Overview

overview

10

Static

static

3

creepypasta virus.exe

windows7-x64

8

creepypasta virus.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    1041s
  • max time network
    416s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/08/2024, 11:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    creepypasta virus.exe

  • Size

    73.1MB

  • MD5

    0572e10f72053b3cae7182f444e1e243

  • SHA1

    af99e83abfcb5820e79fa262a6e390b165552b93

  • SHA256

    04636b88b4736ad0c79843eee21c43892d4738d6e034570e2c81a32972aa75fe

  • SHA512

    8a8430fa1e2262fd26537d49edd52c7f88b039db9e77ef3f5368dd091b1ff17b6432127dfcbd44035897e672c7b7241399f84b05036fda27c582dd074c4e1552

  • SSDEEP

    1572864:MWWQfapBZJbujGp5AuYS2aTjWWQfapBZJbujGp5AuYS2aT:9apBZJbujGpCVTapBZJbujGpCV

Score
10/10
discoveryevasionpersistence

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
    evasion
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 11 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 22 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\creepypasta virus.exe
    "C:\Users\Admin\AppData\Local\Temp\creepypasta virus.exe"
    1⤵
    • Disables RegEdit via registry modification
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4332
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4324
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1872
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:5052
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:856
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4032
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4304
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1920
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:856
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4700
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:836
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:532
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4968
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:768
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:5072
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4380
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2644
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:2512
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3800
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3096
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4308
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3312
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4520
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:2556
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4512
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4244
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:2636
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3224
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2808
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:4940
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2356
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2992
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4364

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
      Filesize

      2KB

      MD5

      a6a0a569eeb53d07f93800240a5c8429

      SHA1

      cc872581df335198d97b53faa276335b53c25ff1

      SHA256

      b4167721ed540edee6f206f51dbaf2f7de2175eded332a6432a8568e2f778aa6

      SHA512

      8c165993770441628572bf953f2fb0dd57238d1b12b831a50cbf04230c40535d1ec4370b2d6a2e22009369b92e4f0ebfcb7d122a4c38e8303052da05dbbb433d

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133675890886080182.txt
      Filesize

      75KB

      MD5

      e42de8885cf0137704dc9328845d2f8c

      SHA1

      d7387a38cda88a091a77ec8ac05090763c05050a

      SHA256

      1cc8340e5b1dacc90401055feeff64eb1b585dfdb05f88e6be6fb0cc685a421f

      SHA512

      eb90801c50d7544251d5a31861e8d60bb17be093938d7494825c86db36902f88f9c957b670d52155fe244e33fb0a5e03ef21af9a6a746d6049814f11749079ce

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZLWU0D9R\microsoft.windows[1].xml
      Filesize

      97B

      MD5

      165c4eb495a1e55b6aa27652f79faaa1

      SHA1

      2a72fe3964fdace12d0527f52b806e545d9797b2

      SHA256

      d694847a55f98886fbb45c6cd2b0fed95d9cd7448660cd023c909b3659d1f51c

      SHA512

      e749ffaf79a8b65f26500c72b3bdacd79c564b89ea16198695892840873ede2b63fda3c6d32480cc5296d7662f91332f83674a5170475d606912af20e5f14367

      Download Submit

    • memory/532-322-0x0000000004EB0000-0x0000000004EB1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/768-323-0x0000020D48300000-0x0000020D48400000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/768-324-0x0000020D48300000-0x0000020D48400000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/768-328-0x0000020D49600000-0x0000020D49620000-memory.dmp

      Filesize

      128KB

      Download

    • memory/768-336-0x0000020D493C0000-0x0000020D493E0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/768-357-0x0000020D499D0000-0x0000020D499F0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/836-190-0x00000210D9E60000-0x00000210D9E80000-memory.dmp

      Filesize

      128KB

      Download

    • memory/836-202-0x00000210DA270000-0x00000210DA290000-memory.dmp

      Filesize

      128KB

      Download

    • memory/836-179-0x00000210D9EA0000-0x00000210D9EC0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/836-175-0x00000208D7D40000-0x00000208D7E40000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/836-174-0x00000208D7D40000-0x00000208D7E40000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/856-172-0x0000000004A20000-0x0000000004A21000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1920-29-0x0000020F7BFB0000-0x0000020F7BFD0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/1920-12-0x0000020F7AF00000-0x0000020F7B000000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/1920-13-0x0000020F7AF00000-0x0000020F7B000000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/1920-17-0x0000020F7BFF0000-0x0000020F7C010000-memory.dmp

      Filesize

      128KB

      Download

    • memory/1920-48-0x0000020F7C3C0000-0x0000020F7C3E0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/1920-14-0x0000020F7AF00000-0x0000020F7B000000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2512-617-0x0000000004EF0000-0x0000000004EF1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2556-920-0x0000000004890000-0x0000000004891000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2636-1068-0x0000000004340000-0x0000000004341000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2644-487-0x00000296E9CC0000-0x00000296E9CE0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/2644-474-0x00000296E9D00000-0x00000296E9D20000-memory.dmp

      Filesize

      128KB

      Download

    • memory/2644-506-0x00000296EA2E0000-0x00000296EA300000-memory.dmp

      Filesize

      128KB

      Download

    • memory/2808-1071-0x000002F86D620000-0x000002F86D720000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2808-1090-0x000002F86E730000-0x000002F86E750000-memory.dmp

      Filesize

      128KB

      Download

    • memory/2808-1104-0x000002F86EB40000-0x000002F86EB60000-memory.dmp

      Filesize

      128KB

      Download

    • memory/2808-1070-0x000002F86D620000-0x000002F86D720000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2808-1075-0x000002F86E770000-0x000002F86E790000-memory.dmp

      Filesize

      128KB

      Download

    • memory/2992-1232-0x000001DF8D860000-0x000001DF8D880000-memory.dmp

      Filesize

      128KB

      Download

    • memory/2992-1245-0x000001DF8DE80000-0x000001DF8DEA0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/2992-1218-0x000001DF8CA00000-0x000001DF8CB00000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2992-1220-0x000001DF8CA00000-0x000001DF8CB00000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2992-1223-0x000001DF8D8A0000-0x000001DF8D8C0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/3096-621-0x0000012C66100000-0x0000012C66200000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/3096-624-0x0000012C66FE0000-0x0000012C67000000-memory.dmp

      Filesize

      128KB

      Download

    • memory/3096-645-0x0000012C675B0000-0x0000012C675D0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/3096-633-0x0000012C66FA0000-0x0000012C66FC0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/3096-620-0x0000012C66100000-0x0000012C66200000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/3096-619-0x0000012C66100000-0x0000012C66200000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/4032-10-0x00000000040E0000-0x00000000040E1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4244-923-0x0000026656C00000-0x0000026656D00000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/4244-949-0x0000026E590C0000-0x0000026E590E0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/4244-928-0x0000026E58D00000-0x0000026E58D20000-memory.dmp

      Filesize

      128KB

      Download

    • memory/4244-936-0x0000026E589B0000-0x0000026E589D0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/4308-769-0x0000000004E10000-0x0000000004E11000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4332-615-0x0000000074B50000-0x0000000075300000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4332-583-0x0000000074B50000-0x0000000075300000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4332-1337-0x0000000074B50000-0x0000000075300000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4332-6-0x0000000074B50000-0x0000000075300000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4332-5-0x0000000009AF0000-0x0000000009AFA000-memory.dmp

      Filesize

      40KB

      Download

    • memory/4332-1-0x0000000000770000-0x000000000508E000-memory.dmp

      Filesize

      73.1MB

      Download

    • memory/4332-4-0x0000000074B50000-0x0000000075300000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4332-465-0x0000000074B5E000-0x0000000074B5F000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4332-3-0x0000000009A50000-0x0000000009AE2000-memory.dmp

      Filesize

      584KB

      Download

    • memory/4332-2-0x0000000009F60000-0x000000000A504000-memory.dmp

      Filesize

      5.6MB

      Download

    • memory/4332-0-0x0000000074B5E000-0x0000000074B5F000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4520-772-0x00000255EAC40000-0x00000255EAD40000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/4520-771-0x00000255EAC40000-0x00000255EAD40000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/4520-775-0x0000025DECD90000-0x0000025DECDB0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/4520-789-0x0000025DECD50000-0x0000025DECD70000-memory.dmp

      Filesize

      128KB

      Download

    • memory/4520-807-0x0000025DED160000-0x0000025DED180000-memory.dmp

      Filesize

      128KB

      Download

    • memory/4940-1217-0x00000000048D0000-0x00000000048D1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/5072-467-0x0000000004C90000-0x0000000004C91000-memory.dmp

      Filesize

      4KB

      Download