Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

0ee3386607...db.exe

windows7-x64

10

0ee3386607...db.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    20/11/2024, 20:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0ee33866076c29d41e0e4c3fac9e2641bac31d82247723adbe8c271a5b5a32db.exe

  • Size

    52KB

  • MD5

    e51e107f9ee3de6202449d7ff315dcac

  • SHA1

    40eec8327696857e7f28a3e22346a76e00306a10

  • SHA256

    0ee33866076c29d41e0e4c3fac9e2641bac31d82247723adbe8c271a5b5a32db

  • SHA512

    8e493bc5c338b1be8b92c243f3172e8a9b9a48df46fc8517bca7c2ce3485fbe148bafaeb51e9a00fec4647c980ebdf1952e879b6a5d6cd9a5eabe30c04de4d10

  • SSDEEP

    768:d+ciLamXW9XgMxjFkpvMVX8q18q13yO1oj5n/wpkfw:IzaEW5gMxZVXf8a3yO1opwF

Score
10/10
discoveryevasionpersistencetrojan

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 10 IoCs
    persistence
  • Modifies visibility of file extensions in Explorer 2 TTPs 5 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 5 IoCs
    evasion
  • Windows security bypass 2 TTPs 25 IoCs
    evasiontrojan
  • Blocks application from running via registry modification 30 IoCs

    Adds application to list of disallowed applications.

    evasion
  • Disables RegEdit via registry modification 10 IoCs
    evasion
  • Disables use of System Restore points 1 TTPs
    evasion
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 10 IoCs
    persistence
  • Executes dropped EXE 20 IoCs
  • Loads dropped DLL 28 IoCs
  • Modifies system executable filetype association 2 TTPs 62 IoCs
    persistence
  • Windows security modification 2 TTPs 30 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 15 IoCs
    persistence
  • Drops desktop.ini file(s) 6 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 32 IoCs
  • Drops file in Windows directory 20 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 45 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 4 IoCs
  • Suspicious use of SetWindowsHookEx 21 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 35 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\0ee33866076c29d41e0e4c3fac9e2641bac31d82247723adbe8c271a5b5a32db.exe
    "C:\Users\Admin\AppData\Local\Temp\0ee33866076c29d41e0e4c3fac9e2641bac31d82247723adbe8c271a5b5a32db.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of file extensions in Explorer
    • Modifies visiblity of hidden/system files in Explorer
    • Windows security bypass
    • Blocks application from running via registry modification
    • Disables RegEdit via registry modification
    • Event Triggered Execution: Image File Execution Options Injection
    • Loads dropped DLL
    • Modifies system executable filetype association
    • Windows security modification
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies Internet Explorer settings
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2348
    • C:\Windows\nEwb0Rn.exe
      C:\Windows\nEwb0Rn.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Blocks application from running via registry modification
      • Disables RegEdit via registry modification
      • Event Triggered Execution: Image File Execution Options Injection
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Windows security modification
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:3012
      • C:\Windows\nEwb0Rn.exe
        C:\Windows\nEwb0Rn.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2928
      • C:\Windows\SysWOW64\WishfulThinking.exe
        C:\Windows\system32\WishfulThinking.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1312
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2268
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1532
    • C:\Windows\SysWOW64\WishfulThinking.exe
      C:\Windows\system32\WishfulThinking.exe
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Blocks application from running via registry modification
      • Disables RegEdit via registry modification
      • Event Triggered Execution: Image File Execution Options Injection
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Windows security modification
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2740
      • C:\Windows\nEwb0Rn.exe
        C:\Windows\nEwb0Rn.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2872
      • C:\Windows\SysWOW64\WishfulThinking.exe
        C:\Windows\system32\WishfulThinking.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1648
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1364
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2168
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Blocks application from running via registry modification
      • Disables RegEdit via registry modification
      • Event Triggered Execution: Image File Execution Options Injection
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Windows security modification
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2744
      • C:\Windows\nEwb0Rn.exe
        C:\Windows\nEwb0Rn.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1524
      • C:\Windows\SysWOW64\WishfulThinking.exe
        C:\Windows\system32\WishfulThinking.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1680
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2336
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:880
    • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
      "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies visibility of file extensions in Explorer
      • Modifies visiblity of hidden/system files in Explorer
      • Windows security bypass
      • Blocks application from running via registry modification
      • Disables RegEdit via registry modification
      • Event Triggered Execution: Image File Execution Options Injection
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies system executable filetype association
      • Windows security modification
      • Adds Run key to start application
      • Enumerates connected drives
      • Drops file in System32 directory
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Modifies Control Panel
      • Modifies Internet Explorer settings
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2592
      • C:\Windows\nEwb0Rn.exe
        C:\Windows\nEwb0Rn.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2660
      • C:\Windows\SysWOW64\WishfulThinking.exe
        C:\Windows\system32\WishfulThinking.exe
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2000
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\WINLOGON.EXE"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2824
      • C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE
        "C:\Users\Admin\Local Settings\Application Data\WINDOWS\SERVICES.EXE"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:2620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Event Triggered Execution

2
T1546

Change Default File Association

1
T1546.001

Image File Execution Options Injection

1
T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Winlogon Helper DLL

1
T1547.004

Event Triggered Execution

2
T1546

Change Default File Association

1
T1546.001

Image File Execution Options Injection

1
T1546.012

Defense Evasion

Hide Artifacts

2
T1564

Hidden Files and Directories

2
T1564.001

Impair Defenses

2
T1562

Disable or Modify Tools

2
T1562.001

Modify Registry

9
T1112

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

1
T1490

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    52KB

    MD5

    ab7a195766b96742dab7090f8ba26ca9

    SHA1

    92ee910a44b2bf8979bf5a5a76c75cbe72cd267b

    SHA256

    e4eafdad06ea0516bc6b95127270fd416fc4ba2a45a4ecf1477ef13549bb9ce4

    SHA512

    76d04f356002523fae8225101a31c7aaf2a85ea30cb39f110b00de323f0ee5ef444d85d0ef369566a220ea695f40c07781243c213e1c96b2659d3a56d8aaa32c

    Download Submit

  • C:\Users\All Users\Start Menu\Programs\Startup\Empty.pif
    Filesize

    52KB

    MD5

    f186d31ecf98e4facf37651babb12604

    SHA1

    781c65b7baabfe1e1e01c38407eed5b38fc65f69

    SHA256

    3dd1b47dd95350a891906a22913dcfd6dd2dcf1c1a297b6b5321c1d66eed9c2c

    SHA512

    1342130479d147743b863c6500b6277eb53d70072cb69ee73b1d88502d4dfd8f960ffb2924bf23d243ead7ec27f2de8d1b4d55b5226ce96a7f7cad75aa277065

    Download Submit

  • C:\Windows\MSVBVM60.DLL
    Filesize

    1.3MB

    MD5

    5343a19c618bc515ceb1695586c6c137

    SHA1

    4dedae8cbde066f31c8e6b52c0baa3f8b1117742

    SHA256

    2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

    SHA512

    708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

    Download Submit

  • C:\Windows\SysWOW64\DamageControl.scr
    Filesize

    52KB

    MD5

    37fc1ad05be52d30764b03363bc2a441

    SHA1

    c2b8b3a7bfc51f9ffc830b3955c4886c5a29b994

    SHA256

    9abe2773d897cb981ca16549d2ed44848b68854499f5135a5356308d942b2628

    SHA512

    249f7d3603d3db9a5086b2ef6688f0c7554940dcf49e637e9526a14d3ffbeacd1e8f787d86f8a7ae4707a393f6bb0367efe4a3bdb8d99fb52232af2db8b1e39a

    Download Submit

  • C:\Windows\SysWOW64\DamageControl.scr
    Filesize

    52KB

    MD5

    e51e107f9ee3de6202449d7ff315dcac

    SHA1

    40eec8327696857e7f28a3e22346a76e00306a10

    SHA256

    0ee33866076c29d41e0e4c3fac9e2641bac31d82247723adbe8c271a5b5a32db

    SHA512

    8e493bc5c338b1be8b92c243f3172e8a9b9a48df46fc8517bca7c2ce3485fbe148bafaeb51e9a00fec4647c980ebdf1952e879b6a5d6cd9a5eabe30c04de4d10

    Download Submit

  • C:\Windows\SysWOW64\JawsOfLife.exe
    Filesize

    52KB

    MD5

    0903b356970833cb3ed934927a067feb

    SHA1

    105437ee42ce0ebffb138525a9621b1a16292e6b

    SHA256

    5ae0f7ce9e924ec18ffd23265b269802d70405f8cced50ec9e2d6e2d34551be4

    SHA512

    65cd06afc9d8f1e281638bc6d737da86f1b0c34d5919f6ecf8a317790d79be063a6a741abfa4ec6d96a7b7acf9b10ce497b8e091911e1a8c1ca0d041af47fc12

    Download Submit

  • C:\Windows\SysWOW64\JawsOfLife.exe
    Filesize

    52KB

    MD5

    fa02385d6788592c78a0cee422513652

    SHA1

    9ee784cd351872147ce19d464b4bf9880fc0803a

    SHA256

    43148aa4fd4f1d3f066dfdf90261b9728c6dbdff9a828fcc812346205d192c46

    SHA512

    a2df500687a31d3f76d33f3f043171abc9b44303198aa85907d0326286d85fd8387ba948c1ee2359daaf3eaf245181d4301323cef16a50b5ce21886d2a10db3e

    Download Submit

  • C:\Windows\nEwb0Rn.exe
    Filesize

    52KB

    MD5

    89c9cf3f99b06133465bb6a4717b437a

    SHA1

    73c4ce8e1ae0d27ea3c30e84f327368c6ba0995a

    SHA256

    584dd160eaac5e80939018e4860cdfb42251af95e827ff82d60677403b8e8c31

    SHA512

    cd89c12d03bec94b80f58628f1868b1115dbe1e8a64d475cdc3d43f9b59b555ad45f8b0e82e753cc4687f6e21872b2534a4a743d88ff1d49b3c875aa096f8fbe

    Download Submit

  • C:\about.htm
    Filesize

    2KB

    MD5

    94c0c5518c4f4bb044842a006d04932a

    SHA1

    23d9a914f6681d65e2b1faa171f4cf492562ebdb

    SHA256

    224c4e5cdc0e7495c5fb5d1f52d76807092b5cc2d0a7c95fa612ff7b1412706e

    SHA512

    79cb2cd9e19ac3cc8bd94f1a20369e61224f8db02bc04d1f5768d62163b68467a3d317808a942bc7cca6ca84c221bb54a76e097f543c88bb89f0a3c9534ff3bb

    Download Submit

  • C:\nEwb0Rn.exe
    Filesize

    52KB

    MD5

    d3ab5a736dfc354c54760a95f5865fb7

    SHA1

    52be5f7dae3ea2a070d123cf8ef2831230f92379

    SHA256

    b7f2d15268d5dd0c7dc790bfdcca9d5dd16937912d17d114a8b014769e189915

    SHA512

    4b66939d21c4c82f6b6e236ce24afb7a4335273f5eaea62d2057445b1e54a674d8717d94f1df0b325aee88ab74e8752f684ceac1840409f49acb1bfa93545aab

    Download Submit

  • C:\nEwb0Rn.exe
    Filesize

    52KB

    MD5

    fec41575687d9dfef803ba0ab1d99351

    SHA1

    62041a1e7836144d6603b2dbce13e851a043a26f

    SHA256

    267a23cf8c1fb9b7a016c0b98271183c421af91e1185f3c45e06553495421092

    SHA512

    85c3e01fb59072a965fa8ec6995b52788a97a0731e79681e56694f100be82de965bea3541984df737c7665fb3bf90f5a909431f5d3954caada07ea05bf815950

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\SERVICES.EXE
    Filesize

    52KB

    MD5

    50b42869259ee6731268b1eac22dc09e

    SHA1

    6b16e9e40eb84726a56ef248256b381cd9f10f56

    SHA256

    69e4b110d2d55ead9852963f99edd252207af960f52ff944e2fecd173d527bb5

    SHA512

    7182941264e6f9d7ef4f67380c9e92a727c5383ad8551ce9bee1cce90905ddb3b6ca6c16931940f9d2b371256a4a2eb50ddc00bcf209fb9fa4d91433ff50c9a5

    Download Submit

  • \Users\Admin\AppData\Local\WINDOWS\WINLOGON.EXE
    Filesize

    52KB

    MD5

    3eabb590994568471ba6562826fc8b51

    SHA1

    9a1ca50238c4ac7dc84ae89c77e96e084f7a5ef0

    SHA256

    ab0bb9182e569b5f1d798662e62fb61f8c5eb774778374b263bae76cf03dc32d

    SHA512

    85d80901388ef9c5222147881da90423268e3a0c1e9aa469f5439ccec1456d2652288e02e214d9a0ae714a364013130d5188cc6db569748fd594560b3925da4b

    Download Submit

  • \Windows\SysWOW64\WishfulThinking.exe
    Filesize

    52KB

    MD5

    be95d3407b4dcb93da5e09565133d9f0

    SHA1

    ef95e04a3877263816e60868e4e8cb6cf823a25b

    SHA256

    cfd1dc93880715ee3865fd8e60788c60c3fa33601dbca86526ea6290bc2b1193

    SHA512

    940294b5415da239872647f698fb73337e66035d5a02b1575d3ea9da38b2d8e0e0c4bd6d3aecb09bb9926c00db8444c982e6b458f48ec66ebeba43f48ee21a0f

    Download Submit

  • memory/880-406-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/1312-226-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/1364-317-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/1364-319-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/1524-281-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/1524-279-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/1532-312-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/1648-278-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/1680-280-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/1680-300-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2000-353-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2168-363-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2168-409-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2268-274-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2268-228-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2336-306-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2336-314-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2348-108-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2348-87-0x0000000002780000-0x00000000027A8000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2348-74-0x0000000002780000-0x00000000027A8000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2348-88-0x0000000002780000-0x00000000027A8000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2348-97-0x0000000002780000-0x00000000027A8000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2348-109-0x0000000002780000-0x00000000027A8000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2348-117-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2348-0-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2592-422-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2592-222-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2620-417-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2660-327-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2660-328-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2740-193-0x00000000024E0000-0x0000000002508000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2740-420-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2740-285-0x00000000024E0000-0x0000000002508000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2740-165-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2740-90-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2740-192-0x00000000024E0000-0x0000000002508000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2740-316-0x00000000024E0000-0x0000000002508000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2740-418-0x00000000024E0000-0x0000000002508000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2744-246-0x0000000000580000-0x00000000005A8000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2744-407-0x0000000000580000-0x00000000005A8000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2744-103-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2744-308-0x0000000000580000-0x00000000005A8000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2744-315-0x0000000000580000-0x00000000005A8000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2744-307-0x0000000000580000-0x00000000005A8000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2744-421-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2744-297-0x0000000000580000-0x00000000005A8000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2744-195-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2824-413-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2872-210-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2872-209-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/2928-168-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/2928-167-0x0000000072940000-0x0000000072A93000-memory.dmp

    Filesize

    1.3MB

    Download

  • memory/3012-244-0x0000000002690000-0x00000000026B8000-memory.dmp

    Filesize

    160KB

    Download

  • memory/3012-223-0x0000000002690000-0x00000000026B8000-memory.dmp

    Filesize

    160KB

    Download

  • memory/3012-333-0x0000000002690000-0x00000000026B8000-memory.dmp

    Filesize

    160KB

    Download

  • memory/3012-243-0x0000000002690000-0x00000000026B8000-memory.dmp

    Filesize

    160KB

    Download

  • memory/3012-287-0x0000000002690000-0x00000000026B8000-memory.dmp

    Filesize

    160KB

    Download

  • memory/3012-164-0x0000000002690000-0x00000000026B8000-memory.dmp

    Filesize

    160KB

    Download

  • memory/3012-151-0x0000000002690000-0x00000000026B8000-memory.dmp

    Filesize

    160KB

    Download

  • memory/3012-152-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download

  • memory/3012-286-0x0000000002690000-0x00000000026B8000-memory.dmp

    Filesize

    160KB

    Download

  • memory/3012-334-0x0000000002690000-0x00000000026B8000-memory.dmp

    Filesize

    160KB

    Download

  • memory/3012-419-0x0000000000400000-0x0000000000428000-memory.dmp

    Filesize

    160KB

    Download