Overview

overview

10

Static

static

3

8fb01222a0...60.exe

windows7-x64

8

8fb01222a0...60.exe

windows10-2004-x64

10

Tetragynian.ps1

windows7-x64

3

Tetragynian.ps1

windows10-2004-x64

8

Analysis

  • max time kernel
    140s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250217-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/02/2025, 03:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Tetragynian.ps1

  • Size

    52KB

  • MD5

    2b6f3bbd81d1494893fdfae65f14f57d

  • SHA1

    3963fa8a7615c4ed1aa6cf77619a8cfec862ad26

  • SHA256

    e42fe8d5aa6aab594e2fee44f18005b3137deea78fb22524da60b846619ce996

  • SHA512

    d9bfc6474d5cbad220ffc8411ed7526aa60423f726dafc453c85e115994729095dd4cbcfa125f3faeaef238a89bf3ba162684961030d6873956cc2fc841ec2ae

  • SSDEEP

    1536:EikIiU3xXA2FTC4CNLcz2QLVS+QU7tZli:EikI53xwERC0lS4tZli

Score
8/10
executionpersistence

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 14 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 26 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 26 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 27 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Tetragynian.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2520
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2352
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4324
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4560
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2404
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1824
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:464
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2592
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:888
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:4104
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:736
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1700
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3472
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3988
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:740
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:3420
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4552
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1452
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:1608
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4368
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4752
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    PID:4108
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1828
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2844
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    PID:1912
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4092
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    PID:2008
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4648
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4860
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3836
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4316
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4004
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1872
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    PID:3280
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3540
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4240
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4304
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3336
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    PID:5040
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4724
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4036
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3888

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
    Filesize

    471B

    MD5

    cadcc49123af027eea7833ce768080b8

    SHA1

    f1f259d4845da1ee0307b6f10c818f96bae37293

    SHA256

    ab033385776cfb1bdce24d93575038096265ab7943182ee291514bd5caaef4f3

    SHA512

    e5ea6230cab531bbe8d09f7d5f6df789d5a63b9fab66bfb4ecc612edc2f961fb40aaa2830e65be9beff28e545aae3f2ceea357b02635ed278e4bba74818f7c5a

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
    Filesize

    412B

    MD5

    f2907e37e012713729702ca3a2430434

    SHA1

    55d30cba20316e5eba5bc21595f9376ce76ec5b2

    SHA256

    6ecb25c13e26efd49133b375053eb9fd3dda743faaf7b18fb8f9d311e7b8315d

    SHA512

    0586c1c3270af0b19629959e9b86fd04cf429ca2a2d50b2f3cf198ab7dccb9ef76b14e93dd846754701f77e1c302392a1dc550735a5422350123f3d1c887f080

    Download Submit

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
    Filesize

    2KB

    MD5

    b8fcc87734c4eb29f9a6f4cc8c7c4268

    SHA1

    20d4a8dd2a11246180bbaf6db6f7f57ae4d0ba66

    SHA256

    90204e40bb4f114e254d7e1b73fcef96c14de55e049048547cf8f6de083ba7c7

    SHA512

    7dc59e22beb5225c559aa27f933d6586f3df4a22c51053d3d518088509e24bafc8cd75b555f951f062afb05ef2efe639c7ed604614f79443aae0a93298e5a135

    Download Submit

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133851861508596009.txt
    Filesize

    75KB

    MD5

    2bd232988d7f75dfc783058c9eaeead6

    SHA1

    d4bf8dc4a9d4db791047d634b99a9832e267174d

    SHA256

    ceadf0284a648c15a5fd8201708a10f021a68d0427c998fa6b5434921f403ea5

    SHA512

    3f44dc84a15cb0339275ba6b2eba161ec8dd1fa44d31104c6b633d0370ce6d20dad24428790ca04c2610aa259bced8d077244136488e08dc0eb3f6538fa11544

    Download Submit

  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\MYYZTTZG\microsoft.windows[1].xml
    Filesize

    97B

    MD5

    b89387c272ea641caf67d5ad0ecffc95

    SHA1

    fb4359da9114895b5f245749637248d72d3911a6

    SHA256

    2617f712a03e2d115b7173bda3ad71e82ce2961d9a11603797600a866274b076

    SHA512

    23b592658e6786ddd6046e099b7ba8a2efbe28fac9b0de39c387a1ed53b9b68a435fa7c0667694f5e4a0d39f089809d5a6f7f04b972e60c65d5472451424f53c

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_p3m43mci.j4b.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    Download Submit

  • memory/464-188-0x0000000002A90000-0x0000000002A91000-memory.dmp

    Filesize

    4KB

    Download

  • memory/740-515-0x0000027AF0230000-0x0000027AF0250000-memory.dmp

    Filesize

    128KB

    Download

  • memory/740-493-0x0000027AEFE60000-0x0000027AEFE80000-memory.dmp

    Filesize

    128KB

    Download

  • memory/740-504-0x0000027AEFE20000-0x0000027AEFE40000-memory.dmp

    Filesize

    128KB

    Download

  • memory/888-227-0x000001DA0E200000-0x000001DA0E220000-memory.dmp

    Filesize

    128KB

    Download

  • memory/888-190-0x000001DA0CD00000-0x000001DA0CE00000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/888-195-0x000001DA0DE30000-0x000001DA0DE50000-memory.dmp

    Filesize

    128KB

    Download

  • memory/888-191-0x000001DA0CD00000-0x000001DA0CE00000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/888-192-0x000001DA0CD00000-0x000001DA0CE00000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/888-226-0x000001DA0DDF0000-0x000001DA0DE10000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1452-636-0x000001EEF9F00000-0x000001EEFA000000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/1452-635-0x000001EEF9F00000-0x000001EEFA000000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/1452-640-0x000001EEFADE0000-0x000001EEFAE00000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1452-652-0x000001EEFADA0000-0x000001EEFADC0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1452-663-0x000001EEFB3B0000-0x000001EEFB3D0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1608-779-0x0000000004790000-0x0000000004791000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1700-340-0x00000224FD920000-0x00000224FDA20000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/1700-339-0x00000224FD920000-0x00000224FDA20000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/1700-344-0x00000224FEA70000-0x00000224FEA90000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1700-354-0x00000224FEA30000-0x00000224FEA50000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1700-367-0x00000224FEE40000-0x00000224FEE60000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1824-44-0x000001A002FD0000-0x000001A002FF0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1824-66-0x000001A0038E0000-0x000001A003900000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1824-31-0x000001A002600000-0x000001A002700000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/1824-35-0x000001A003520000-0x000001A003540000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1872-1378-0x000001AB1E840000-0x000001AB1E860000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1872-1390-0x000001AB1E800000-0x000001AB1E820000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1872-1402-0x000001AB1EC00000-0x000001AB1EC20000-memory.dmp

    Filesize

    128KB

    Download

  • memory/1872-1374-0x000001AB1D500000-0x000001AB1D600000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/1872-1373-0x000001AB1D500000-0x000001AB1D600000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/1912-1073-0x00000000049E0000-0x00000000049E1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2008-1079-0x0000020C12660000-0x0000020C12680000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2008-1095-0x0000020C12620000-0x0000020C12640000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2008-1111-0x0000020C12A20000-0x0000020C12A40000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2008-1074-0x0000020C11500000-0x0000020C11600000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/2008-1076-0x0000020C11500000-0x0000020C11600000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/2520-16-0x00000249BED40000-0x00000249BED64000-memory.dmp

    Filesize

    144KB

    Download

  • memory/2520-13-0x00007FFD17620000-0x00007FFD180E1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2520-11-0x00007FFD17620000-0x00007FFD180E1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2520-0-0x00007FFD17623000-0x00007FFD17625000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2520-18-0x00007FFD17620000-0x00007FFD180E1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2520-20-0x00007FFD17620000-0x00007FFD180E1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2520-19-0x00007FFD17620000-0x00007FFD180E1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2520-15-0x00000249BED40000-0x00000249BED6A000-memory.dmp

    Filesize

    168KB

    Download

  • memory/2520-12-0x00007FFD17620000-0x00007FFD180E1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2520-14-0x00007FFD17620000-0x00007FFD180E1000-memory.dmp

    Filesize

    10.8MB

    Download

  • memory/2520-6-0x00000249A5C60000-0x00000249A5C82000-memory.dmp

    Filesize

    136KB

    Download

  • memory/2844-937-0x000001963DD80000-0x000001963DDA0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2844-932-0x000001963CC20000-0x000001963CD20000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/2844-952-0x000001963E150000-0x000001963E170000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2844-941-0x000001963DD40000-0x000001963DD60000-memory.dmp

    Filesize

    128KB

    Download

  • memory/2844-933-0x000001963CC20000-0x000001963CD20000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/2844-934-0x000001963CC20000-0x000001963CD20000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/3420-633-0x00000000049A0000-0x00000000049A1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3472-485-0x0000000004520000-0x0000000004521000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3836-1227-0x000002B9FA300000-0x000002B9FA320000-memory.dmp

    Filesize

    128KB

    Download

  • memory/3836-1255-0x000002B9FA6D0000-0x000002B9FA6F0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/3836-1242-0x000002B9F9FC0000-0x000002B9F9FE0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/4104-337-0x0000000004370000-0x0000000004371000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4108-931-0x00000000043D0000-0x00000000043D1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4316-1371-0x00000000043D0000-0x00000000043D1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4560-29-0x0000000004CE0000-0x0000000004CE1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4648-1219-0x00000000044B0000-0x00000000044B1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4752-817-0x0000024174F30000-0x0000024174F50000-memory.dmp

    Filesize

    128KB

    Download

  • memory/4752-792-0x0000024174B20000-0x0000024174B40000-memory.dmp

    Filesize

    128KB

    Download

  • memory/4752-785-0x0000024174B60000-0x0000024174B80000-memory.dmp

    Filesize

    128KB

    Download

  • memory/4752-781-0x0000024173A00000-0x0000024173B00000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/4752-780-0x0000024173A00000-0x0000024173B00000-memory.dmp

    Filesize

    1024KB

    Download