac3b5e917d9c

    • C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf

      Filesize

      2KB

      MD5

      0a05e7c27c2ab0f0f902d4517f1ec139

      SHA1

      082ab0e6ab71698cec2dd3e8f781a957009e8d35

      SHA256

      63c94dee49f6559c9603690efd54309e3df64fe389716927b6cd906f2cc32b88

      SHA512

      474587189a593238d40fc343fb3b5ee6da851bdab3c63c6df29bc2ee8ee160e5a5f5bc03f7275d2209cd21beed9d5c6c0fef6d977c5bb2e0e50298e617693ec9

    • C:\Users\Admin\AppData\Roaming\AnyDesk\service.conf

      Filesize

      2KB

      MD5

      8ca2f629f6a6f80611b237bf34559c37

      SHA1

      b38eda353876e1e9d135118433eeba1c292451c6

      SHA256

      6069e728ce2ff6412c4e93efd485ab3bb0919657c4afb39bdbeaaa316c8efa38

      SHA512

      67994fa808f7e43827b893f58f27245ada002310cd3d150084ea027fe6f4576534fab1dad7916d2100653ce4e35a3efac75604570172df6fff1783d4105ba88e

    • C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

      Filesize

      681B

      MD5

      ae93740e68f25eaa1d2069e873d73519

      SHA1

      b3d256a0a90ef7b2071a4340514f5034ab1af175

      SHA256

      dc320a95ea6f36bb75b8d573715ca1412696cd1a3cc81611191caaa003f4c585

      SHA512

      ab1f99bd8c4d499be7eec8e2dff3dda2ae6ca7af2746dcf48781570a923cc83e1cd96108af21d3465c91c535d4f57746b1356be31f4807f6e1396b91bdb30cdc

    • C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

      Filesize

      802B

      MD5

      894301078150133aa6b9ca32bab81682

      SHA1

      c099a3ff7075d6f98ce6d930354a6da7d3d6d076

      SHA256

      5f42b6795472a4d85c6d98ee736674010b95146d312764472667cdc658973a48

      SHA512

      f3d5682c217519c3693f8c037c61b351bc1c6b54067d5fcc0ad0faf8579dbeee714926a9383ab710d846056d26b8505ba9426d9dc8ffb81426cc81681e6f83a8

    • C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

      Filesize

      312B

      MD5

      0c04ad1083dc5c7c45e3ee2cd344ae38

      SHA1

      f1cf190f8ca93000e56d49732e9e827e2554c46f

      SHA256

      6452273c017db7cbe0ffc5b109bbf3f8d3282fb91bfa3c5eabc4fb8f1fc98cb0

      SHA512

      6c414b39bbc1f1f08446c6c6da6f6e1ceb9303bbf183ae279c872d91641ea8d67ec5e5c4e0824da3837eca73ec29fe70e92b72c09458c8ce50fa6f08791d1492

    • C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

      Filesize

      424B

      MD5

      8e55b0e437d6deb048fbc4ff6ba44376

      SHA1

      e79a87637647a9b619f8df1510b6eef36a76f2ec

      SHA256

      b7e777a9f23b717cf50c21377150e14d0384593a286a1ef4d42d47122d658e36

      SHA512

      84cd5f0ae859dfd015266f26348454ba96f3b9cabf52c223b792052118d6ad3962f7f9d92e4dfacaf142c665ba3ad12f53520dcdf0f4c993dd62e84bd20efe4e

    • C:\Users\Admin\AppData\Roaming\AnyDesk\system.conf

      Filesize

      424B

      MD5

      4758e24312b6739df8a2b4e53834b1fd

      SHA1

      baea6a8087959e057ebeb1fe5fec67bb53e2927f

      SHA256

      fbb4544eebcb827ae216bb230cb0d3119248715023d929921bb18702a06c517a

      SHA512

      fb85f5d30e33ce4c0a7757d57eb84c90caefb4a46f379a653c621e62f1b25b0ad9bba5a8a468e087488e422aef06d41556e2c45f35167b46974ff5a6de6ef011

    • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

      Filesize

      2KB

      MD5

      2c24392a5e5fa8a26637d43ee1a8300a

      SHA1

      0a8df0234461a28c94f8a190514b9dd1b77ac931

      SHA256

      2851f55d07667dcf037dc8836fc574dc61c255024be01794491df8d319edb9e3

      SHA512

      25d31a8e50a27d1aef2ac979bef483e3a30d2e038c85623f40e6864b883bee6fb641895ac4ca9097b16e260cc26e590be30d8fdf5900f2a443b07d35f96785d9

    • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

      Filesize

      2KB

      MD5

      96bbfeb45c1bedbdf9a15bbf54fc40e7

      SHA1

      ca476a2bb98d52331221603b86757aa2cdca8598

      SHA256

      3d65faa9eab4185387530756c3f28890309150f32b0eff462bcf40003dc7dcf3

      SHA512

      516126ba1d61c72e45236f335e86f2de063f97e434eb87904ed9986795d09b8b36b279d236c05d18e00e3bb4a0f3011e9ba09b62b5d63674fb31cf4006b522f7

    • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

      Filesize

      3KB

      MD5

      371ee7c687a09c71725a576a6e714712

      SHA1

      e0e71df6116e36176aa5d8c6e07fcbf5b70015ae

      SHA256

      095da621d290fbc560a1fe102678ff1957f4eb34f3d12d054ab52c235781362b

      SHA512

      5c457c7926d8ee8eb2fcf8f1c2bb3cab2e8113c7af0832e449c92fea5a1f4ab19bedfd7c6b326da7ee54d6266ab1f0eed0a43f663a69599eff2ba981d28a327b

    • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

      Filesize

      3KB

      MD5

      e27fc320461c8f9061b5992a7fce9b7d

      SHA1

      cda5526f33e0c30a10b5835988977d9c3d34eb08

      SHA256

      23f2f414eddbac2208e2cb21c56e686f6d18dc4622fee9e573c9cef9c7a121bc

      SHA512

      fe89cb972ead7097c8c93eca3f6f3381d86d0a28df01eeaa2ff40403e17ecbb347ee13f15fc9d1226ee7c362acd399da9ffc1a5722e123cc35f8a7c8cfe5a0d4

    • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

      Filesize

      6KB

      MD5

      3890a38752e166cebf60d24c548113a1

      SHA1

      42d7de5b3a097a8df1504362c9aad4e9aa9bd9d8

      SHA256

      d41fa0dbf3d2a789bb1aa919a2ce20111b9d90650d480676e07c73efd3c83590

      SHA512

      75ba4e89c7c939dd20c86bc623cb3c397742d646bf9bcc709cf50f330daa2557c9ea6ecc925f834bf6740bf455fbc99ab5d1f4f124a76e477ca4c93e6321ea6b

    • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

      Filesize

      6KB

      MD5

      e2f1fa3975366f8ab59629b5d4413561

      SHA1

      2a27100b9d06eb13db43f3846cba917b8523cc4a

      SHA256

      98474ec17ca4e33a796d3f1e5ae87d9aaa3a08a3bdf7263f1f0646af9f2087a8

      SHA512

      8829d00fabebb6605396c4641c8b42c3aa2902bceb82438520b2c5beb50860d57ae21454fee7e4b130cbd572f3f82e1618c36886f227aab0a785254b6328ceea

    • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

      Filesize

      1KB

      MD5

      35d5cee39bc87855dfd95e403128ed79

      SHA1

      a829374dcecb2034be03ddfdc5f453b4bf4bc24d

      SHA256

      9af887aa45d84d3c31bf03e140694a811f3114589b1d89918a7c7848030603ff

      SHA512

      d00e1866cdc7d7c6b3cab57a0d946ed2a0192c4b72687ea29c703a24fd07dca0263a731b947f0afddc3f99e771289bf6ff4ca7282da578acc38581bf683c575d

    • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

      Filesize

      6KB

      MD5

      7c08f0856d46f4109db3588c316e2080

      SHA1

      722cb58f5dc2812efb5eedffc88e8ff5534369b5

      SHA256

      7db98b1a3541332912f5b4be0224d6d7f2cca804a4daae206abc022efed44a1e

      SHA512

      432cd3854af07fb23f62613a075c8c2bf05c7a74de444f576ac0aaf3768e1fed8dae911acb972c313df86febe804468736eaf22d18705ab234e9c7980317fb63

    • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

      Filesize

      6KB

      MD5

      0baeb7d1d541624768a80338562ea9e7

      SHA1

      7189f4ae9c70207b5d8d8c3444cfa3abfc55bd37

      SHA256

      988a2aecfd6542f0c57f881bfb70a8a6abff29dc83a14160d778055b9271a44d

      SHA512

      9a66cb53885bb53ef45ec164625f967130a95432e5ba442c310203d3464da1f54dc83a9b5be450cbfac970f55795ddca57dd4f8961a0cb97a95fecc3bd7986cc

    • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

      Filesize

      1KB

      MD5

      8a8217840ad7010541126dc7a7a4203d

      SHA1

      b09f149d919291ee79bfbff4e5e2ca1b707bcb23

      SHA256

      e50185c46d74453e9102a6fa3527cc393b1f619538260f35d0109188ee1cfe64

      SHA512

      147bd21022d22234ae3d05c639892c7c9ba5bcb5e1051e41a4e6f1c599618a3f189846f69b0d30bfb51d99f3c574430bf902b0a87437de92d5d3afea6d79f5b6

    • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

      Filesize

      1KB

      MD5

      16931007e7e4cf6874cf4e25c62f714c

      SHA1

      913b60fc2e28f1ade3ba85c5c9a3d3b4684beb79

      SHA256

      9586441f47c220f80868c35d2644e87646d2ebe46e8a77b0b551803f7e621e31

      SHA512

      3c3bd30e782933eb4efb2e1ae0e8476553d10f98fba120e6b352fdc2faa1baab76a226b7616f36ad18357acd83a5fc9ffcd8b262e48a0089ce8b093f9639a9f4

    • C:\Users\Admin\AppData\Roaming\AnyDesk\user.conf

      Filesize

      1KB

      MD5

      f63a9be57dfded08764250b961457ced

      SHA1

      fc4a65d64202f8af1d8d2904922e116d207278ee

      SHA256

      fc89ae7f10aadf3dd0d6aaae017b319b08e8af54273b0297d3892b5c092d06e9

      SHA512

      addb3511ddfc058752ef9b4c6388436c745091f8564cc79042b3605b1f8ddc5df677deabf4bd8491a1c2b982fe9365e33f5ecaa740195003c0c3ebd547f0ce70

    • memory/2192-13-0x0000000000A10000-0x0000000002147000-memory.dmp

      Filesize

      23.2MB

    • memory/2192-33-0x0000000002240000-0x0000000002241000-memory.dmp

      Filesize

      4KB

    • memory/2192-11-0x0000000000A10000-0x0000000002147000-memory.dmp

      Filesize

      23.2MB

    • memory/2192-249-0x0000000000A10000-0x0000000002147000-memory.dmp

      Filesize

      23.2MB

    • memory/2680-32-0x0000000002800000-0x0000000002801000-memory.dmp

      Filesize

      4KB

    • memory/2680-12-0x0000000000A10000-0x0000000002147000-memory.dmp

      Filesize

      23.2MB

    • memory/2680-250-0x0000000000A10000-0x0000000002147000-memory.dmp

      Filesize

      23.2MB

    • memory/3004-1-0x0000000000A10000-0x0000000002147000-memory.dmp

      Filesize

      23.2MB

    • memory/3004-92-0x0000000007EE0000-0x0000000007EE1000-memory.dmp

      Filesize

      4KB

    • memory/3004-27-0x0000000006100000-0x0000000006101000-memory.dmp

      Filesize

      4KB

    • memory/3004-4-0x00000000021E0000-0x00000000021E1000-memory.dmp

      Filesize

      4KB

    • memory/3004-237-0x00000000078A0000-0x00000000078A1000-memory.dmp

      Filesize

      4KB

    • memory/3004-0-0x0000000000A10000-0x0000000002147000-memory.dmp

      Filesize

      23.2MB

    • memory/3004-248-0x0000000000A10000-0x0000000002147000-memory.dmp

      Filesize

      23.2MB

    • memory/3004-95-0x0000000007890000-0x0000000007891000-memory.dmp

      Filesize

      4KB

    • memory/3004-22-0x0000000006110000-0x0000000006111000-memory.dmp

      Filesize

      4KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.