Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    125s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/05/2024, 11:06

General

  • Target

    TNoodle-WCA-1.2.2.jar

  • Size

    29.8MB

  • MD5

    9f7103370956308807e2c6529f459133

  • SHA1

    e9c1227a7557ce7d62c59e4183f39b750ddf13e0

  • SHA256

    151fb27eae66cd0cd335f1717668d26e8530bb5d0266a0c5f871395dcd6237c1

  • SHA512

    30f44daca0b86f28a571db43e0958f465fe56c9a54b51c1487a927d8da2a356e613dea8f2f8a72142ca6e3babeaf257b1315edff14c8eb3d76755e5c66d5f2df

  • SSDEEP

    786432:/mznhtI2TkLLD44F4k/6Qe+jRBBJdCQgbg:+bOLo4F4Ke+lBBJgQg0

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
    java -jar C:\Users\Admin\AppData\Local\Temp\TNoodle-WCA-1.2.2.jar
    1⤵
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:824
    • C:\Windows\system32\icacls.exe
      C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
      2⤵
      • Modifies file permissions
      PID:1668
    • C:\Program Files\Java\jre-1.8\temp-launcher\TNoodle-WCA-1.2.2.exe
      "C:\Program Files\Java\jre-1.8\temp-launcher\TNoodle-WCA-1.2.2.exe" -Xmx1820m -classpath C:\Users\Admin\AppData\Local\Temp\TNoodle-WCA-1.2.2.jar org.worldcubeassociation.tnoodle.deployable.jar.WebscramblesServer --noReexec
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4964
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://localhost:2014/
        3⤵
          PID:3300
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=3748 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:1
      1⤵
        PID:4340
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=3668 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:1
        1⤵
          PID:1080
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5624 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
          1⤵
            PID:2352
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=5516 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:1
            1⤵
              PID:2284
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5872 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
              1⤵
                PID:644
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
                1⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:4884
                • C:\Windows\system32\more.com
                  "C:\Windows\system32\more.com"
                  2⤵
                    PID:3952
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=4936 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8
                  1⤵
                    PID:3856
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
                    1⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4296
                    • C:\Windows\system32\wininit.exe
                      "C:\Windows\system32\wininit.exe"
                      2⤵
                        PID:2268

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Program Files\Java\jre-1.8\temp-launcher\TNoodle-WCA-1.2.2.exe

                      Filesize

                      285KB

                      MD5

                      dafb5fbb0614c19eccdab9bef8f89c22

                      SHA1

                      91ab91eb4a90f02c4950c3e5da80f3eb24bddb52

                      SHA256

                      af62c3850cd7a84db64bbaf68533e2769da619a8a4bccf0ac4836d2ec86e4b5e

                      SHA512

                      81cf8e04b595052e67db73454a67e2098e1df9353e2c3cc842b8ab2a9fa837b90a2101d5a097a6b0af0030869e788de1aa73ebb958f1428a3952ce0464db3e93

                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                      Filesize

                      3KB

                      MD5

                      3f01549ee3e4c18244797530b588dad9

                      SHA1

                      3e87863fc06995fe4b741357c68931221d6cc0b9

                      SHA256

                      36b51e575810b6af6fc5e778ce0f228bc7797cd3224839b00829ca166fa13f9a

                      SHA512

                      73843215228865a4186ac3709bf2896f0f68da0ba3601cc20226203dd429a2ad9817b904a45f6b0456b8be68deebf3b011742a923ce4a77c0c6f3a155522ab50

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache

                      Filesize

                      53KB

                      MD5

                      a26df49623eff12a70a93f649776dab7

                      SHA1

                      efb53bd0df3ac34bd119adf8788127ad57e53803

                      SHA256

                      4ebde1c12625cb55034d47e5169f709b0bd02a8caa76b5b9854efad7f4710245

                      SHA512

                      e5f9b8645fb2a50763fcbffe877ca03e9cadf099fe2d510b74bfa9ff18d0a6563d11160e00f495eeefebde63450d0ade8d6b6a824e68bd8a59e1971dc842709c

                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive

                      Filesize

                      3KB

                      MD5

                      1232f9a334c83346c92f8c0e6316826d

                      SHA1

                      7c49a87463a44d69189d5f1a3cb57a85f233b8ab

                      SHA256

                      d1b926739d7b0c3476a536c1472b50f9d2234b0c27e8bb271bb37134f8311bf0

                      SHA512

                      95ea0f2f2af3f53a29dd04fca7dac5cbdd0a13df74b42b82435781a95446bd94a4ba98676f0aeefc329f883a2965bb58026a37a82f0b14ad4f9b1261e05c9af9

                    • C:\Users\Admin\AppData\Local\Temp\SystemTrayCache_Admin\ESD82BVHO8KH85O4T38QKLPQEUBPCOI7.cache

                      Filesize

                      198B

                      MD5

                      37cab7554d56739071aa7e693d252d8f

                      SHA1

                      5f78b9001fc9af8719a777de464c3f4cc183bea1

                      SHA256

                      9c25cc2e102d76914f883dd89a7b2698db8c3d6ede5074bf4029011ee1fac7a1

                      SHA512

                      c2a98db47826a9d5a97a4bf9db7a192eb8fd33436d1d251b64ca3ebf4df9cd7bfb8519fdfebdf23136db878e454a8561a7ba9925275c5fb79f37df5f1ba182f7

                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2f0nohbi.1a2.ps1

                      Filesize

                      60B

                      MD5

                      d17fe0a3f47be24a6453e9ef58c94641

                      SHA1

                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                      SHA256

                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                      SHA512

                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                    • C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna8615617503262029611.dll

                      Filesize

                      248KB

                      MD5

                      34d12b1e2af72d9bb267bbc8c0d53e4a

                      SHA1

                      d9ed8776645f6b4f52df16132450863c47ea92d7

                      SHA256

                      13b2cac3f50368ab97fa2e3b0d0d2cb612f68449d5bbd6de187fc85ee4469d03

                      SHA512

                      c0a063477cf63a8b647ea721842968b506d70ea22c586a412707d7293b46c218b6a510f34b7dbedd3ed29a9d4b5dc5c6a1995403d65884b17348a9545e580a10

                    • C:\Users\Admin\AppData\Local\Temp\tnoodle.log

                      Filesize

                      756B

                      MD5

                      eb0d14c3b345a40e3ff0f4a2a9c3c2d4

                      SHA1

                      42ed6ff1ec2df05131db396d5bd1d0af1d5c5657

                      SHA256

                      543ea1b045cc3776d6a4861bdddbd02da9a8fafb3ac9dd661edf964d8ba889c3

                      SHA512

                      bbf9124b12d48cd65d5edf1357f6054b570de43f5c03cbd80ba268b730f2ee490dccf8c38debfb83af4a51e3b48809d2791df95ce0ced016385e360ce293cdcc

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt

                      Filesize

                      6B

                      MD5

                      2378e46cc86f8ea4e157da9f7354d670

                      SHA1

                      67c01d92a9dc447dbb3986c20f6bb20aceab1f81

                      SHA256

                      aee5b85055f156c30a6dd3cc9e6c43693bfed7aa40ed4f77212b5e424d191308

                      SHA512

                      b81ef404fc90e8852d6a0ecb3f2b1578c020dc57dfa81f5b3f82354f682a946f2997ae5cd12335615f198ab4dde726477f4f9dacb06fd3bcf878e4d4ec907d73

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                      Filesize

                      5KB

                      MD5

                      5bf69fe3e850368231593a822974c577

                      SHA1

                      9dd778d6fb3f38650925f5999da4f403a5c54a5f

                      SHA256

                      499cc8727fbe09a49a3261b1be4f31959787e92117553f91663ee1baca7ff8cf

                      SHA512

                      09dde90cfac0531c98dc69f1f9c224f730904faa27f848712219e7f202fe15f1703311e135e3a9ada2053191efd55d45483ee45f2d7abadcf73fc643ccab0837

                    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                      Filesize

                      5KB

                      MD5

                      7b099949520163bb1463313820708982

                      SHA1

                      8e4233310d0c5f49e4fced8bb0264f79f8cfa433

                      SHA256

                      3314c30aaa2760ffb6c0e6d3e1463e6aaf95a09906cbb29fdc0c69719cc4ffdc

                      SHA512

                      ef44092631cbb932158d9fe84acf9c40fec8984031d696ed5cee01def2743c347f8d5ad1b533562562648dbc7f9d0802ac164694d93167ba559a7e45b85298ae

                    • memory/824-11-0x000002C1D3380000-0x000002C1D3381000-memory.dmp

                      Filesize

                      4KB

                    • memory/824-49-0x000002C1D4C40000-0x000002C1D4EB0000-memory.dmp

                      Filesize

                      2.4MB

                    • memory/824-21-0x000002C1D4ED0000-0x000002C1D4EE0000-memory.dmp

                      Filesize

                      64KB

                    • memory/824-18-0x000002C1D4EC0000-0x000002C1D4ED0000-memory.dmp

                      Filesize

                      64KB

                    • memory/824-16-0x000002C1D4EB0000-0x000002C1D4EC0000-memory.dmp

                      Filesize

                      64KB

                    • memory/824-14-0x000002C1D3380000-0x000002C1D3381000-memory.dmp

                      Filesize

                      4KB

                    • memory/824-70-0x000002C1D4EC0000-0x000002C1D4ED0000-memory.dmp

                      Filesize

                      64KB

                    • memory/824-68-0x000002C1D4EB0000-0x000002C1D4EC0000-memory.dmp

                      Filesize

                      64KB

                    • memory/824-2-0x000002C1D4C40000-0x000002C1D4EB0000-memory.dmp

                      Filesize

                      2.4MB

                    • memory/824-75-0x000002C1D4ED0000-0x000002C1D4EE0000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-203-0x000001F1EA8D0000-0x000001F1EA8E0000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-249-0x000001F1EA9C0000-0x000001F1EA9D0000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-72-0x000001F1E8DD0000-0x000001F1E8DD1000-memory.dmp

                      Filesize

                      4KB

                    • memory/4964-69-0x000001F1EA890000-0x000001F1EA8A0000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-76-0x000001F1EA8A0000-0x000001F1EA8B0000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-80-0x000001F1E8DD0000-0x000001F1E8DD1000-memory.dmp

                      Filesize

                      4KB

                    • memory/4964-82-0x000001F1EA5C0000-0x000001F1EA830000-memory.dmp

                      Filesize

                      2.4MB

                    • memory/4964-83-0x000001F1EA8B0000-0x000001F1EA8C0000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-89-0x000001F1EA830000-0x000001F1EA840000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-90-0x000001F1EA8C0000-0x000001F1EA8D0000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-100-0x000001F1EA840000-0x000001F1EA850000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-101-0x000001F1EA8D0000-0x000001F1EA8E0000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-110-0x000001F1E8DD0000-0x000001F1E8DD1000-memory.dmp

                      Filesize

                      4KB

                    • memory/4964-113-0x000001F1EA850000-0x000001F1EA860000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-116-0x000001F1EA8E0000-0x000001F1EA8F0000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-115-0x000001F1EA860000-0x000001F1EA870000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-117-0x000001F1E8DD0000-0x000001F1E8DD1000-memory.dmp

                      Filesize

                      4KB

                    • memory/4964-127-0x000001F1E8DD0000-0x000001F1E8DD1000-memory.dmp

                      Filesize

                      4KB

                    • memory/4964-132-0x000001F1EA870000-0x000001F1EA880000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-133-0x000001F1EA8F0000-0x000001F1EA900000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-137-0x000001F1EA880000-0x000001F1EA890000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-138-0x000001F1EA900000-0x000001F1EA910000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-141-0x000001F1E8DD0000-0x000001F1E8DD1000-memory.dmp

                      Filesize

                      4KB

                    • memory/4964-148-0x000001F1EA920000-0x000001F1EA930000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-147-0x000001F1EA910000-0x000001F1EA920000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-146-0x000001F1EA890000-0x000001F1EA8A0000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-145-0x000001F1E8DD0000-0x000001F1E8DD1000-memory.dmp

                      Filesize

                      4KB

                    • memory/4964-154-0x000001F1EA930000-0x000001F1EA940000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-153-0x000001F1E8E00000-0x000001F1E8E10000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-155-0x000001F1E8DD0000-0x000001F1E8DD1000-memory.dmp

                      Filesize

                      4KB

                    • memory/4964-165-0x000001F1E8DD0000-0x000001F1E8DD1000-memory.dmp

                      Filesize

                      4KB

                    • memory/4964-169-0x000001F1EA940000-0x000001F1EA950000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-168-0x000001F1EA8A0000-0x000001F1EA8B0000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-60-0x000001F1E8DD0000-0x000001F1E8DD1000-memory.dmp

                      Filesize

                      4KB

                    • memory/4964-181-0x000001F1E8DD0000-0x000001F1E8DD1000-memory.dmp

                      Filesize

                      4KB

                    • memory/4964-184-0x000001F1EA8B0000-0x000001F1EA8C0000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-185-0x000001F1EA950000-0x000001F1EA960000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-201-0x000001F1EA8C0000-0x000001F1EA8D0000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-59-0x000001F1EA880000-0x000001F1EA890000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-204-0x000001F1EA960000-0x000001F1EA970000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-215-0x000001F1EA970000-0x000001F1EA980000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-220-0x000001F1EA980000-0x000001F1EA990000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-219-0x000001F1EA8E0000-0x000001F1EA8F0000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-243-0x000001F1EA900000-0x000001F1EA910000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-242-0x000001F1EA9A0000-0x000001F1EA9B0000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-241-0x000001F1EA990000-0x000001F1EA9A0000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-240-0x000001F1EA8F0000-0x000001F1EA900000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-247-0x000001F1EA9B0000-0x000001F1EA9C0000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-246-0x000001F1EA920000-0x000001F1EA930000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-71-0x000001F1E8E00000-0x000001F1E8E10000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-248-0x000001F1EA930000-0x000001F1EA940000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-245-0x000001F1EA910000-0x000001F1EA920000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-252-0x000001F1EA9D0000-0x000001F1EA9E0000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-251-0x000001F1EA940000-0x000001F1EA950000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-257-0x000001F1EA950000-0x000001F1EA960000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-259-0x000001F1EA9F0000-0x000001F1EAA00000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-258-0x000001F1EA9E0000-0x000001F1EA9F0000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-262-0x000001F1EAA10000-0x000001F1EAA20000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-261-0x000001F1EAA00000-0x000001F1EAA10000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-264-0x000001F1EAA20000-0x000001F1EAA30000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-263-0x000001F1EA960000-0x000001F1EA970000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-267-0x000001F1EAA30000-0x000001F1EAA40000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-266-0x000001F1EA970000-0x000001F1EA980000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-271-0x000001F1EAA40000-0x000001F1EAA50000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-270-0x000001F1EA980000-0x000001F1EA990000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-274-0x000001F1EA990000-0x000001F1EA9A0000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-275-0x000001F1EAA50000-0x000001F1EAA60000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-283-0x000001F1EAA60000-0x000001F1EAA70000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-282-0x000001F1EA9A0000-0x000001F1EA9B0000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-302-0x000001F1EAA80000-0x000001F1EAA90000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-301-0x000001F1EAA70000-0x000001F1EAA80000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-299-0x000001F1EA9B0000-0x000001F1EA9C0000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-401-0x000001F1EAA90000-0x000001F1EAAA0000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-396-0x000001F1EA9C0000-0x000001F1EA9D0000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-404-0x000001F1EA9D0000-0x000001F1EA9E0000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-405-0x000001F1EAAA0000-0x000001F1EAAB0000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-418-0x000001F1EAA00000-0x000001F1EAA10000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-415-0x000001F1EAAD0000-0x000001F1EAAE0000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-414-0x000001F1EAAC0000-0x000001F1EAAD0000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-413-0x000001F1EAAB0000-0x000001F1EAAC0000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-412-0x000001F1EA9F0000-0x000001F1EAA00000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-411-0x000001F1EA9E0000-0x000001F1EA9F0000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-423-0x000001F1EAA20000-0x000001F1EAA30000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-422-0x000001F1EAB00000-0x000001F1EAB10000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-421-0x000001F1EAAF0000-0x000001F1EAB00000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-420-0x000001F1EAAE0000-0x000001F1EAAF0000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-419-0x000001F1EAA10000-0x000001F1EAA20000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-446-0x000001F1EAB30000-0x000001F1EAB40000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-448-0x000001F1EAA40000-0x000001F1EAA50000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-447-0x000001F1EAB40000-0x000001F1EAB50000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-443-0x000001F1EAB20000-0x000001F1EAB30000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-442-0x000001F1EAB10000-0x000001F1EAB20000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-441-0x000001F1EAA30000-0x000001F1EAA40000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-53-0x000001F1EA870000-0x000001F1EA880000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-50-0x000001F1EA860000-0x000001F1EA870000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-47-0x000001F1EA850000-0x000001F1EA860000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-43-0x000001F1EA840000-0x000001F1EA850000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-41-0x000001F1EA830000-0x000001F1EA840000-memory.dmp

                      Filesize

                      64KB

                    • memory/4964-38-0x000001F1E8DD0000-0x000001F1E8DD1000-memory.dmp

                      Filesize

                      4KB

                    • memory/4964-27-0x000001F1EA5C0000-0x000001F1EA830000-memory.dmp

                      Filesize

                      2.4MB