Overview

overview

10

Static

static

1

Document53374pdf.exe

windows7-x64

3

Document53374pdf.exe

windows10-2004-x64

10

Bestikkels...er.ps1

windows7-x64

3

Bestikkels...er.ps1

windows10-2004-x64

8

Resubmissions

31-01-2025 17:22

250131-vxyxdasjfz 10

31-01-2025 17:06

250131-vmka8stmhq 10

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-01-2025 17:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Bestikkelsesanklager.ps1

  • Size

    51KB

  • MD5

    59b0b98cd78cde9e66a8e1195fa35be3

  • SHA1

    d9a9813e0983f69b6c11fbb7c5b2c28df207fd13

  • SHA256

    7ecd47a0c1aaf0942e55d6be3e11cf4a7e8485084de7f88d38722758fd3c7411

  • SHA512

    4478091235e926276545239847d6eab2eccc8755b05c4794eb6ba19c3afb4521cdd53dc935f9731b37d7ee3c0667b9fb997a3377f23203b40cb002392aed1e8a

  • SSDEEP

    768:qq7eNLn1vlqkLYurDEflvt2sS0+a8fiZ7ZbjBenEnTz0HyZumtsuY71jsf+FLDmu:kNme/AX2p0ftZ7FGZHyZffyy7oKDm7

Score
8/10
executionpersistence

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 11 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 20 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 20 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 21 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Bestikkelsesanklager.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3428
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4944
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:604
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4052
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2292
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1952
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:3256
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2128
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:960
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:3664
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1748
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3308
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:2024
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4228
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2528
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:1992
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3572
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    PID:2880
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:392
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4856
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:904
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3768
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1132
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:552
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4080
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1972
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1624
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4404
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1820
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4260
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:2196
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4180
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1052

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
    Filesize

    471B

    MD5

    8b2c7086fb4ac5566a019ce59ae92a2a

    SHA1

    ec6a96151fc2e25f4fcbfe7279d246c3651a6249

    SHA256

    46731e4108a4de7bc1fd51ad9eeae152ea690dcc27d0ada40ea66e29f4280189

    SHA512

    0d9d7985b345bfe8c0bba6e9cf984aa72e32853d4f3dd81063cfcd654ba3d1cb3790b57ad5efdfab779dee7b6b6589dde15dd2d3be2361d7c8ea4d327ea536e0

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
    Filesize

    412B

    MD5

    76ab2bdc1eae811ba0d76c8f850d58bf

    SHA1

    a4345dfff406823a056d1bc7fabfc710bb4e5817

    SHA256

    fc953458baa0547f1a336e345cfe1f068386426051a282f69ef0596551a495bb

    SHA512

    3f2901b6d3fc334ecc160f4215f480000cd9be27d9cfa654cc36c6d713bea582c3679fe50ba51f1e6f89eb68191d3b8b4c66aa695642fe3e513f23f7d4fb3bad

    Download Submit

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
    Filesize

    2KB

    MD5

    50c75271e47fd1001e6603c36934f03c

    SHA1

    a6726dfe5a837ada99c7960e347c0e7e138741fd

    SHA256

    35f33d3165435b7e05795f9c23fadab496bc4ececf71731565e6ed064b6d990b

    SHA512

    d05aaaf1c7878a18224d7778681a2a0af4641517eff7aebdee284fec4736d2a6006c3bda7b1896f15c3a6399b7c27109d7e29b669fe8c6beeff8eafc1427cdb1

    Download Submit

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133828168488671221.txt
    Filesize

    75KB

    MD5

    4d54c49d2f53538861d98ada2687895a

    SHA1

    89085a1d9ffac4d722c59a7e2c0ed8198361556b

    SHA256

    1493a5c9f0ebda62f58d54f90b2ac80765b4713abd9fdd951fcb0ec342f8a086

    SHA512

    232cbe04af109719c8da6af1918e5bff9db524ddccdd393367a22d3f185f75f0771dda37e980b54d135d4b59caa269c7e98cd87bfe35ff3dda32074c1fb8a052

    Download Submit

  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\M6JCG2RK\microsoft.windows[1].xml
    Filesize

    96B

    MD5

    732a32ad072ef786d816a4f85b1b6bea

    SHA1

    fe1945717c160ac3266f291564a003c044d409b0

    SHA256

    7dd2262373fcd6ebe2ed2c6e66242c85b1434c3fe23ca92ba41ae328ce8b941e

    SHA512

    55b57d5bf942f20a3557f20adeebb4c01cde4aec9d7a4fa8bfe6281fe0981773d8ce637fdbd1dc64f25abe72d75fad2a6538fadc86483ede9fdc5b59c0d36b79

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gpe3ttkr.z4v.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    Download Submit

  • memory/392-739-0x0000000004810000-0x0000000004811000-memory.dmp

    Filesize

    4KB

    Download

  • memory/552-893-0x00000263E0900000-0x00000263E0A00000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/552-898-0x0000026BE2A60000-0x0000026BE2A80000-memory.dmp

    Filesize

    128KB

    Download

  • memory/552-895-0x00000263E0900000-0x00000263E0A00000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/552-924-0x0000026BE2E30000-0x0000026BE2E50000-memory.dmp

    Filesize

    128KB

    Download

  • memory/552-910-0x0000026BE2A20000-0x0000026BE2A40000-memory.dmp

    Filesize

    128KB

    Download

  • memory/904-757-0x0000020CFCED0000-0x0000020CFCEF0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/904-747-0x0000020CFCF10000-0x0000020CFCF30000-memory.dmp

    Filesize

    128KB

    Download

  • memory/904-768-0x0000020CFD4E0000-0x0000020CFD500000-memory.dmp

    Filesize

    128KB

    Download

  • memory/960-184-0x0000021957B40000-0x0000021957C40000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/960-200-0x0000021958A60000-0x0000021958A80000-memory.dmp

    Filesize

    128KB

    Download

  • memory/960-212-0x0000021959080000-0x00000219590A0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/960-183-0x0000021957B40000-0x0000021957C40000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/960-188-0x0000021958AA0000-0x0000021958AC0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1052-1324-0x000001C2DB160000-0x000001C2DB180000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1052-1320-0x000001C2DA000000-0x000001C2DA100000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/1052-1348-0x000001C2DB520000-0x000001C2DB540000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1052-1319-0x000001C2DA000000-0x000001C2DA100000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/1052-1336-0x000001C2DB120000-0x000001C2DB140000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1624-1040-0x000001E230020000-0x000001E230120000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/1624-1043-0x000001E231170000-0x000001E231190000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1624-1052-0x000001E231130000-0x000001E231150000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1624-1064-0x000001E231540000-0x000001E231560000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1624-1039-0x000001E230020000-0x000001E230120000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/1624-1038-0x000001E230020000-0x000001E230120000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/1952-36-0x00000255383D0000-0x00000255383F0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1952-67-0x00000255387A0000-0x00000255387C0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1952-33-0x00000255373B0000-0x00000255374B0000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/1952-32-0x00000255373B0000-0x00000255374B0000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/1952-45-0x0000025538390000-0x00000255383B0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1992-600-0x0000000004150000-0x0000000004151000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2024-457-0x0000000004660000-0x0000000004661000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2528-465-0x0000029FC17C0000-0x0000029FC17E0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2528-472-0x0000029FC1780000-0x0000029FC17A0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2528-495-0x0000029FC1B90000-0x0000029FC1BB0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2880-615-0x0000029D06DB0000-0x0000029D06DD0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2880-607-0x0000029D06DF0000-0x0000029D06E10000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2880-639-0x0000029D073C0000-0x0000029D073E0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/3256-181-0x0000000004020000-0x0000000004021000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3308-342-0x00000244A8440000-0x00000244A8460000-memory.dmp

    Filesize

    128KB

    Download

  • memory/3308-353-0x00000244A8850000-0x00000244A8870000-memory.dmp

    Filesize

    128KB

    Download

  • memory/3308-315-0x00000244A7400000-0x00000244A7500000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/3308-322-0x00000244A8480000-0x00000244A84A0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/3428-17-0x0000021077E90000-0x0000021077EB4000-memory.dmp

    Filesize

    144KB

    Download

  • memory/3428-6-0x000002105EC70000-0x000002105EC92000-memory.dmp

    Filesize

    136KB

    Download

  • memory/3428-0-0x00007FFE58A43000-0x00007FFE58A45000-memory.dmp

    Filesize

    8KB

    Download

  • memory/3428-15-0x00007FFE58A40000-0x00007FFE59501000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3428-14-0x00007FFE58A40000-0x00007FFE59501000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3428-21-0x00007FFE58A40000-0x00007FFE59501000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3428-20-0x00007FFE58A40000-0x00007FFE59501000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3428-19-0x00007FFE58A40000-0x00007FFE59501000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3428-16-0x0000021077E90000-0x0000021077EBA000-memory.dmp

    Filesize

    168KB

    Download

  • memory/3428-13-0x00007FFE58A40000-0x00007FFE59501000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3428-12-0x00007FFE58A40000-0x00007FFE59501000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3428-11-0x00007FFE58A40000-0x00007FFE59501000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/3664-321-0x0000000004BA0000-0x0000000004BA1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3768-892-0x0000000004BA0000-0x0000000004BA1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4052-30-0x0000000004380000-0x0000000004381000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4080-1037-0x0000000004320000-0x0000000004321000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4260-1198-0x000002669B6A0000-0x000002669B6C0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/4260-1206-0x000002669BCC0000-0x000002669BCE0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/4260-1184-0x000002669A800000-0x000002669A900000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/4260-1188-0x000002669B6E0000-0x000002669B700000-memory.dmp

    Filesize

    128KB

    Download

  • memory/4260-1183-0x000002669A800000-0x000002669A900000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/4260-1185-0x000002669A800000-0x000002669A900000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/4404-1181-0x0000000004620000-0x0000000004621000-memory.dmp

    Filesize

    4KB

    Download