Overview

overview

8

Static

static

3

ep_setup.exe

windows11-21h2-x64

8

Analysis

  • max time kernel
    225s
  • max time network
    207s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    18-11-2024 07:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ep_setup.exe

  • Size

    10.6MB

  • MD5

    f164888a6fbc646b093f6af6663f4e63

  • SHA1

    3c0bb9f9a4ad9b1c521ad9fc30ec03668577c97c

  • SHA256

    8c5a3597666f418b5c857e68c9a13b7b6d037ea08a988204b572f053450add67

  • SHA512

    f1b2173962561d3051ec6b5aa2fc0260809e37e829255d95c8a085f990c18b724daff4372f646d505dabe3cc3013364d4316c2340527c75d140dbc6b5ebdeee1

  • SSDEEP

    196608:Yobw/inDWIRviYy06kRUEsyiFo2ItCC2bO+WxNtTYnepC5YbM/rN2kGBlSrnU:dw/2Bvc06kiEviXTCIKNtUnqYYA/A

Score
8/10
discoveryevasionexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Stops running service(s) 4 TTPs
    evasionexecution
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Loads dropped DLL 7 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 9 IoCs
  • Drops file in Windows directory 5 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 5 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\ep_setup.exe
    "C:\Users\Admin\AppData\Local\Temp\ep_setup.exe"
    1⤵
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3356
    • C:\Windows\system32\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /f /im explorer.exe
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:1112
    • C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" stop ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB
      2⤵
      • Launches sc.exe
      PID:4052
    • C:\Windows\system32\sc.exe
      "C:\Windows\system32\sc.exe" start ep_dwm_D17F1E1A-5919-4427-8F89-A1A8503CA3EB
      2⤵
      • Launches sc.exe
      PID:328
    • C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host.dll"
      2⤵
      • Loads dropped DLL
      • Modifies registry class
      PID:5108
    • C:\Windows\system32\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll"
      2⤵
      • Loads dropped DLL
      • Modifies registry class
      PID:952
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Loads dropped DLL
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2292
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Program Files\ExplorerPatcher\ep_gui.dll",ZZGUI
        3⤵
        • Loads dropped DLL
        PID:3288
  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
    1⤵
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4016
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

1
T1569

Service Execution

1
T1569.002

Persistence

Boot or Logon Autostart Execution

1
T1547

Active Setup

1
T1547.014

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Active Setup

1
T1547.014

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Component Object Model Hijacking

1
T1546.015

Defense Evasion

Impair Defenses

1
T1562

Modify Registry

2
T1112

Credential Access

Discovery

Peripheral Device Discovery

2
T1120

Query Registry

5
T1012

System Information Discovery

4
T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

1
T1489

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\ExplorerPatcher\WebView2Loader.dll
    Filesize

    161KB

    MD5

    c5f0c46e91f354c58ecec864614157d7

    SHA1

    cb6f85c0b716b4fc3810deb3eb9053beb07e803c

    SHA256

    465a7ddfb3a0da4c3965daf2ad6ac7548513f42329b58aebc337311c10ea0a6f

    SHA512

    287756078aa08130907bd8601b957e9e006cef9f5c6765df25cfaa64ddd0fff7d92ffa11f10a00a4028687f3220efda8c64008dbcf205bedae5da296e3896e91

    Download Submit

  • C:\Program Files\ExplorerPatcher\ep_gui.dll
    Filesize

    734KB

    MD5

    81cd6d96f81b1e54aa327a4af6bcbe85

    SHA1

    b786c4bde03d1566b1b040eb8970b82f7b80a007

    SHA256

    b23bab1f5dc85c9e10145eeb32214d6cfe02fb5abcf956a37a3c9dd7e09fee67

    SHA512

    a1360b71ba11b529bd21f8c93c6ceec01c4faa9d33ca5e5fa62acb118cebf1e9e1d38ea17d236d1f8bd0d790f6b743329d41598d5a62c794b4786c14975782be

    Download Submit

  • C:\Program Files\ExplorerPatcher\ep_weather_host.dll
    Filesize

    238KB

    MD5

    aac2857727cff3cd7b291f9500196f73

    SHA1

    c86eedff45b672df58885f12e7a7aee3398c618b

    SHA256

    78ed3e3676d97c337fef071b522805f4cf742587a40f96af4aa4d74fee0af88a

    SHA512

    a4c54b4221b1745fe1de6d53fcd7a528b4bacda6b2c66e02d55bd5867d118e042a35490e45b64c2d24398a9ac06e356bf10a2822f83663d52c1a28e10f0a52e5

    Download Submit

  • C:\Program Files\ExplorerPatcher\ep_weather_host_stub.dll
    Filesize

    109KB

    MD5

    e477912c435db101603781dcc44289e1

    SHA1

    7b2eda1b6055e8874f37fb9b48bcc933bf69c1c3

    SHA256

    0930d2e71353a411d96dc4dfdd473dace98d1b7b9546ac4c185f8984f8b9c18b

    SHA512

    9f8089742099a789387381980ec5b493deec46bd73f39cf8fa9919be4dd772b20c70246e5e90d625011f052d5c3b2000b42c50843956d74fb85ff1b1d18eace9

    Download Submit

  • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ExplorerPatcher\Properties (ExplorerPatcher).lnk
    Filesize

    1KB

    MD5

    529b102ab425f25dda621fb5b5340881

    SHA1

    7091c78e6d9c480a5b178f0976c8dc6f87b1fa82

    SHA256

    d1df5ea82ee910e7296605b30e0fa2a353745871319ebff97648f653c6b34037

    SHA512

    54a5c579e06652f355d89702872318eb656fa12910977b52f25195e1665edd80e2c8973973994aa77a603839262bbfdf47f8ae941dd81a04181cb9312bce2d45

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
    Filesize

    14KB

    MD5

    6cef141907053593031fefe2e2404fe8

    SHA1

    fc830687d61e9f77c9a8d46ea3ca6d806e57f767

    SHA256

    24c8e5bc3277e9edf722fbb68cbc23ad2f20f2ebe5a2faad231998e954cd18e5

    SHA512

    cc657c12578e8a359bfe0d08ee3582549e39dff8decd188a5b22532887db3b21a81eea68c770abddaa993294c6b1a7b0256ac65ab5869b63912c9c2231ed02d4

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
    Filesize

    14KB

    MD5

    d812162850ed956bd2918d5df08c21f2

    SHA1

    6fe0f195baf8e5f7a3098004a0e118af98dcd24e

    SHA256

    b82d6b256a1912c0fc347bfc0912151c65e7705063fb264d518f84695ea8aca1

    SHA512

    0abcd7eefd1d73cd60ba3be78e2fe7fb02d0bf234d3fc6772f54778fb8dff76abcccd329b6fe7fd078c75037975d8b37d1e8459f465da5817603097d0e0a0e87

    Download Submit

  • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\SLUK5XI7\www.bing[1].xml
    Filesize

    3KB

    MD5

    348c54e634bf90a381c7a5885f36f0db

    SHA1

    17a6735ad5db29058a739bf3ec7eee8203088df4

    SHA256

    16d35ec461e64287cc4b4d362751b08c44e71fcd07398b2c47025dd8e03517d5

    SHA512

    fa52baeb3121972b885e84dde45643b449cdf9c957f2952a1cb159c45f5afb97330a9fc49bc3f04208d0c1fea8b43f3e3305223fc229f73f2e12fe62fc37112e

    Download Submit

  • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\SLUK5XI7\www.bing[1].xml
    Filesize

    326B

    MD5

    535e49a9af6d735178ccae51a537a4e5

    SHA1

    f3ed6199b0c3603e15d5fc690e874045903a48e3

    SHA256

    e88fdaf158e05db4569501eb90a4b547cf92987fe7f03892bed3bb060a0ade6d

    SHA512

    c4fc44e5de557cb6a7fd9acb809822e849e2363b1b330d4e5008d67cc280f3420c04ae0fb3025cd060960725235524a59d6cd826855748403cea50e31108184c

    Download Submit

  • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\SLUK5XI7\www.bing[1].xml
    Filesize

    1KB

    MD5

    629337629c226b01bc41f6a51cbd1bbe

    SHA1

    2fa6a78269016c3df2c0081745e476e224b75783

    SHA256

    bdc0afc8c5fb93d26714e00881e60d8f18ece27e52e7c46a69013bed89cad674

    SHA512

    01eb352b143d644c75ae17e217bd14e814396fb8c6d9887c427abbef54857281109bd27165ec0b1a40799746fd1b46c895ebfbf0853d062e5d376c44f9a7e963

    Download Submit

  • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133763890430551371.txt
    Filesize

    68KB

    MD5

    c49501de1bbb5093472658120120f742

    SHA1

    253193982c9e3cbd30d9c231b84fae9e3aa7656b

    SHA256

    76e3307ba0fa4f4596e91263f76833acf7e4d84fbad76898cf549d41d831d7eb

    SHA512

    a3f1dd3e4772c69e8681988f21faf6c31a3b182a1fbf0c0b0cd2d5f16566f3b6f2d233cda59b8e5659ee2c8457b3b28c2b83b4ff906c48b7fcda75038b7ec9dd

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\eptA0D9.tmp
    Filesize

    19KB

    MD5

    cd9dbd3f5ec5814a4f1fa6542be9352e

    SHA1

    04e8e94d40cd784a7e75bc52305c879b0f6e367b

    SHA256

    7ecd4088669a573db2c9f5d6d3d0a75f65d6271481cbdc195f12c4a88e01c733

    SHA512

    920b31ac1f11f59bc3191a64734a02801a1e5a0311663037e2f0c0e7918e9fd9e1e79d6fb8affee21b50b400f0f137e183f8e010782dec351d4b437a7103451e

    Download Submit

  • C:\Users\Admin\AppData\Roaming\ExplorerPatcher\StartDocked.pdb
    Filesize

    16.4MB

    MD5

    2e3682c2244b6604851b0d6b3eb7b248

    SHA1

    047c762af86b37f582573d3a88b68ab1ab8dbab3

    SHA256

    9ac8bf7c0a79fe47bea4ca8d364aa3e7b3f92b02a27507d704528b89e7e0e776

    SHA512

    834bec41cfb5cac51e3cad91d21327581a1180df98ce5cbe1a04ae8c5a5c793a0ac49b95dfa309162d653fc8d174b4c7f38c7f1f02d3e0907582b8f5d2ec6c87

    Download Submit

  • C:\Users\Admin\AppData\Roaming\ExplorerPatcher\StartUI.pdb
    Filesize

    34.0MB

    MD5

    8f9851f27ceebbbe2799bba2b19b3915

    SHA1

    841821920991665b6fd00952091a0501a180cd20

    SHA256

    095ad9d4d095282aa10038b86be989e543da3a547e07142ceab6f955c155b9cf

    SHA512

    9c02eca9dddda6dcb84c6ce9ffab631a4980ae25c10f2853cc124d91b099b669af508db271f02576bbf918cbf3c07e10b963c6a1a8c9482f29ca4e99258eea04

    Download Submit

  • C:\Users\Admin\AppData\Roaming\ExplorerPatcher\twinui.pcshell.pdb
    Filesize

    24.0MB

    MD5

    def29fd81caf648be9b71298bb7513d0

    SHA1

    cd3ac3f22d51dc9d949409fd84848c4b1d8f6bab

    SHA256

    745f3e5f484b42c4650847b82ea36ff132b228d4096f49c493a2a7b1e32d5dce

    SHA512

    937ce45ba86505225e272b9ab8f1628722a8d70e523253758d6bdf8d531e279a256da3c9682aa63826c7ff0d41340bd936e88f066ba6b6c87d73370eda6ab889

    Download Submit

  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\dxgi.dll
    Filesize

    699KB

    MD5

    8bfca71add96d3de75173d464792e2b9

    SHA1

    fe6bc3c30c26d6ce1c149b173b5d79c80102d5b9

    SHA256

    5aaa6bab20b7116b32bddba1df216f7476557bb48397e1968a49ede14e6c377d

    SHA512

    b560415727d15ceeb09e5d9e39ea2b4043848bf4239fbf5068aaac86f64b3d05d4e21eb197416db0fb4172c68f782c05aeae18ac70c27f80566040b6ba79159a

    Download Submit

  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\wincorlib.DLL
    Filesize

    164KB

    MD5

    b80816ee9fcdb1d9076b73fd929fc96b

    SHA1

    ff9a5a12dca164652419f5dee082af4a49b8a03b

    SHA256

    d63b9fc13c99000cf77d02ee6e5e84c825d02a92d87b728cb601681b5eb21671

    SHA512

    21cebca787a0fa0976b44315bf05b6eb4719306653ddbbfce41231244219bcd288cd8045980bacf21481ddabcf464c82795147db755148cc0e23167bbb874fd7

    Download Submit

  • C:\Windows\dxgi.dll
    Filesize

    699KB

    MD5

    047b192a9c703fc5a2c2764db869ff5c

    SHA1

    8c1494acc3119fbf8332ae3b6a4f854e5b4d37cb

    SHA256

    1971c57f88849b4069be06d3784e0968755c916fa1564a3f8f05610d3b02cdcc

    SHA512

    c7f80703db23611d56618a8b1b4ffff814a9264135e3846df99120c0ffc16da9d5b37c6465ac25d61d4f6e386d36b3de640c57c460098f06778c658cc19454cc

    Download Submit

  • memory/2292-50-0x00007FF720530000-0x00007FF7209F4000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/2292-39-0x00007FF720530000-0x00007FF7209F4000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/2292-36-0x00007FF720530000-0x00007FF7209F4000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/2292-32-0x00007FF720530000-0x00007FF7209F4000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/2292-43-0x00007FF720530000-0x00007FF7209F4000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/2292-46-0x00007FF720530000-0x00007FF7209F4000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/2292-45-0x00007FF720530000-0x00007FF7209F4000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/2292-44-0x00007FF720530000-0x00007FF7209F4000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/2292-42-0x00007FF720530000-0x00007FF7209F4000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/2292-41-0x00007FF720530000-0x00007FF7209F4000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/2292-51-0x00007FF720530000-0x00007FF7209F4000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/2292-53-0x00007FF720530000-0x00007FF7209F4000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/2292-52-0x00007FF720530000-0x00007FF7209F4000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/2292-49-0x00007FFA5A3F0000-0x00007FFA5A9BB000-memory.dmp

    Filesize

    5.8MB

    Download

  • memory/2292-35-0x00007FF720530000-0x00007FF7209F4000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/2292-60-0x00007FF720530000-0x00007FF7209F4000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/2292-54-0x00007FFA5B150000-0x00007FFA5B983000-memory.dmp

    Filesize

    8.2MB

    Download

  • memory/2292-56-0x00007FFA70100000-0x00007FFA708AE000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/2292-59-0x00007FF720530000-0x00007FF7209F4000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/2292-48-0x00007FF720530000-0x00007FF7209F4000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/2292-47-0x00007FF720530000-0x00007FF7209F4000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/2292-40-0x00007FF720530000-0x00007FF7209F4000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/2292-38-0x00007FF720530000-0x00007FF7209F4000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/2292-34-0x00007FF720530000-0x00007FF7209F4000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/2292-37-0x00007FF720530000-0x00007FF7209F4000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/2292-83-0x0000000004010000-0x0000000004011000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2292-24-0x00007FFA59890000-0x00007FFA59B01000-memory.dmp

    Filesize

    2.4MB

    Download

  • memory/2292-28-0x00007FFA59890000-0x00007FFA59B01000-memory.dmp

    Filesize

    2.4MB

    Download

  • memory/2292-29-0x00007FFA59890000-0x00007FFA59B01000-memory.dmp

    Filesize

    2.4MB

    Download

  • memory/2292-22-0x00007FFA70100000-0x00007FFA708AE000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/2292-252-0x00000000045B0000-0x00000000045B9000-memory.dmp

    Filesize

    36KB

    Download

  • memory/2292-33-0x00007FF720530000-0x00007FF7209F4000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/2292-27-0x00007FFA59890000-0x00007FFA59B01000-memory.dmp

    Filesize

    2.4MB

    Download

  • memory/2292-26-0x00007FFA59890000-0x00007FFA59B01000-memory.dmp

    Filesize

    2.4MB

    Download

  • memory/2292-31-0x00007FF720530000-0x00007FF7209F4000-memory.dmp

    Filesize

    4.8MB

    Download

  • memory/2292-30-0x00007FFA70A50000-0x00007FFA70BFC000-memory.dmp

    Filesize

    1.7MB

    Download

  • memory/2292-23-0x00007FFA70100000-0x00007FFA708AE000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/2292-25-0x00007FFA59890000-0x00007FFA59B01000-memory.dmp

    Filesize

    2.4MB

    Download

  • memory/4016-501-0x0000027A62D50000-0x0000027A62E50000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/4016-320-0x0000027A60700000-0x0000027A60800000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/4016-1184-0x0000027A60530000-0x0000027A60550000-memory.dmp

    Filesize

    128KB

    Download

  • memory/4016-308-0x0000027A5CB30000-0x0000027A5CC30000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/4016-232-0x0000027A5CE50000-0x0000027A5CE70000-memory.dmp

    Filesize

    128KB

    Download

  • memory/4016-231-0x0000027A5D010000-0x0000027A5D110000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/4016-230-0x0000027A5C220000-0x0000027A5C240000-memory.dmp

    Filesize

    128KB

    Download

  • memory/4016-187-0x0000027A5CCF0000-0x0000027A5CDF0000-memory.dmp

    Filesize

    1024KB

    Download