Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

2b1c6494c4...0N.exe

windows7-x64

10

2b1c6494c4...0N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    119s
  • max time network
    14s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    11/09/2024, 18:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2b1c6494c471b0ad336e3d9ce8c934f0N.exe

  • Size

    52KB

  • MD5

    2b1c6494c471b0ad336e3d9ce8c934f0

  • SHA1

    80d42b6a617cebfe2c0668b482b87f8742485f9f

  • SHA256

    c46b7fe7ca962ffc011e0f356dc0c5e80d4727d3a2057c33bbb443e67f7e4420

  • SHA512

    21996e570ee4160cb370a6e9a6829f52c3c650b3f47359df1eef1e258edabcded91f120561e7a74c37c550ff085f19ee6cb05cc818732733f3fe744dc30c0ed6

  • SSDEEP

    768:d+ciLamXW9XgMxjFkpvMVX8q18q13yO1oj5n/wFkfw:IzaEW5gMxZVXf8a3yO1opwB

Score
10/10
discoveryevasionpersistencetrojan

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 10 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 5 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 5 IoCs
    evasion
  • Windows security bypass 2 TTPs 25 IoCs
    evasiontrojan
  • Blocks application from running via registry modification 30 IoCs

    Adds application to list of disallowed applications.

    evasion
  • Disables RegEdit via registry modification 10 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 10 IoCs
    persistence
  • Executes dropped EXE 20 IoCs
  • Loads dropped DLL 28 IoCs
  • Modifies system executable filetype association 2 TTPs 62 IoCs
    persistence
  • Windows security modification 2 TTPs 30 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 15 IoCs
    persistence
  • Drops desktop.ini file(s) 12 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 32 IoCs
  • Drops file in Windows directory 20 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 45 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 4 IoCs
  • Suspicious use of SetWindowsHookEx 21 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 35 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2b1c6494c471b0ad336e3d9ce8c934f0N.exe
    "C:\Users\Admin\AppData\Local\Temp\2b1c6494c471b0ad336e3d9ce8c934f0N.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Windows security bypass
    • Blocks application from running via registry modification
    • Disables RegEdit via registry modification
    • Event Triggered Execution: Image File Execution Options Injection
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Windows security modification
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies Internet Explorer settings
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2056
    • C:\Windows\nEwb0Rn.exe
      C:\Windows\nEwb0Rn.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Blocks application from running via registry modification
      • Disables RegEdit via registry modification
      • Event Triggered Execution: Image File Execution Options Injection
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Windows security modification
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2700
      • C:\Windows\nEwb0Rn.exe
        C:\Windows\nEwb0Rn.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:872
      • C:\Windows\SysWOW64\WishfulThinking.exe
        C:\Windows\system32\WishfulThinking.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1232
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1416
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1660
    • C:\Windows\SysWOW64\WishfulThinking.exe
      C:\Windows\system32\WishfulThinking.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Blocks application from running via registry modification
      • Disables RegEdit via registry modification
      • Event Triggered Execution: Image File Execution Options Injection
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Windows security modification
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2824
      • C:\Windows\nEwb0Rn.exe
        C:\Windows\nEwb0Rn.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2436
      • C:\Windows\SysWOW64\WishfulThinking.exe
        C:\Windows\system32\WishfulThinking.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1940
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1836
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1664
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Blocks application from running via registry modification
      • Disables RegEdit via registry modification
      • Event Triggered Execution: Image File Execution Options Injection
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Windows security modification
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2632
      • C:\Windows\nEwb0Rn.exe
        C:\Windows\nEwb0Rn.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1144
      • C:\Windows\SysWOW64\WishfulThinking.exe
        C:\Windows\system32\WishfulThinking.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:828
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1476
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2724
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Blocks application from running via registry modification
      • Disables RegEdit via registry modification
      • Event Triggered Execution: Image File Execution Options Injection
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Windows security modification
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1972
      • C:\Windows\nEwb0Rn.exe
        C:\Windows\nEwb0Rn.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2176
      • C:\Windows\SysWOW64\WishfulThinking.exe
        C:\Windows\system32\WishfulThinking.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:876
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2524
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Event Triggered Execution

2
T1546

Change Default File Association

1
T1546.001

Image File Execution Options Injection

1
T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Event Triggered Execution

2
T1546

Change Default File Association

1
T1546.001

Image File Execution Options Injection

1
T1546.012

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Impair Defenses

2
T1562

Disable or Modify Tools

2
T1562.001

Modify Registry

9
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    52KB

    MD5

    871e069732afc1e4d483da34c2626bb8

    SHA1

    14fb0e2bc65df2a315399a9551b02acbc8dd4d7c

    SHA256

    d11bf883c16781fc8bc970ecb657119a1e05d9e026387cbd203f0746c1010925

    SHA512

    7fbb1babcdb95c8daba705e93aef3890de8c97a7e264d6a31e36e4212f03d0ca3dce2e4efc54e93f70e40365aecf59926cd48d79833ec4d50de7c86d0e625abb

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    52KB

    MD5

    cfe229a9c07094598cd760632486dce3

    SHA1

    ecb742ea8a6d28c038a927ece64c2186f6222ed0

    SHA256

    319e2cff6ee6f6f5cfd0487d551b103b99756c7e18798377f12129f28dcbcdf7

    SHA512

    52236765960b7e23085fa96eda3a4367506dbf14123c957b951bae087f4b3ace7097bf318878057791b565cd61cbd31de841ebf699d3387b8b9df1804a74e7cf

    Download Submit

  • C:\Windows\MSVBVM60.DLL
    Filesize

    1.3MB

    MD5

    5343a19c618bc515ceb1695586c6c137

    SHA1

    4dedae8cbde066f31c8e6b52c0baa3f8b1117742

    SHA256

    2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

    SHA512

    708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

    Download Submit

  • C:\Windows\SysWOW64\DamageControl.scr
    Filesize

    52KB

    MD5

    3b97101f611c9ee17e4ef858a12076d6

    SHA1

    9a870a8c4ee3547db9016e637c4afbf6f21b7c49

    SHA256

    bd89bd1332cc7331812b96349c0761b9e62e969a9369a8850e6905b163238385

    SHA512

    9df7f5706741a74045eca7e915c95b4480cfd77dd066e0433aee18675cdf7faed018cc50cd004b2c24363cf0ae18f87e4d3e4816e7304202112e6d636d3aa0ea

    Download Submit

  • C:\Windows\SysWOW64\DamageControl.scr
    Filesize

    52KB

    MD5

    28a80a15df0d32b6ac9e22ae9bba3705

    SHA1

    fa4abe47526ba73dfbf36adebebe5616884a6b3b

    SHA256

    3badefc91a5c6d3848a9c2bb1915ce5d66f0e62807be254705082189ed9cf400

    SHA512

    ed401d1c8983a80ca3834927e3ee347e1c2ed9c6631aa72888feb39c07f3eeafebbab1f8c834e3586a2b3a7c5e9dccf82f3d13b98883fc6cb566ae2d7007f231

    Download Submit

  • C:\Windows\SysWOW64\DamageControl.scr
    Filesize

    52KB

    MD5

    2b1c6494c471b0ad336e3d9ce8c934f0

    SHA1

    80d42b6a617cebfe2c0668b482b87f8742485f9f

    SHA256

    c46b7fe7ca962ffc011e0f356dc0c5e80d4727d3a2057c33bbb443e67f7e4420

    SHA512

    21996e570ee4160cb370a6e9a6829f52c3c650b3f47359df1eef1e258edabcded91f120561e7a74c37c550ff085f19ee6cb05cc818732733f3fe744dc30c0ed6

    Download Submit

  • C:\Windows\SysWOW64\JawsOfLife.exe
    Filesize

    52KB

    MD5

    1061214615d08c96d8b6853ad04113a8

    SHA1

    0203af35094d359cb8449f55822e3e9057211ac6

    SHA256

    3b9ca009577d82420aa51134cb8bdf44c83adbe9cd1cfd7e7b1f0c8b6ca21bde

    SHA512

    5b9d9901cf57994a3d55416d2df8f36dda070bf6ebe11f872298e6ebc2c93fb073a26b72c4797a985dafd927893c1ac8b171b3cdb7c766d0efb96b3f72354509

    Download Submit

  • C:\Windows\SysWOW64\JawsOfLife.exe
    Filesize

    52KB

    MD5

    260c3c8be4d11740d76c9d549175a6b7

    SHA1

    5f57a29626b139fc8b5f28dd33febb02ccbfaa29

    SHA256

    6b3f0a0ebef14b4b83689b8aecaac606e3c3bfe84b85afd8f2953d7b33f3363b

    SHA512

    862e25d7354b2bf0f988d5ab08dd9866177148647ac8af419f926ef6a9bf6d9d0620d87782486d19c89a73a4e016ffc85908c124024ebe9d286509e7b9359921

    Download Submit

  • C:\Windows\nEwb0Rn.exe
    Filesize

    52KB

    MD5

    42aa46f0d9ee5ae8d1b97039d4436346

    SHA1

    04dd68bfdacc5ff0be7da834493d3bbca538e884

    SHA256

    af4a5032996144e617dd37654e2d8bb8d17f1765e60df7c873f182fff01318ef

    SHA512

    66d34439fc0274aba73c4189dd7f822d9ce725519cb68c240b2412949953825ba20c86d50ad9470194386d84b1834466f14c264ed7453a7bdf4eb372e61f3602

    Download Submit

  • C:\about.htm
    Filesize

    2KB

    MD5

    94c0c5518c4f4bb044842a006d04932a

    SHA1

    23d9a914f6681d65e2b1faa171f4cf492562ebdb

    SHA256

    224c4e5cdc0e7495c5fb5d1f52d76807092b5cc2d0a7c95fa612ff7b1412706e

    SHA512

    79cb2cd9e19ac3cc8bd94f1a20369e61224f8db02bc04d1f5768d62163b68467a3d317808a942bc7cca6ca84c221bb54a76e097f543c88bb89f0a3c9534ff3bb

    Download Submit

  • C:\nEwb0Rn.exe
    Filesize

    52KB

    MD5

    cbb3fc0cc236154a2af655d63358df9f

    SHA1

    66a0a3d1e4f5e3c6672cc24754858b7d0c82afc3

    SHA256

    e11660211ee369ff584e3b36d6b927caebed71b36a1ab456af4ae73a04a3d135

    SHA512

    c62c77a22263bbe584e60f28482676b9afc02d5f8d64614a78374bf9c9f6f324589c34efcc0006a634644aa86a71a66b94416d754f83b6c260d3c826086c2166

    Download Submit

  • C:\nEwb0Rn.exe
    Filesize

    52KB

    MD5

    c6bf6d331e598ac4d82568ab6dca2f30

    SHA1

    31447c9ffbe5aa74532a606bceb219db087a1fc7

    SHA256

    b126ca3f9340b8e4e38e947e2265d9975d21e7f8d06ff843b76a80895e19d886

    SHA512

    648300c2dcdf4a6b51a194f9bd3e3b63e85cf0a9a9f7a18175dba16e224b897368e75871a452d74b058aaa7e29c6a6b32aef339ab13db9e97e45d9b1f792ce36

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
    Filesize

    52KB

    MD5

    bc26defa2ed6f6fb0319f1ffacc1da6a

    SHA1

    dbf206a2304debb67fb025780144708a3f0c7c1f

    SHA256

    1ff36e1ac2345644dce1dad8776d8e9ba66151a267d0a3ebd98e6575c51a10c8

    SHA512

    566d3b43309c02c4c96edaa647cc42f4fcc953b4f8b7f7b4f79ac12f2bde15f1aeeb795386bac6757b48f374b112dbd7202cb99620158ba0ab791302ee4f8a45

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
    Filesize

    52KB

    MD5

    934efc9d472d6303daf21f1634595262

    SHA1

    55e276a938c61761001f082ed2896d98adc4a239

    SHA256

    44860a5d8c545f7c8cd7754baa400f1c185763ffb8bf81721bdc376d61807edd

    SHA512

    102df0160c1364299033ad3ddd1aaef54962d7df821379fb57cfb04a6de44ef2570421688bf5b0430defc6441897d79cb223eb5f04a01cb5ebc5b9d63056d0bb

    Download Submit

  • \Windows\SysWOW64\WishfulThinking.exe
    Filesize

    52KB

    MD5

    91250b5422e27555c08a32e2987b8a38

    SHA1

    fce2143deca4583b63b4af9c9125cbaf53854a4c

    SHA256

    37e38ad879fbaffdfa32b9eaf2fa7f1d7af00d0bcbd86c87ddd369c557c77224

    SHA512

    6136a66a8c4cf0e000ed857eb3bebcad789348cfbe1a0c930f0eb35750ca465e34e0f98d5adab1c6cf8533e033596b43224c2089e36d925b4a859a9489dcd04a

    Download Submit

  • memory/828-309-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/872-238-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/872-239-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/876-306-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/1144-298-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1144-299-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/1232-241-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1232-234-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/1232-240-0x0000000000220000-0x0000000000230000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1232-275-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/1416-288-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/1416-292-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/1660-317-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/1660-328-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/1664-310-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/1664-308-0x00000000001B0000-0x00000000001C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1664-307-0x00000000001B0000-0x00000000001C0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1836-305-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/1940-199-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/1940-314-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/1972-478-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/1972-117-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/1972-285-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2056-119-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2056-116-0x0000000002690000-0x00000000026B8000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2056-77-0x0000000002690000-0x00000000026B8000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2056-0-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2056-121-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2056-103-0x0000000002690000-0x00000000026B8000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2056-109-0x0000000002690000-0x00000000026B8000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2056-78-0x0000000002690000-0x00000000026B8000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2056-90-0x0000000002690000-0x00000000026B8000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2104-361-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2176-286-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2176-290-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2436-196-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2436-195-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2436-186-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2524-326-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2524-316-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2632-322-0x0000000001ED0000-0x0000000001EF8000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2632-232-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2632-235-0x0000000001ED0000-0x0000000001EF8000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2632-477-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2632-104-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2700-475-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2700-329-0x0000000002550000-0x0000000002578000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2700-233-0x0000000002550000-0x0000000002578000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2700-80-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2700-187-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2724-400-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2824-185-0x0000000000830000-0x0000000000858000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2824-91-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2824-476-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2824-198-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2824-201-0x0000000000830000-0x0000000000858000-memory.dmp

    Filesize

    160KB

    Download