c3cd814e24332499f4893f5ba58ff1c3f30be33fce9f8738d037395afc640581

Analysis

max time kernel
222s
max time network
207s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
27/02/2024, 20:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

hwid_get.exe
Size

5.5MB
MD5

7621ea85028502c91a7554e9de65661d
SHA1

321684ad00246673cedb70ac06d07a06a7be8bf4
SHA256

c3cd814e24332499f4893f5ba58ff1c3f30be33fce9f8738d037395afc640581
SHA512

faeaa8dddeaf622307c61f82fc8f5602007babdb1b7b74014b8297257dced6473d17a0995c97d5fc96f9ce1ecb16571d2a6883ffe8a32302543eaea9e8df9a21
SSDEEP

98304:uenGwawmQUOP7NFX+jzPBPMrIUb+OPlkPjhsL:ulJOPpFuvPBmUOPMj

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\e:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ico\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.tif\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f6013957bd69da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dib	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002fc22575bd69da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d38d5476bd69da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000894b975bd69da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004da8cc75bd69da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008ca85377bd69da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.jpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.txt\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: 33	5076	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5076	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5076	SearchIndexer.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 2236	5076	SearchIndexer.exe	93
PID 5076 wrote to memory of 2236	5076	SearchIndexer.exe	93
PID 5076 wrote to memory of 1048	5076	SearchIndexer.exe	95
PID 5076 wrote to memory of 1048	5076	SearchIndexer.exe	95
PID 5076 wrote to memory of 4392	5076	SearchIndexer.exe	98
PID 5076 wrote to memory of 4392	5076	SearchIndexer.exe	98

C:\Users\Admin\AppData\Local\Temp\hwid_get.exe
"C:\Users\Admin\AppData\Local\Temp\hwid_get.exe"
1⤵
PID:4656

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2236
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 632 2716 2736 824 {0E5DCEC5-7795-4E38-9621-94DFD9F9A421}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1048
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 632 2740 2720 824 {85EE815A-7738-4808-A14A-3AD87E32A3BF}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4392

C:\Users\Admin\AppData\Local\Temp\hwid_get.exe
"C:\Users\Admin\AppData\Local\Temp\hwid_get.exe"
1⤵
PID:2952

C:\Users\Admin\AppData\Local\Temp\hwid_get.exe
"C:\Users\Admin\AppData\Local\Temp\hwid_get.exe"
1⤵
PID:4468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1048-37-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-38-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-39-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-40-0x000001FCF0020000-0x000001FCF0030000-memory.dmp

Filesize
64KB

Download
memory/1048-41-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-42-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-43-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-45-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-44-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-46-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-47-0x000001FCF0130000-0x000001FCF0131000-memory.dmp

Filesize
4KB

Download
memory/1048-49-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-48-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-52-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-51-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-54-0x000001FCF0150000-0x000001FCF0160000-memory.dmp

Filesize
64KB

Download
memory/1048-53-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-50-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-55-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-56-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-58-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-57-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-59-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-60-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-61-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-62-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-63-0x000001FCF0150000-0x000001FCF0160000-memory.dmp

Filesize
64KB

Download
memory/1048-64-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-65-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-67-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-66-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-68-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-69-0x000001FCF0150000-0x000001FCF0160000-memory.dmp

Filesize
64KB

Download
memory/1048-70-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-71-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-72-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-75-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-74-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-76-0x000001FCF0150000-0x000001FCF0160000-memory.dmp

Filesize
64KB

Download
memory/1048-73-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-77-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-78-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-79-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-80-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-82-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-83-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-84-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-88-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-90-0x000001FCF0150000-0x000001FCF0160000-memory.dmp

Filesize
64KB

Download
memory/1048-92-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-93-0x000001FCF0150000-0x000001FCF0160000-memory.dmp

Filesize
64KB

Download
memory/1048-95-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-96-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-97-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-99-0x000001FCF0150000-0x000001FCF0160000-memory.dmp

Filesize
64KB

Download
memory/1048-100-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-110-0x000001FCF0150000-0x000001FCF0160000-memory.dmp

Filesize
64KB

Download
memory/1048-111-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-112-0x000001FCF0150000-0x000001FCF0160000-memory.dmp

Filesize
64KB

Download
memory/1048-115-0x000001FCF0150000-0x000001FCF0160000-memory.dmp

Filesize
64KB

Download
memory/1048-116-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-117-0x000001FCF0150000-0x000001FCF0160000-memory.dmp

Filesize
64KB

Download
memory/1048-119-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-123-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-124-0x000001FCF0150000-0x000001FCF0160000-memory.dmp

Filesize
64KB

Download
memory/1048-134-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-136-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-137-0x000001FCF0150000-0x000001FCF0160000-memory.dmp

Filesize
64KB

Download
memory/1048-140-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-141-0x000001FCF0260000-0x000001FCF0270000-memory.dmp

Filesize
64KB

Download
memory/1048-146-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-151-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-152-0x000001FCF0260000-0x000001FCF0270000-memory.dmp

Filesize
64KB

Download
memory/1048-153-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-161-0x000001FCF0260000-0x000001FCF0270000-memory.dmp

Filesize
64KB

Download
memory/1048-160-0x000001FCF0010000-0x000001FCF0020000-memory.dmp

Filesize
64KB

Download
memory/1048-162-0x000001FCF0260000-0x000001FCF0270000-memory.dmp

Filesize
64KB

Download
memory/1048-163-0x000001FCF0260000-0x000001FCF0270000-memory.dmp

Filesize
64KB

Download
memory/1048-164-0x000001FCF0260000-0x000001FCF0270000-memory.dmp

Filesize
64KB

Download
memory/1048-165-0x000001FCF0260000-0x000001FCF0270000-memory.dmp

Filesize
64KB

Download
memory/5076-0-0x00000220FD510000-0x00000220FD520000-memory.dmp

Filesize
64KB

Download
memory/5076-16-0x00000220FD740000-0x00000220FD750000-memory.dmp

Filesize
64KB

Download
memory/5076-32-0x00000220FDD00000-0x00000220FDD08000-memory.dmp

Filesize
32KB

Download