Overview

overview

10

Static

static

10

0abffe828d...15.exe

windows7-x64

10

0abffe828d...15.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    109s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-09-2024 17:24

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0abffe828d2eb7e3afd05070cd31f109e85279619df66f536fcd0ad0e42cc315.exe

  • Size

    14KB

  • MD5

    3d190541758e0f39bbe43700e8445d9f

  • SHA1

    72d168679f3bc5977b7cf8dd81e712bae4c64b83

  • SHA256

    0abffe828d2eb7e3afd05070cd31f109e85279619df66f536fcd0ad0e42cc315

  • SHA512

    2fc3a2c89325842b3c019fba36fa4389e3312f6ac955939550776319ce017b8480941406c8a7994e9e86a9335bc78927140fec57779b5fcb9d5fd9c32e2478f6

  • SSDEEP

    192:wO8CyIeAUKLeADlDp16N8feKr0h8syciISeKX83e3Q5tfgo7:wvueA/Lv/16+GKlsycVKN3c

Score
10/10
cobaltstrikebackdoorpersistencetrojan

Malware Config

Extracted

Family

cobaltstrike

C2

http://3.122.237.166:4443/HEbn

Attributes
  • user_agent

    User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko

Signatures

  • Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 9 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 16 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 12 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 14 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3448
    • C:\Users\Admin\AppData\Local\Temp\0abffe828d2eb7e3afd05070cd31f109e85279619df66f536fcd0ad0e42cc315.exe
      "C:\Users\Admin\AppData\Local\Temp\0abffe828d2eb7e3afd05070cd31f109e85279619df66f536fcd0ad0e42cc315.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2924
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4368
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4456
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4948
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2668
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4464
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SendNotifyMessage
    PID:4396
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3964
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4736
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:2884
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1700
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:5104
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2476
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2132
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    PID:3540
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4428
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3216
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3236
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:404
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3852
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:1544
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4372
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4032
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    PID:4876
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
      PID:1176
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
        PID:3736
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:3184
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:4272
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:3544
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:2372
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:3640
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:4520
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:3796
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:4296
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:3476
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:4388
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:3132
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                                PID:2784
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:1680
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:3476
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                      PID:4308
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:2696
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:4176
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:4328
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:4360
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:3816
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:64

                                                Network

                                                MITRE ATT&CK Enterprise v15

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                  Filesize

                                                  471B

                                                  MD5

                                                  c5ae9f54c69f9746498f9a30aadf6d0f

                                                  SHA1

                                                  fd076d7133bce1925d86039f32abf2ff8dac3d94

                                                  SHA256

                                                  19a14eb8d7c9b00e80577a7199763fcea0e2feddcdb0b19def90bf631c7cba9d

                                                  SHA512

                                                  3904209e4cae0f35795f076daaaeec12ce46200f99e9216340b7f6b636b809e0dd451101263f0a534bd3e42ec79fc1ee85f2fcd7562d05cbd1df9ea6c5300af8

                                                  Download Submit

                                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9
                                                  Filesize

                                                  420B

                                                  MD5

                                                  2115082fef8e8cecf62d113d489651fb

                                                  SHA1

                                                  b86156752d11b8074b20edb7f399d0c7b1ce0a80

                                                  SHA256

                                                  2cb87647fc832f43b7434c94afada61d1692e71240d14b00a136ddea70e1d544

                                                  SHA512

                                                  5a1a95a82a51a7a209a3f292ea399eff30c1e6417f2b6fec89d9eae64d7c602e5b3bd3280767e65932aa0bdd3da044d4a9e7b7e5b9029a440e6190f250c056e2

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                  Filesize

                                                  2KB

                                                  MD5

                                                  48ec57dc71c08d5bf54ac3e5e2680d12

                                                  SHA1

                                                  d7f7f016f6eb758ae297c4a055ce2eca78ee9011

                                                  SHA256

                                                  33ff3e9e4d47e76f423053e88715b723ba566e66151f13121ed8b21a7e0a79fa

                                                  SHA512

                                                  059ad2adb6e7b432cca6ea7b0b9f34749fdd92c31b182a80d2d36ca98cfb27cfbd0258f4c844f84e327d76a76d986d0d3f07cfd1b4f7fe50bb649cb0f997b911

                                                  Download Submit

                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\Y25IPP08\microsoft.windows[1].xml
                                                  Filesize

                                                  97B

                                                  MD5

                                                  d07a8eeeb6da833c3c127ff207daead9

                                                  SHA1

                                                  cc8a12f7c600ac6ad8211f50045ca376f88f3cb6

                                                  SHA256

                                                  113038e3d15cda4a50c0980cb7075456d00b0770a1c436b68cea36b435363392

                                                  SHA512

                                                  84bac1ea9a2bac093a6356933b08c841d1ef922937d05db05b388b6b107d77a7edcf6431db083a89e611c86c2ed9e8e83207e798edb08e3e056045780a432800

                                                  Download Submit

                                                • memory/1544-717-0x0000000004850000-0x0000000004851000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2132-341-0x000001A5B7D40000-0x000001A5B7D60000-memory.dmp

                                                  Filesize

                                                  128KB

                                                  Download

                                                • memory/2132-317-0x000001A5B7970000-0x000001A5B7990000-memory.dmp

                                                  Filesize

                                                  128KB

                                                  Download

                                                • memory/2132-329-0x000001A5B7930000-0x000001A5B7950000-memory.dmp

                                                  Filesize

                                                  128KB

                                                  Download

                                                • memory/2132-313-0x0000019DB5820000-0x0000019DB5920000-memory.dmp

                                                  Filesize

                                                  1024KB

                                                  Download

                                                • memory/2132-312-0x0000019DB5820000-0x0000019DB5920000-memory.dmp

                                                  Filesize

                                                  1024KB

                                                  Download

                                                • memory/2372-1161-0x0000000004BE0000-0x0000000004BE1000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/2784-1481-0x000001B838060000-0x000001B838080000-memory.dmp

                                                  Filesize

                                                  128KB

                                                  Download

                                                • memory/2784-1463-0x000001B837C90000-0x000001B837CB0000-memory.dmp

                                                  Filesize

                                                  128KB

                                                  Download

                                                • memory/2784-1472-0x000001B837C50000-0x000001B837C70000-memory.dmp

                                                  Filesize

                                                  128KB

                                                  Download

                                                • memory/3184-1013-0x0000000004000000-0x0000000004001000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/3216-487-0x000002911F320000-0x000002911F340000-memory.dmp

                                                  Filesize

                                                  128KB

                                                  Download

                                                • memory/3216-468-0x000002911EF20000-0x000002911EF40000-memory.dmp

                                                  Filesize

                                                  128KB

                                                  Download

                                                • memory/3216-456-0x000002911EF60000-0x000002911EF80000-memory.dmp

                                                  Filesize

                                                  128KB

                                                  Download

                                                • memory/3236-569-0x00000000035A0000-0x00000000035A1000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/3448-0-0x0000000000D80000-0x0000000000D81000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/3448-1-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/3476-1339-0x0000019E838A0000-0x0000019E838C0000-memory.dmp

                                                  Filesize

                                                  128KB

                                                  Download

                                                • memory/3476-1326-0x0000019E83290000-0x0000019E832B0000-memory.dmp

                                                  Filesize

                                                  128KB

                                                  Download

                                                • memory/3476-1309-0x0000019E82500000-0x0000019E82600000-memory.dmp

                                                  Filesize

                                                  1024KB

                                                  Download

                                                • memory/3476-1311-0x0000019E82500000-0x0000019E82600000-memory.dmp

                                                  Filesize

                                                  1024KB

                                                  Download

                                                • memory/3476-1314-0x0000019E832D0000-0x0000019E832F0000-memory.dmp

                                                  Filesize

                                                  128KB

                                                  Download

                                                • memory/3476-1310-0x0000019E82500000-0x0000019E82600000-memory.dmp

                                                  Filesize

                                                  1024KB

                                                  Download

                                                • memory/3540-448-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/3544-1046-0x000002D946300000-0x000002D946320000-memory.dmp

                                                  Filesize

                                                  128KB

                                                  Download

                                                • memory/3544-1033-0x000002D945F00000-0x000002D945F20000-memory.dmp

                                                  Filesize

                                                  128KB

                                                  Download

                                                • memory/3544-1020-0x000002D945F40000-0x000002D945F60000-memory.dmp

                                                  Filesize

                                                  128KB

                                                  Download

                                                • memory/3544-1016-0x000002D944E00000-0x000002D944F00000-memory.dmp

                                                  Filesize

                                                  1024KB

                                                  Download

                                                • memory/3544-1015-0x000002D944E00000-0x000002D944F00000-memory.dmp

                                                  Filesize

                                                  1024KB

                                                  Download

                                                • memory/3736-896-0x000002AF4F8E0000-0x000002AF4F900000-memory.dmp

                                                  Filesize

                                                  128KB

                                                  Download

                                                • memory/3736-884-0x000002AF4F2C0000-0x000002AF4F2E0000-memory.dmp

                                                  Filesize

                                                  128KB

                                                  Download

                                                • memory/3736-872-0x000002AF4E400000-0x000002AF4E500000-memory.dmp

                                                  Filesize

                                                  1024KB

                                                  Download

                                                • memory/3736-875-0x000002AF4F300000-0x000002AF4F320000-memory.dmp

                                                  Filesize

                                                  128KB

                                                  Download

                                                • memory/3796-1308-0x0000000004020000-0x0000000004021000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/3852-596-0x0000027853420000-0x0000027853440000-memory.dmp

                                                  Filesize

                                                  128KB

                                                  Download

                                                • memory/3852-586-0x0000027853020000-0x0000027853040000-memory.dmp

                                                  Filesize

                                                  128KB

                                                  Download

                                                • memory/3852-577-0x0000027853060000-0x0000027853080000-memory.dmp

                                                  Filesize

                                                  128KB

                                                  Download

                                                • memory/4032-752-0x0000027600610000-0x0000027600630000-memory.dmp

                                                  Filesize

                                                  128KB

                                                  Download

                                                • memory/4032-738-0x0000027600200000-0x0000027600220000-memory.dmp

                                                  Filesize

                                                  128KB

                                                  Download

                                                • memory/4032-725-0x0000027600240000-0x0000027600260000-memory.dmp

                                                  Filesize

                                                  128KB

                                                  Download

                                                • memory/4032-721-0x000002767DF00000-0x000002767E000000-memory.dmp

                                                  Filesize

                                                  1024KB

                                                  Download

                                                • memory/4388-1456-0x00000000046A0000-0x00000000046A1000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/4396-156-0x0000000004630000-0x0000000004631000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/4464-47-0x0000017D47E40000-0x0000017D47E60000-memory.dmp

                                                  Filesize

                                                  128KB

                                                  Download

                                                • memory/4464-12-0x0000017D46A00000-0x0000017D46B00000-memory.dmp

                                                  Filesize

                                                  1024KB

                                                  Download

                                                • memory/4464-17-0x0000017D47A70000-0x0000017D47A90000-memory.dmp

                                                  Filesize

                                                  128KB

                                                  Download

                                                • memory/4464-44-0x0000017D47A30000-0x0000017D47A50000-memory.dmp

                                                  Filesize

                                                  128KB

                                                  Download

                                                • memory/4520-1181-0x0000015665850000-0x0000015665870000-memory.dmp

                                                  Filesize

                                                  128KB

                                                  Download

                                                • memory/4520-1168-0x0000015665890000-0x00000156658B0000-memory.dmp

                                                  Filesize

                                                  128KB

                                                  Download

                                                • memory/4520-1192-0x0000015665C60000-0x0000015665C80000-memory.dmp

                                                  Filesize

                                                  128KB

                                                  Download

                                                • memory/4736-178-0x000001D0E5570000-0x000001D0E5590000-memory.dmp

                                                  Filesize

                                                  128KB

                                                  Download

                                                • memory/4736-159-0x000001D0E4450000-0x000001D0E4550000-memory.dmp

                                                  Filesize

                                                  1024KB

                                                  Download

                                                • memory/4736-164-0x000001D0E55B0000-0x000001D0E55D0000-memory.dmp

                                                  Filesize

                                                  128KB

                                                  Download

                                                • memory/4736-195-0x000001D0E5980000-0x000001D0E59A0000-memory.dmp

                                                  Filesize

                                                  128KB

                                                  Download

                                                • memory/4876-868-0x0000000003F00000-0x0000000003F01000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/4948-11-0x0000000004240000-0x0000000004241000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download

                                                • memory/5104-311-0x0000000002BB0000-0x0000000002BB1000-memory.dmp

                                                  Filesize

                                                  4KB

                                                  Download