Overview

overview

10

Static

static

10

0abffe828d...15.exe

windows7-x64

10

0abffe828d...15.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    104s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-09-2024 14:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0abffe828d2eb7e3afd05070cd31f109e85279619df66f536fcd0ad0e42cc315.exe

  • Size

    14KB

  • MD5

    3d190541758e0f39bbe43700e8445d9f

  • SHA1

    72d168679f3bc5977b7cf8dd81e712bae4c64b83

  • SHA256

    0abffe828d2eb7e3afd05070cd31f109e85279619df66f536fcd0ad0e42cc315

  • SHA512

    2fc3a2c89325842b3c019fba36fa4389e3312f6ac955939550776319ce017b8480941406c8a7994e9e86a9335bc78927140fec57779b5fcb9d5fd9c32e2478f6

  • SSDEEP

    192:wO8CyIeAUKLeADlDp16N8feKr0h8syciISeKX83e3Q5tfgo7:wvueA/Lv/16+GKlsycVKN3c

Score
10/10
cobaltstrikebackdoorpersistencetrojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://3.122.237.166:4443/HEbn

Attributes
  • user_agent

    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko

Signatures

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 16 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 12 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3524
    • C:\Users\Admin\AppData\Local\Temp\0abffe828d2eb7e3afd05070cd31f109e85279619df66f536fcd0ad0e42cc315.exe
      "C:\Users\Admin\AppData\Local\Temp\0abffe828d2eb7e3afd05070cd31f109e85279619df66f536fcd0ad0e42cc315.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2188
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4456
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3620
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1060
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4496
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1548
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:4492
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:928
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4156
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:3564
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4700
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2560
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4364
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1620
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2412
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3800
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1872
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3136
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4980
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4984
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4032
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Modifies registry class
    PID:3552
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
      PID:3188
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
        PID:3996
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:3868
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:4700
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:3740
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:1924
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:1984
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:3140
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:3936
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:4496
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:984
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:4900
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:584
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                                PID:4736
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:2928
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:2012
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                      PID:4892
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:4276
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:4856
                                        • C:\Windows\explorer.exe
                                          explorer.exe
                                          1⤵
                                            PID:1616
                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                            1⤵
                                              PID:4240
                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                              1⤵
                                                PID:3536
                                              • C:\Windows\explorer.exe
                                                explorer.exe
                                                1⤵
                                                  PID:2408
                                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                  1⤵
                                                    PID:1948
                                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                    1⤵
                                                      PID:3300
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                        PID:4516
                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                        1⤵
                                                          PID:4956
                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                          1⤵
                                                            PID:3232

                                                          Network

                                                          MITRE ATT&CK Enterprise v15

                                                          Replay Monitor

                                                          Loading Replay Monitor...

                                                          Downloads

                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                            Filesize

                                                            471B

                                                            MD5

                                                            c5ae9f54c69f9746498f9a30aadf6d0f

                                                            SHA1

                                                            fd076d7133bce1925d86039f32abf2ff8dac3d94

                                                            SHA256

                                                            19a14eb8d7c9b00e80577a7199763fcea0e2feddcdb0b19def90bf631c7cba9d

                                                            SHA512

                                                            3904209e4cae0f35795f076daaaeec12ce46200f99e9216340b7f6b636b809e0dd451101263f0a534bd3e42ec79fc1ee85f2fcd7562d05cbd1df9ea6c5300af8

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                            Filesize

                                                            420B

                                                            MD5

                                                            f6f8432cd4323158ec47a5254b9c8676

                                                            SHA1

                                                            8426cacb25a672f46c1a77e1e8b404104b8d42a4

                                                            SHA256

                                                            3afc082b5041ca9e1296f005c23a8bf45e38675fc659dc79257ae45916379786

                                                            SHA512

                                                            b893042b0aec02e883c255800a42ee74e8464a96d30f6f6b3bf0ddc1467d3b143055756542757e8390e44f311798a9d491a6f23706254c463deb54478fd07688

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                            Filesize

                                                            2KB

                                                            MD5

                                                            6de7d6c5fc94dcaf957b528eea928946

                                                            SHA1

                                                            cd335c3e6a58b18a83b35e98af45e430c197bfa7

                                                            SHA256

                                                            322b6092866c5370268ae11147c331ca20a0310845a34a93899c809f007de7c0

                                                            SHA512

                                                            a4a5725671facdfb489869b233dc8d099b78e775acf43664128d754d0fd610fb8015bf487fccf8fb87e38b466c4d9429dd8451d98afc4eab6cc9c6788a0df881

                                                            Download Submit

                                                          • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\RMU4N5WP\microsoft.windows[1].xml
                                                            Filesize

                                                            97B

                                                            MD5

                                                            1e30d8c8ef07e3c98200641a90d1ae95

                                                            SHA1

                                                            b8e86446e5ff4d10984af769b912d8d34313da54

                                                            SHA256

                                                            0d0b29673b1fcaea71df3130c5c5cf31a8f8bbd16b60f9861b4a42665c934493

                                                            SHA512

                                                            bc0ca2e71bcc7f3680c683f91a87204d614f4bac56750619f449194f6aa69d983f526b4f73a5fed083ad56d648dfcce3a80c25b93fd07e76b616f14b219b6f04

                                                            Download Submit

                                                          • memory/984-1343-0x00000245A6040000-0x00000245A6140000-memory.dmp

                                                            Filesize

                                                            1024KB

                                                            Download

                                                          • memory/984-1344-0x00000245A6040000-0x00000245A6140000-memory.dmp

                                                            Filesize

                                                            1024KB

                                                            Download

                                                          • memory/1060-10-0x0000000004920000-0x0000000004921000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/1548-17-0x000001CCFAC00000-0x000001CCFAC20000-memory.dmp

                                                            Filesize

                                                            128KB

                                                            Download

                                                          • memory/1548-42-0x000001CCFAFD0000-0x000001CCFAFF0000-memory.dmp

                                                            Filesize

                                                            128KB

                                                            Download

                                                          • memory/1548-28-0x000001CCFABC0000-0x000001CCFABE0000-memory.dmp

                                                            Filesize

                                                            128KB

                                                            Download

                                                          • memory/1924-1199-0x0000000004000000-0x0000000004001000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/2412-465-0x00000289E5B00000-0x00000289E5C00000-memory.dmp

                                                            Filesize

                                                            1024KB

                                                            Download

                                                          • memory/2412-477-0x00000289E6C00000-0x00000289E6C20000-memory.dmp

                                                            Filesize

                                                            128KB

                                                            Download

                                                          • memory/2412-464-0x00000289E5B00000-0x00000289E5C00000-memory.dmp

                                                            Filesize

                                                            1024KB

                                                            Download

                                                          • memory/2412-501-0x00000289E7000000-0x00000289E7020000-memory.dmp

                                                            Filesize

                                                            128KB

                                                            Download

                                                          • memory/2412-469-0x00000289E6C40000-0x00000289E6C60000-memory.dmp

                                                            Filesize

                                                            128KB

                                                            Download

                                                          • memory/2412-466-0x00000289E5B00000-0x00000289E5C00000-memory.dmp

                                                            Filesize

                                                            1024KB

                                                            Download

                                                          • memory/2560-317-0x000001A043420000-0x000001A043440000-memory.dmp

                                                            Filesize

                                                            128KB

                                                            Download

                                                          • memory/2560-326-0x000001A0431E0000-0x000001A043200000-memory.dmp

                                                            Filesize

                                                            128KB

                                                            Download

                                                          • memory/2560-312-0x000001A042300000-0x000001A042400000-memory.dmp

                                                            Filesize

                                                            1024KB

                                                            Download

                                                          • memory/2560-349-0x000001A0437F0000-0x000001A043810000-memory.dmp

                                                            Filesize

                                                            128KB

                                                            Download

                                                          • memory/3136-617-0x00000175912B0000-0x00000175912D0000-memory.dmp

                                                            Filesize

                                                            128KB

                                                            Download

                                                          • memory/3136-629-0x00000175916C0000-0x00000175916E0000-memory.dmp

                                                            Filesize

                                                            128KB

                                                            Download

                                                          • memory/3136-606-0x00000175912F0000-0x0000017591310000-memory.dmp

                                                            Filesize

                                                            128KB

                                                            Download

                                                          • memory/3136-602-0x0000017590200000-0x0000017590300000-memory.dmp

                                                            Filesize

                                                            1024KB

                                                            Download

                                                          • memory/3136-603-0x0000017590200000-0x0000017590300000-memory.dmp

                                                            Filesize

                                                            1024KB

                                                            Download

                                                          • memory/3140-1203-0x0000029954400000-0x0000029954500000-memory.dmp

                                                            Filesize

                                                            1024KB

                                                            Download

                                                          • memory/3140-1206-0x00000299550D0000-0x00000299550F0000-memory.dmp

                                                            Filesize

                                                            128KB

                                                            Download

                                                          • memory/3140-1216-0x0000029955090000-0x00000299550B0000-memory.dmp

                                                            Filesize

                                                            128KB

                                                            Download

                                                          • memory/3140-1202-0x0000029954400000-0x0000029954500000-memory.dmp

                                                            Filesize

                                                            1024KB

                                                            Download

                                                          • memory/3140-1229-0x00000299558A0000-0x00000299558C0000-memory.dmp

                                                            Filesize

                                                            128KB

                                                            Download

                                                          • memory/3140-1201-0x0000029954400000-0x0000029954500000-memory.dmp

                                                            Filesize

                                                            1024KB

                                                            Download

                                                          • memory/3524-1-0x0000000000750000-0x0000000000751000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/3524-0-0x00000000006F0000-0x00000000006F1000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/3552-896-0x0000000004320000-0x0000000004321000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/3564-311-0x00000000043E0000-0x00000000043E1000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/3740-1052-0x0000029BE8E00000-0x0000029BE8F00000-memory.dmp

                                                            Filesize

                                                            1024KB

                                                            Download

                                                          • memory/3740-1055-0x0000029BE9D10000-0x0000029BE9D30000-memory.dmp

                                                            Filesize

                                                            128KB

                                                            Download

                                                          • memory/3740-1067-0x0000029BE9CD0000-0x0000029BE9CF0000-memory.dmp

                                                            Filesize

                                                            128KB

                                                            Download

                                                          • memory/3740-1079-0x0000029BEA2E0000-0x0000029BEA300000-memory.dmp

                                                            Filesize

                                                            128KB

                                                            Download

                                                          • memory/3740-1050-0x0000029BE8E00000-0x0000029BE8F00000-memory.dmp

                                                            Filesize

                                                            1024KB

                                                            Download

                                                          • memory/3740-1051-0x0000029BE8E00000-0x0000029BE8F00000-memory.dmp

                                                            Filesize

                                                            1024KB

                                                            Download

                                                          • memory/3800-599-0x0000000002FA0000-0x0000000002FA1000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/3868-1048-0x0000000004760000-0x0000000004761000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/3936-1341-0x0000000004860000-0x0000000004861000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/3996-903-0x000002A2AEC70000-0x000002A2AEC90000-memory.dmp

                                                            Filesize

                                                            128KB

                                                            Download

                                                          • memory/3996-926-0x000002A2AF040000-0x000002A2AF060000-memory.dmp

                                                            Filesize

                                                            128KB

                                                            Download

                                                          • memory/3996-915-0x000002A2AEC30000-0x000002A2AEC50000-memory.dmp

                                                            Filesize

                                                            128KB

                                                            Download

                                                          • memory/3996-899-0x000002A2ADC00000-0x000002A2ADD00000-memory.dmp

                                                            Filesize

                                                            1024KB

                                                            Download

                                                          • memory/3996-898-0x000002A2ADC00000-0x000002A2ADD00000-memory.dmp

                                                            Filesize

                                                            1024KB

                                                            Download

                                                          • memory/4032-763-0x00000130007B0000-0x00000130007D0000-memory.dmp

                                                            Filesize

                                                            128KB

                                                            Download

                                                          • memory/4032-751-0x00000127FEA00000-0x00000127FEB00000-memory.dmp

                                                            Filesize

                                                            1024KB

                                                            Download

                                                          • memory/4032-754-0x0000013000B00000-0x0000013000B20000-memory.dmp

                                                            Filesize

                                                            128KB

                                                            Download

                                                          • memory/4032-750-0x00000127FEA00000-0x00000127FEB00000-memory.dmp

                                                            Filesize

                                                            1024KB

                                                            Download

                                                          • memory/4032-749-0x00000127FEA00000-0x00000127FEB00000-memory.dmp

                                                            Filesize

                                                            1024KB

                                                            Download

                                                          • memory/4032-786-0x0000013000EC0000-0x0000013000EE0000-memory.dmp

                                                            Filesize

                                                            128KB

                                                            Download

                                                          • memory/4156-169-0x000002D7869E0000-0x000002D786A00000-memory.dmp

                                                            Filesize

                                                            128KB

                                                            Download

                                                          • memory/4156-180-0x000002D7869A0000-0x000002D7869C0000-memory.dmp

                                                            Filesize

                                                            128KB

                                                            Download

                                                          • memory/4156-200-0x000002D7870B0000-0x000002D7870D0000-memory.dmp

                                                            Filesize

                                                            128KB

                                                            Download

                                                          • memory/4364-462-0x0000000004C70000-0x0000000004C71000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/4492-161-0x00000000027D0000-0x00000000027D1000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download

                                                          • memory/4980-748-0x0000000004CC0000-0x0000000004CC1000-memory.dmp

                                                            Filesize

                                                            4KB

                                                            Download