Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

Client.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    92s
  • max time network
    141s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/10/2024, 06:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Client.exe

  • Size

    16KB

  • MD5

    203da2c862c0594774d5a8d400974128

  • SHA1

    fc16eeaccc9197484254f8b2a2aa559f7613029f

  • SHA256

    6e5dcc76eb40605f27adaba59d0c6e3836c904cb3a3935fd8e3dd22555e027c3

  • SHA512

    7841e998b722201b3ac4b0e885d3fda53f58239feed0f3bb860498efd044e6e8d485d333ff6b1370abeedf24f9212ca345bf445db2790a2363afab26e3cce6e8

  • SSDEEP

    384:SLGXnSVdX5/VBjipD9oDPlMNcLlb5sVKZyN5Ct:SLGXnSVdTBjOclMNESo

Score
8/10
persistence

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 5 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 8 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Client.exe
    "C:\Users\Admin\AppData\Local\Temp\Client.exe"
    1⤵
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:5044
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe"
      2⤵
        PID:3864
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2820
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2916
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:2776
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:5008
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:3192
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4528
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Enumerates system info in registry
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2300
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of SendNotifyMessage
      PID:3428
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:2696
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1672
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Modifies registry class
      PID:4484
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
        PID:2044
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:1300
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
            PID:4116
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:656
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:940
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:3556
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:3836
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:2820
                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                      1⤵
                        PID:740
                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                        1⤵
                          PID:3444
                        • C:\Windows\explorer.exe
                          explorer.exe
                          1⤵
                            PID:3164
                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                            1⤵
                              PID:4200
                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                              1⤵
                                PID:2188
                              • C:\Windows\explorer.exe
                                explorer.exe
                                1⤵
                                  PID:3136
                                • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                  1⤵
                                    PID:2620
                                  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                    1⤵
                                      PID:1968
                                    • C:\Windows\explorer.exe
                                      explorer.exe
                                      1⤵
                                        PID:3532
                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                        1⤵
                                          PID:2288
                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                          1⤵
                                            PID:1244
                                          • C:\Windows\explorer.exe
                                            explorer.exe
                                            1⤵
                                              PID:3728
                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                              1⤵
                                                PID:208
                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                1⤵
                                                  PID:1948
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:776
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:3388
                                                    • C:\Windows\explorer.exe
                                                      explorer.exe
                                                      1⤵
                                                        PID:3856
                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                        1⤵
                                                          PID:4268
                                                        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                          1⤵
                                                            PID:1220
                                                          • C:\Windows\explorer.exe
                                                            explorer.exe
                                                            1⤵
                                                              PID:3680
                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                              1⤵
                                                                PID:2620
                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                1⤵
                                                                  PID:1376

                                                                Network

                                                                MITRE ATT&CK Enterprise v15

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                                  Filesize

                                                                  2KB

                                                                  MD5

                                                                  00d870f3d100b69657d43ee130b477a8

                                                                  SHA1

                                                                  cf9a886794121ef6363271c781a2a29059cfdc90

                                                                  SHA256

                                                                  0ec9094e5cdf930e01ada00413ddd0fa7c78eb0a3f10828e610875639bbe1057

                                                                  SHA512

                                                                  004a6f9f61e0d48d20c788f7412e8076e8273f6da8f15352e4c4e02ca03f7d5000c9b67fed4a944c9e7a2ad170e4312c1231740805b1af9c091a8ee618259f27

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133731897695421669.txt
                                                                  Filesize

                                                                  74KB

                                                                  MD5

                                                                  62d30d0f2d9d533e322e5d873da1c784

                                                                  SHA1

                                                                  d6b937cbc6194462940123d984b2de8fb02853d1

                                                                  SHA256

                                                                  4d5ced715b5ce3169cc5cf75da3f185958b47229a913b20b26495f291e0fb133

                                                                  SHA512

                                                                  65d33dd50cfee6bf6b7721f814a5b976b18b62b05ae0836f5bb01cbf4230f35a9bc6d7f5d32eb979ef095ee7c05d8a8cd1e795a0c92a6e83e42fdffbc90c57c1

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\IDX_CONTENT_TASKBARHEADLINES.json
                                                                  Filesize

                                                                  229KB

                                                                  MD5

                                                                  5cbbc20f171c18ea535d0f121ecf6df5

                                                                  SHA1

                                                                  97f265b66a15bdda2cac94aa77928841939e56b7

                                                                  SHA256

                                                                  4616f99c3dc2fb2cb5a35b4bf218c212bfc19f875075c47a963645223a6d1ffc

                                                                  SHA512

                                                                  5a1012929b216c25967077df2672fa30fe2e0a6f9ccf08e1c04fb2f2305cbafa9829e0d3fe78accc5db443d111741d770ed04d91cdbf59bc840fc3858737a9e9

                                                                  Download Submit

                                                                • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\LLDJA3WI\microsoft.windows[1].xml
                                                                  Filesize

                                                                  97B

                                                                  MD5

                                                                  372706547a804b876522fe741dbfc040

                                                                  SHA1

                                                                  9bca733d6804f24c6841ef02b52e8ade1b45d7e4

                                                                  SHA256

                                                                  09fe1eb66c953d75dc66ff6df9237cde5f419fb25fab6327de9cde6676219651

                                                                  SHA512

                                                                  cc8057de048bf5646e41bed6f01111328bceae9abb4282a4ee1be635d086b6b3647cb5cc17cc3564980e5e31342a767dc639e536edbd3720df6b35ac7ebce34a

                                                                  Download Submit

                                                                • memory/656-340-0x0000022D544C0000-0x0000022D544E0000-memory.dmp

                                                                  Filesize

                                                                  128KB

                                                                  Download

                                                                • memory/656-361-0x0000022D54AA0000-0x0000022D54AC0000-memory.dmp

                                                                  Filesize

                                                                  128KB

                                                                  Download

                                                                • memory/656-350-0x0000022D54480000-0x0000022D544A0000-memory.dmp

                                                                  Filesize

                                                                  128KB

                                                                  Download

                                                                • memory/940-484-0x0000000003EC0000-0x0000000003EC1000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                  Download

                                                                • memory/1220-1378-0x0000024D06CB0000-0x0000024D06CD0000-memory.dmp

                                                                  Filesize

                                                                  128KB

                                                                  Download

                                                                • memory/1220-1396-0x0000024D072C0000-0x0000024D072E0000-memory.dmp

                                                                  Filesize

                                                                  128KB

                                                                  Download

                                                                • memory/1220-1364-0x0000024D06CF0000-0x0000024D06D10000-memory.dmp

                                                                  Filesize

                                                                  128KB

                                                                  Download

                                                                • memory/1244-1066-0x0000021434A00000-0x0000021434B00000-memory.dmp

                                                                  Filesize

                                                                  1024KB

                                                                  Download

                                                                • memory/1244-1067-0x0000021434A00000-0x0000021434B00000-memory.dmp

                                                                  Filesize

                                                                  1024KB

                                                                  Download

                                                                • memory/1244-1065-0x0000021434A00000-0x0000021434B00000-memory.dmp

                                                                  Filesize

                                                                  1024KB

                                                                  Download

                                                                • memory/1244-1083-0x0000021435900000-0x0000021435920000-memory.dmp

                                                                  Filesize

                                                                  128KB

                                                                  Download

                                                                • memory/1244-1094-0x0000021435F20000-0x0000021435F40000-memory.dmp

                                                                  Filesize

                                                                  128KB

                                                                  Download

                                                                • memory/1244-1070-0x0000021435940000-0x0000021435960000-memory.dmp

                                                                  Filesize

                                                                  128KB

                                                                  Download

                                                                • memory/1300-332-0x0000000002C90000-0x0000000002C91000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                  Download

                                                                • memory/1672-225-0x00000227AC8C0000-0x00000227AC8E0000-memory.dmp

                                                                  Filesize

                                                                  128KB

                                                                  Download

                                                                • memory/1672-213-0x00000227AC2A0000-0x00000227AC2C0000-memory.dmp

                                                                  Filesize

                                                                  128KB

                                                                  Download

                                                                • memory/1672-193-0x00000227AB370000-0x00000227AB470000-memory.dmp

                                                                  Filesize

                                                                  1024KB

                                                                  Download

                                                                • memory/1672-191-0x00000227AB370000-0x00000227AB470000-memory.dmp

                                                                  Filesize

                                                                  1024KB

                                                                  Download

                                                                • memory/1672-196-0x00000227AC2E0000-0x00000227AC300000-memory.dmp

                                                                  Filesize

                                                                  128KB

                                                                  Download

                                                                • memory/1672-192-0x00000227AB370000-0x00000227AB470000-memory.dmp

                                                                  Filesize

                                                                  1024KB

                                                                  Download

                                                                • memory/1948-1217-0x000001CF85F00000-0x000001CF86000000-memory.dmp

                                                                  Filesize

                                                                  1024KB

                                                                  Download

                                                                • memory/1948-1222-0x000001CF86D00000-0x000001CF86D20000-memory.dmp

                                                                  Filesize

                                                                  128KB

                                                                  Download

                                                                • memory/1948-1249-0x000001CF872E0000-0x000001CF87300000-memory.dmp

                                                                  Filesize

                                                                  128KB

                                                                  Download

                                                                • memory/1948-1236-0x000001CF86CC0000-0x000001CF86CE0000-memory.dmp

                                                                  Filesize

                                                                  128KB

                                                                  Download

                                                                • memory/1968-914-0x0000028654320000-0x0000028654420000-memory.dmp

                                                                  Filesize

                                                                  1024KB

                                                                  Download

                                                                • memory/1968-930-0x0000028655440000-0x0000028655460000-memory.dmp

                                                                  Filesize

                                                                  128KB

                                                                  Download

                                                                • memory/1968-913-0x0000028654320000-0x0000028654420000-memory.dmp

                                                                  Filesize

                                                                  1024KB

                                                                  Download

                                                                • memory/1968-918-0x0000028655480000-0x00000286554A0000-memory.dmp

                                                                  Filesize

                                                                  128KB

                                                                  Download

                                                                • memory/1968-942-0x0000028655850000-0x0000028655870000-memory.dmp

                                                                  Filesize

                                                                  128KB

                                                                  Download

                                                                • memory/2188-799-0x00000112FF4A0000-0x00000112FF4C0000-memory.dmp

                                                                  Filesize

                                                                  128KB

                                                                  Download

                                                                • memory/2188-788-0x00000112FF090000-0x00000112FF0B0000-memory.dmp

                                                                  Filesize

                                                                  128KB

                                                                  Download

                                                                • memory/2188-775-0x00000112FE000000-0x00000112FE100000-memory.dmp

                                                                  Filesize

                                                                  1024KB

                                                                  Download

                                                                • memory/2188-774-0x00000112FE000000-0x00000112FE100000-memory.dmp

                                                                  Filesize

                                                                  1024KB

                                                                  Download

                                                                • memory/2188-779-0x00000112FF0D0000-0x00000112FF0F0000-memory.dmp

                                                                  Filesize

                                                                  128KB

                                                                  Download

                                                                • memory/2300-40-0x000001F51C700000-0x000001F51C720000-memory.dmp

                                                                  Filesize

                                                                  128KB

                                                                  Download

                                                                • memory/2300-23-0x000001F51B600000-0x000001F51B700000-memory.dmp

                                                                  Filesize

                                                                  1024KB

                                                                  Download

                                                                • memory/2300-27-0x000001F51C740000-0x000001F51C760000-memory.dmp

                                                                  Filesize

                                                                  128KB

                                                                  Download

                                                                • memory/2300-59-0x000001F51CB10000-0x000001F51CB30000-memory.dmp

                                                                  Filesize

                                                                  128KB

                                                                  Download

                                                                • memory/2300-22-0x000001F51B600000-0x000001F51B700000-memory.dmp

                                                                  Filesize

                                                                  1024KB

                                                                  Download

                                                                • memory/2820-630-0x00000000042D0000-0x00000000042D1000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                  Download

                                                                • memory/3136-911-0x0000000004340000-0x0000000004341000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                  Download

                                                                • memory/3164-772-0x0000000003F80000-0x0000000003F81000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                  Download

                                                                • memory/3192-57-0x0000000004020000-0x0000000004021000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                  Download

                                                                • memory/3428-190-0x0000000004310000-0x0000000004311000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                  Download

                                                                • memory/3444-668-0x00000188A1280000-0x00000188A12A0000-memory.dmp

                                                                  Filesize

                                                                  128KB

                                                                  Download

                                                                • memory/3444-646-0x00000188A0C70000-0x00000188A0C90000-memory.dmp

                                                                  Filesize

                                                                  128KB

                                                                  Download

                                                                • memory/3444-632-0x000001889FD50000-0x000001889FE50000-memory.dmp

                                                                  Filesize

                                                                  1024KB

                                                                  Download

                                                                • memory/3444-636-0x00000188A0CB0000-0x00000188A0CD0000-memory.dmp

                                                                  Filesize

                                                                  128KB

                                                                  Download

                                                                • memory/3532-1064-0x0000000003F50000-0x0000000003F51000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                  Download

                                                                • memory/3728-1216-0x0000000004530000-0x0000000004531000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                  Download

                                                                • memory/3836-486-0x000002260C200000-0x000002260C300000-memory.dmp

                                                                  Filesize

                                                                  1024KB

                                                                  Download

                                                                • memory/3836-504-0x000002260D2F0000-0x000002260D310000-memory.dmp

                                                                  Filesize

                                                                  128KB

                                                                  Download

                                                                • memory/3836-515-0x000002260D700000-0x000002260D720000-memory.dmp

                                                                  Filesize

                                                                  128KB

                                                                  Download

                                                                • memory/3836-491-0x000002260D330000-0x000002260D350000-memory.dmp

                                                                  Filesize

                                                                  128KB

                                                                  Download

                                                                • memory/3836-488-0x000002260C200000-0x000002260C300000-memory.dmp

                                                                  Filesize

                                                                  1024KB

                                                                  Download

                                                                • memory/3856-1358-0x0000000004660000-0x0000000004661000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                  Download

                                                                • memory/5044-11-0x000000001C990000-0x000000001C998000-memory.dmp

                                                                  Filesize

                                                                  32KB

                                                                  Download

                                                                • memory/5044-18-0x00007FF974E80000-0x00007FF975821000-memory.dmp

                                                                  Filesize

                                                                  9.6MB

                                                                  Download

                                                                • memory/5044-16-0x00007FF974E80000-0x00007FF975821000-memory.dmp

                                                                  Filesize

                                                                  9.6MB

                                                                  Download

                                                                • memory/5044-13-0x00007FF974E80000-0x00007FF975821000-memory.dmp

                                                                  Filesize

                                                                  9.6MB

                                                                  Download

                                                                • memory/5044-12-0x00007FF974E80000-0x00007FF975821000-memory.dmp

                                                                  Filesize

                                                                  9.6MB

                                                                  Download

                                                                • memory/5044-14-0x00007FF974E80000-0x00007FF975821000-memory.dmp

                                                                  Filesize

                                                                  9.6MB

                                                                  Download

                                                                • memory/5044-10-0x000000001D6E0000-0x000000001D77C000-memory.dmp

                                                                  Filesize

                                                                  624KB

                                                                  Download

                                                                • memory/5044-9-0x000000001D2A0000-0x000000001D2BC000-memory.dmp

                                                                  Filesize

                                                                  112KB

                                                                  Download

                                                                • memory/5044-8-0x00007FF974E80000-0x00007FF975821000-memory.dmp

                                                                  Filesize

                                                                  9.6MB

                                                                  Download

                                                                • memory/5044-15-0x00007FF974E80000-0x00007FF975821000-memory.dmp

                                                                  Filesize

                                                                  9.6MB

                                                                  Download

                                                                • memory/5044-7-0x00007FF974E80000-0x00007FF975821000-memory.dmp

                                                                  Filesize

                                                                  9.6MB

                                                                  Download

                                                                • memory/5044-6-0x00007FF975135000-0x00007FF975136000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                  Download

                                                                • memory/5044-5-0x00007FF974E80000-0x00007FF975821000-memory.dmp

                                                                  Filesize

                                                                  9.6MB

                                                                  Download

                                                                • memory/5044-4-0x000000001C4D0000-0x000000001C532000-memory.dmp

                                                                  Filesize

                                                                  392KB

                                                                  Download

                                                                • memory/5044-0-0x00007FF975135000-0x00007FF975136000-memory.dmp

                                                                  Filesize

                                                                  4KB

                                                                  Download

                                                                • memory/5044-3-0x000000001C350000-0x000000001C3F6000-memory.dmp

                                                                  Filesize

                                                                  664KB

                                                                  Download

                                                                • memory/5044-2-0x00007FF974E80000-0x00007FF975821000-memory.dmp

                                                                  Filesize

                                                                  9.6MB

                                                                  Download

                                                                • memory/5044-1-0x000000001BE80000-0x000000001C34E000-memory.dmp

                                                                  Filesize

                                                                  4.8MB

                                                                  Download