Overview

overview

10

Static

static

3

ad79445854...18.exe

windows7-x64

7

ad79445854...18.exe

windows10-2004-x64

10

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

8

Norby.ps1

windows7-x64

3

Norby.ps1

windows10-2004-x64

8

Analysis

  • max time kernel
    110s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250207-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/02/2025, 04:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Norby.ps1

  • Size

    52KB

  • MD5

    237cdf672782754d57c42a5b82371b98

  • SHA1

    6fe41a22c98e07b85ceb25b0870c539fe969197d

  • SHA256

    26c1ca3a25a867de4b6c580a67c25f0b772a8d0d1ee9bb87facf3daa741cac57

  • SHA512

    c97e1a229e3280c591b0bc76ea6850e8c5ee90420eea1d09a9a5f1effd264d06c8ce4aae166d43de00f1fc68422f277809cd899e33fee505d9be116efa8a0ce9

  • SSDEEP

    1536:80FHbCINgp4KZE6oMXF7BaHqljyJuamYN:HHbClpBZagu3N

Score
8/10
discoveryexecutionpersistence

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 12 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file 1 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Norby.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3132
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3256
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4324
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3504
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4940
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1212
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3280
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:548
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1216
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:372
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MTY2NUIyNkMtRDEyMi00NTQyLUFDMzAtMjhGNEIzRUVEN0FEfSIgdXNlcmlkPSJ7MTkwQjQ0OTctRjU3QS00OUJGLTkzN0ItQjQ5RkFCMUU1MjNCfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7RUMzNzEzOTEtOERENi00NzQ5LTlFNEMtNTMxQ0FEOUFCNzc3fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDY4ODkiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxOTM2NTgwOTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MDE3NDgxNDc5Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
    1⤵
    • System Location Discovery: System Language Discovery
    • System Network Configuration Discovery: Internet Connection Discovery
    PID:4088
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:1176
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1856
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3296
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4388
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4832
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4268
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1128
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4032
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4064
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:1444
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2824
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:212
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1732
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3964
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:1820
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2056
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1328
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3732
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
      PID:3980
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
        PID:3264
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:4076
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:4780
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:1012
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:2804
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:3908
                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                  1⤵
                    PID:3912
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:1012
                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                      1⤵
                        PID:1752

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                        Filesize

                        2KB

                        MD5

                        1f91f8d48855a85a8c0f9fcfd4ca01a3

                        SHA1

                        16d317e1f1d3b270f6a2b0712dfc13d36486e62f

                        SHA256

                        41eb5252dcd8dbbe8c4ed2654afcdc31cf2a5dcd7f99079d11a5dba2473c68cf

                        SHA512

                        ec9dcea05d46043b16dbecbc8ed135e40e1e88c58df07d07cec960986d509a2304960212129b90b5971cbcd5d245c5ed5d7dffc87b83269e4583843f18c8b9c2

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133835766808536140.txt
                        Filesize

                        74KB

                        MD5

                        1927574b0cc8a5c0bba384fd4be1b4ae

                        SHA1

                        a1477f3e5f5e2c345789ebb573b6cd243f3325d7

                        SHA256

                        30bb255431daac1d2b55fb9ab47edd755a045440a0ea14689f46867f0a5e3a31

                        SHA512

                        ee98cdfd9f8065fedd16e8a60e1f908d426e7c017a9be2938376e4028a8f381a9e58de7e3b64df49d0a3fc7efdf7896793689a11a7721f6843ed7261aa847b56

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\Q9TOUWWH\microsoft.windows[1].xml
                        Filesize

                        97B

                        MD5

                        67f39fda911dc3ce09b14821c5bbc4a1

                        SHA1

                        a54854a18bea2857edbd4d2405960973e553aa7c

                        SHA256

                        9751b6f4e9629f5016b77123770c540659be2bfaf4499b3275de6b7510a1a82d

                        SHA512

                        10e1667bbb85a03f8e6373c74870e67ed03b34c435e558a9480807c8c657b83947a2e95ca2d4af0d05384529fd49d2ef061d7f36e5fc0f686fd86320a33a19f2

                        Download Submit

                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mmf4u53s.1pv.ps1
                        Filesize

                        60B

                        MD5

                        d17fe0a3f47be24a6453e9ef58c94641

                        SHA1

                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                        SHA256

                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                        SHA512

                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                        Download Submit

                      • memory/212-345-0x00000000029A0000-0x00000000029A1000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/372-35-0x0000021EC1B10000-0x0000021EC1B30000-memory.dmp

                        Filesize

                        128KB

                        Download

                      • memory/372-36-0x0000021EC1AD0000-0x0000021EC1AF0000-memory.dmp

                        Filesize

                        128KB

                        Download

                      • memory/372-45-0x0000021EC20E0000-0x0000021EC2100000-memory.dmp

                        Filesize

                        128KB

                        Download

                      • memory/372-31-0x0000021EC0C00000-0x0000021EC0D00000-memory.dmp

                        Filesize

                        1024KB

                        Download

                      • memory/372-30-0x0000021EC0C00000-0x0000021EC0D00000-memory.dmp

                        Filesize

                        1024KB

                        Download

                      • memory/548-29-0x0000000003440000-0x0000000003441000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/1328-491-0x0000020D66740000-0x0000020D66840000-memory.dmp

                        Filesize

                        1024KB

                        Download

                      • memory/1328-492-0x0000020D66740000-0x0000020D66840000-memory.dmp

                        Filesize

                        1024KB

                        Download

                      • memory/1328-496-0x0000020D676A0000-0x0000020D676C0000-memory.dmp

                        Filesize

                        128KB

                        Download

                      • memory/1328-508-0x0000020D67660000-0x0000020D67680000-memory.dmp

                        Filesize

                        128KB

                        Download

                      • memory/1328-525-0x0000020D67C80000-0x0000020D67CA0000-memory.dmp

                        Filesize

                        128KB

                        Download

                      • memory/1444-202-0x0000000004110000-0x0000000004111000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/1820-489-0x0000000002D00000-0x0000000002D01000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/2804-635-0x0000000004E10000-0x0000000004E11000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/3132-14-0x00007FFEB91A0000-0x00007FFEB9C61000-memory.dmp

                        Filesize

                        10.8MB

                        Download

                      • memory/3132-17-0x000001787DF90000-0x000001787DFB4000-memory.dmp

                        Filesize

                        144KB

                        Download

                      • memory/3132-21-0x00007FFEB91A0000-0x00007FFEB9C61000-memory.dmp

                        Filesize

                        10.8MB

                        Download

                      • memory/3132-13-0x00007FFEB91A0000-0x00007FFEB9C61000-memory.dmp

                        Filesize

                        10.8MB

                        Download

                      • memory/3132-0-0x00007FFEB91A3000-0x00007FFEB91A5000-memory.dmp

                        Filesize

                        8KB

                        Download

                      • memory/3132-12-0x00007FFEB91A0000-0x00007FFEB9C61000-memory.dmp

                        Filesize

                        10.8MB

                        Download

                      • memory/3132-15-0x00007FFEB91A0000-0x00007FFEB9C61000-memory.dmp

                        Filesize

                        10.8MB

                        Download

                      • memory/3132-20-0x00007FFEB91A0000-0x00007FFEB9C61000-memory.dmp

                        Filesize

                        10.8MB

                        Download

                      • memory/3132-11-0x00007FFEB91A0000-0x00007FFEB9C61000-memory.dmp

                        Filesize

                        10.8MB

                        Download

                      • memory/3132-10-0x000001787DDC0000-0x000001787DDE2000-memory.dmp

                        Filesize

                        136KB

                        Download

                      • memory/3132-19-0x00007FFEB91A0000-0x00007FFEB9C61000-memory.dmp

                        Filesize

                        10.8MB

                        Download

                      • memory/3132-16-0x000001787DF90000-0x000001787DFBA000-memory.dmp

                        Filesize

                        168KB

                        Download

                      • memory/3912-638-0x0000018FF6100000-0x0000018FF6200000-memory.dmp

                        Filesize

                        1024KB

                        Download

                      • memory/3912-641-0x0000018FF7260000-0x0000018FF7280000-memory.dmp

                        Filesize

                        128KB

                        Download

                      • memory/3912-664-0x0000018FF7630000-0x0000018FF7650000-memory.dmp

                        Filesize

                        128KB

                        Download

                      • memory/3912-653-0x0000018FF7220000-0x0000018FF7240000-memory.dmp

                        Filesize

                        128KB

                        Download

                      • memory/3964-366-0x000001F3DF8D0000-0x000001F3DF8F0000-memory.dmp

                        Filesize

                        128KB

                        Download

                      • memory/3964-381-0x000001F3DFEE0000-0x000001F3DFF00000-memory.dmp

                        Filesize

                        128KB

                        Download

                      • memory/3964-352-0x000001F3DF910000-0x000001F3DF930000-memory.dmp

                        Filesize

                        128KB

                        Download

                      • memory/3964-348-0x000001F3DEA00000-0x000001F3DEB00000-memory.dmp

                        Filesize

                        1024KB

                        Download

                      • memory/3964-347-0x000001F3DEA00000-0x000001F3DEB00000-memory.dmp

                        Filesize

                        1024KB

                        Download

                      • memory/4032-221-0x0000017940340000-0x0000017940360000-memory.dmp

                        Filesize

                        128KB

                        Download

                      • memory/4032-235-0x0000017940750000-0x0000017940770000-memory.dmp

                        Filesize

                        128KB

                        Download

                      • memory/4032-208-0x0000017940380000-0x00000179403A0000-memory.dmp

                        Filesize

                        128KB

                        Download

                      • memory/4032-204-0x000001793F820000-0x000001793F920000-memory.dmp

                        Filesize

                        1024KB

                        Download

                      • memory/4032-203-0x000001793F820000-0x000001793F920000-memory.dmp

                        Filesize

                        1024KB

                        Download