Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

Rasauq SoftWorks.exe

windows10-2004-x64

10

Rasauq SoftWorks.exe

windows10-ltsc_2021-x64

10

Rasauq SoftWorks.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    892s
  • max time network
    893s
  • platform
    windows11-21h2_x64
  • resource
    win11-20250314-en
  • resource tags

    arch:x64arch:x86image:win11-20250314-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    17/03/2025, 15:01

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Rasauq SoftWorks.exe

  • Size

    81KB

  • MD5

    12a225de8199d2a31f049a6f300d8cfa

  • SHA1

    24819a452cf1db15167a52b12f258d27baacbd6e

  • SHA256

    1399d955881d9db34cbe261c117818a7933a1cc7c8cdabcff8fc22c880053801

  • SHA512

    3e321ac6e35b83e0645611721354a03358da7dde8bc42f761e258f87fa2ae8a33c3778aa48b10e0ead87331eded7240b7134f9c05333a823a53258f7a52cac32

  • SSDEEP

    1536:XnWk13eNqz4VP6fwWF/38MkbzG9KfwnIO6VFdOm/AqDi8:XWk13ebiIY8MkbzYXIdOm/ni8

Score
10/10
gurcuxwormcredential_accessdiscoveryexecutionpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

xworm

C2

looking-brings.gl.at.ply.gg:65381

Attributes
  • Install_directory

    %LocalAppData%

  • install_file

    USB.exe

  • telegram

    https://api.telegram.org/bot8074871433:AAGd-vCZQOlCC_n2SUFT-qQ6fFThcBVDd1Y

Extracted

Family

gurcu

C2

https://api.telegram.org/bot8074871433:AAGd-vCZQOlCC_n2SUFT-qQ6fFThcBVDd1Y/sendMessage?chat_id=1002422094535

Signatures

  • Detect Xworm Payload 2 IoCs
  • Gurcu family
    gurcu
  • Gurcu, WhiteSnake

    Gurcu aka WhiteSnake is a malware stealer written in C#.

    stealergurcu
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Drops startup file 2 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 2 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 26 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 41 IoCs
  • Suspicious use of SendNotifyMessage 25 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Rasauq SoftWorks.exe
    "C:\Users\Admin\AppData\Local\Temp\Rasauq SoftWorks.exe"
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3224
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Rasauq SoftWorks.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2184
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Rasauq SoftWorks.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:6032
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Windows Host Service.scr'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5220
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Windows Host Service.scr'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2848
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Windows Host Service" /tr "C:\Users\Admin\AppData\Local\Windows Host Service.scr"
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:3060
    • C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /delete /f /tn "Windows Host Service"
      2⤵
        PID:4792
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp7CEF.tmp.bat""
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2368
        • C:\Windows\system32\timeout.exe
          timeout 3
          3⤵
          • Delays execution with timeout.exe
          PID:3276
    • C:\Users\Admin\AppData\Local\Windows Host Service.scr
      "C:\Users\Admin\AppData\Local\Windows Host Service.scr"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:672
    • C:\Users\Admin\AppData\Local\Windows Host Service.scr
      "C:\Users\Admin\AppData\Local\Windows Host Service.scr"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:668
    • C:\Users\Admin\AppData\Local\Windows Host Service.scr
      "C:\Users\Admin\AppData\Local\Windows Host Service.scr"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:5824
    • C:\Users\Admin\AppData\Local\Windows Host Service.scr
      "C:\Users\Admin\AppData\Local\Windows Host Service.scr"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3308
    • C:\Users\Admin\AppData\Local\Windows Host Service.scr
      "C:\Users\Admin\AppData\Local\Windows Host Service.scr"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2456
    • C:\Users\Admin\AppData\Local\Windows Host Service.scr
      "C:\Users\Admin\AppData\Local\Windows Host Service.scr"
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4544
    • C:\Windows\system32\sihost.exe
      sihost.exe
      1⤵
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3116
      • C:\Windows\explorer.exe
        explorer.exe /LOADSAVEDWINDOWS
        2⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Drops desktop.ini file(s)
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:5300
    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
      1⤵
      • Enumerates system info in registry
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:5492
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:668
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k UnistackSvcGroup
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:5692
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy
      1⤵
        PID:4604
      • C:\Windows\system32\rundll32.exe
        "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 MicrosoftWindows.Client.CBS_cw5n1h2txyewy
        1⤵
          PID:4268
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:4172
        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
          1⤵
          • Enumerates system info in registry
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:4272
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Checks processor information in registry
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:5352

        Network

        MITRE ATT&CK Enterprise v15

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        1
        T1059

        PowerShell

        1
        T1059.001

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Persistence

        Boot or Logon Autostart Execution

        2
        T1547

        Active Setup

        1
        T1547.014

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Privilege Escalation

        Boot or Logon Autostart Execution

        2
        T1547

        Active Setup

        1
        T1547.014

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Defense Evasion

        Modify Registry

        3
        T1112

        Credential Access

        Credentials from Password Stores

        2
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Windows Credential Manager

        1
        T1555.004

        Unsecured Credentials

        1
        T1552

        Credentials In Files

        1
        T1552.001

        Discovery

        Browser Information Discovery

        1
        T1217

        Peripheral Device Discovery

        2
        T1120

        Query Registry

        5
        T1012

        System Information Discovery

        5
        T1082

        Lateral Movement

        Collection

        Data from Local System

        1
        T1005

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Windows Host Service.scr.log
          Filesize

          654B

          MD5

          2cbbb74b7da1f720b48ed31085cbd5b8

          SHA1

          79caa9a3ea8abe1b9c4326c3633da64a5f724964

          SHA256

          e31b18f21621d9983bfdf1ea3e53884a9d58b8ffd79e0e5790da6f3a81a8b9d3

          SHA512

          ecf02d5240e0c1c005d3ab393aa7eff62bd498c2db5905157e2bf6d29e1b663228a9583950842629d1a4caef404c8941a0c7799b1a3bd1eb890a09fdb7efcff9

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
          Filesize

          2KB

          MD5

          627073ee3ca9676911bee35548eff2b8

          SHA1

          4c4b68c65e2cab9864b51167d710aa29ebdcff2e

          SHA256

          85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

          SHA512

          3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini
          Filesize

          174B

          MD5

          e0fd7e6b4853592ac9ac73df9d83783f

          SHA1

          2834e77dfa1269ddad948b87d88887e84179594a

          SHA256

          feea416e5e5c8aa81416b81fb25132d1c18b010b02663a253338dbdfb066e122

          SHA512

          289de77ffbe328388ad080129b7460712985d42076e78a3a545124881c30f564c5ef8fb4024d98903d88a6a187c60431a600f6ecbbe2888ee69e40a67ce77b55

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
          Filesize

          1024KB

          MD5

          6fa35cf9bb39277f567f98f372607f12

          SHA1

          219f4a937b6f311e15dbe4aa9963ef35276f8ec4

          SHA256

          35377e57133d8ff5131d2b6e9f9e220aff4a31230cf3ac9c1d21f059045d31c7

          SHA512

          48bb27b17efbbd9067e2446f92214f338551aac0b6e2d7129f92d56eb89d94049c47bc344e62d52e5670bad307a93008572f5adbded5cc24c45b8415ff818f5a

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
          Filesize

          7KB

          MD5

          28bbad21104f80454dcd7217b71557dc

          SHA1

          8b3d54071b7c81b45d18318df0cca71a7eb3ad7b

          SHA256

          10462d2b4153fbd9788f52fa8afe5c1bc2eaee67ba0845e768b8d7221ce4415d

          SHA512

          6fdae726df1746a554d5c4a4a2d1bceff985abcbcf322bca27d4512d214d29d1c2d226558c1959e6224e08c4763a60fb06c8e0ed5ff574f452c32f1b2bd054cf

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          Filesize

          944B

          MD5

          aa4f31835d07347297d35862c9045f4a

          SHA1

          83e728008935d30f98e5480fba4fbccf10cefb05

          SHA256

          99c83bc5c531e49d4240700142f3425aba74e18ebcc23556be32238ffde9cce0

          SHA512

          ec3a4bee8335007b8753ae8ac42287f2b3bcbb258f7fc3fb15c9f8d3e611cb9bf6ae2d3034953286a34f753e9ec33f7495e064bab0e8c7fcedd75d6e5eb66629

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          Filesize

          944B

          MD5

          fb9fada5651a2593ce0268bd1ee523a6

          SHA1

          870a5771f5033c5a7cc418701790bf1dc139383d

          SHA256

          292dffc35560c53f5e8c2c5fc5345ecef3bcda441ac4226dc953d16ed1d1955b

          SHA512

          310746aec847ec95c5ce9b2ef05ef95b9a93ac7b00839becd742f8a5191172d248cd6ef06a96c32f3dea005263c0d81b01b126fdd47c033930f5ed1af0192a97

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          Filesize

          944B

          MD5

          21768e58b50adabb5a22fff53a91e6d0

          SHA1

          2c308f026a9fbd5a6aa681f45e5c5593a7a603e6

          SHA256

          fec2b54f9d90615d0f981d6ab60c8911fc555c56a642cdfe57f43793716fedfe

          SHA512

          507899fe636d91c16ec7ab75823e7bd3eda7e0d00cdd0f51be75da80aa4ee59e583c181e30fbe352b18e09faa0d9bb29dcce2167c41fa97d8e62feff474c6018

          Download Submit

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
          Filesize

          944B

          MD5

          d9cf98576a2cb3f3c61ecb945ac5c0ba

          SHA1

          31cefba9c71f6e2712ce4ff2d346634bf7b8b945

          SHA256

          c5c85705c6d58aa00e0b67a6170fa1ae6de8b6de616d0c1e57c820d47ea5ce6f

          SHA512

          639df2e2c19df7b00d1e0278dd838920e349f00f65c33c8594f4717e5dda275632c2e1e20b0dfa614f91ad089e93847e939c2e228bfd99e1dea5a70948feebed

          Download Submit

        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
          Filesize

          28KB

          MD5

          5673dfe4c137a463ed74841b30ffaed4

          SHA1

          01d7f3b626cb5bd8d98442a60af9dbfeaa7f64df

          SHA256

          562bdbeab7b02cb74358fcbb42aab3147370bfd4d83d4b651dfd3b218ce84023

          SHA512

          1802e1ed5c418b8c7f8047832e148866e304763d810528200b1849a3470cf75fdf847db8d625946681965c4749e9d089e9f0f927046f0a01ef1fb5154f762c87

          Download Submit

        • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\StartUnifiedTileModelCache.dat
          Filesize

          25KB

          MD5

          bad47c164245b5b4b64a815288b8c83b

          SHA1

          5c3db6b4af1835cd15aea7ab226db2d48e06f20b

          SHA256

          e692feddf61fab1a85e3b55fd866c1f82ca536ce00dd76ea832c7ef073bb6489

          SHA512

          3f20a273cc768f60ef9d77c0a766ac1654d3b7b33d94964cc86d97b33aebb16b6c8de87ec7c01384a3f985639ecd282913fb9ffeb6be33943c78fefaa14b16d9

          Download Submit

        • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\AV6A5B0C\www.bing[1].xml
          Filesize

          3KB

          MD5

          96197530cb397d1b4416e71d164f4b61

          SHA1

          d6a958cfc4606947d2b52dce659061702f062bc6

          SHA256

          a73a9231d7546ec9d0f967617282452563f679baee776121734532c0fb9777f3

          SHA512

          7e44295bd15b4106e7836a5b062989209525149e0bbd15e83d593772056e0751c50b53eb74bfcb34da930b77b40882cbc6e944d7feec6a94fe4f2ebe092cbe17

          Download Submit

        • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\NXWPYMPK\www.bing[1].xml
          Filesize

          97B

          MD5

          8c4cb0f46d3f4e183617d90ca2dd7f68

          SHA1

          099cd8cfc4ec5b4fc5392dd1e6e7acbfcf04da28

          SHA256

          6959092ef8f95f6b805baad046e74e61e91c3b769de026d995ac91b7d1981621

          SHA512

          295245a435e48717916fcc981aef066aed6bdb7f96d84e84aec418f108462914daa313522ee50de3d8a302341c44ed4478b4ef9678d766326779e2d4a75dbe4f

          Download Submit

        • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\NXWPYMPK\www.bing[1].xml
          Filesize

          328B

          MD5

          a8e28df6e6ae1e7e59d453b8ed87f2d6

          SHA1

          44b260c69cc0634fa65c3ac0aab8475c8e703a3a

          SHA256

          fa351706f1dc14168121d6f16c329f438485c8d41ec57f9be70bcbd31e18ffec

          SHA512

          8d5a5e88a1a107a587f4dac3b3b090a25c7169bf5b9e8cc6579782bf6717e33398727a88aa25275391f24c76c8d971627eea4354f81bd7b43af0c9f92b7f777d

          Download Submit

        • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\NXWPYMPK\www.bing[1].xml
          Filesize

          15KB

          MD5

          9633532a0ea58072454f827cd2a7b4ca

          SHA1

          49f5a330ec8f14ca9f5207e05f3e82053f768036

          SHA256

          5a836b6255afb7b95a48dab28214f4907d4dd79f4711b37f20ac4bc93075a2c5

          SHA512

          a2fe1ae32b8eba834cb590d7243aa197b5e3131254830d5d91619930e3644043f5856b8269615a83b7003153c9794bb9c3699a99325f977e74ba119dc2d61519

          Download Submit

        • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{1ac42ecc-15cb-4696-bd52-a7c44bef9ee0}\Apps.ft
          Filesize

          23KB

          MD5

          2b42afec5a4f3ea224dc8b96ed72e3f2

          SHA1

          b79c16ad8d15b33d7dabaf961d2d7384492a10ee

          SHA256

          9682a44fe7ef62a0f21984ca14390d27bbeea471d5528f8f7e26f9e10311598a

          SHA512

          b612246e627c5e43778d9f36138df7bdc82f163ee93ed181faa9506fa7cf8fb95ebf363462e4a5e92ff825c5ea8ef3b919e1277b41a8b401112e3fc2b1d506fd

          Download Submit

        • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{1ac42ecc-15cb-4696-bd52-a7c44bef9ee0}\Apps.index
          Filesize

          984KB

          MD5

          da8c8a3543bd308946df654219e96b64

          SHA1

          708c27256e10cc239c53521dc931e18e327f37d8

          SHA256

          df36bf600ed15cd3b28861dd14ad0ac2399f306d696978fb06740ca477962036

          SHA512

          587d3adbb305568ae77e0d4c99761165f66ca0a0e533230ad58e2c2b9eca211ce99350383b7f62e74023c69c117c8d6fa482e1ed8a84d8b5045421849a907b1f

          Download Submit

        • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{85276c52-c5e6-4255-bccd-505dcbc1bbe5}\0.0.filtertrie.intermediate.txt
          Filesize

          5KB

          MD5

          a9cbfb3bca2862b5e2aa7a8caaaa6f98

          SHA1

          a5cfdaec60d4e0217bc8fe33a03407df18694e29

          SHA256

          24b275c475b89000e9cd3794271cb611cace85ed11b5a782ff8d82744ed8511d

          SHA512

          ef79e1ff9202a3465ea96385e5a18810d9b0e671e5e8a9ae2d6335277935dc55afd0fa7b83cad184716c0df2342bead02c057abc38b47304bcba65aa77fdd252

          Download Submit

        • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{85276c52-c5e6-4255-bccd-505dcbc1bbe5}\Apps.ft
          Filesize

          8KB

          MD5

          cc1a3f61f4a214faa138a8b820bf742e

          SHA1

          ef469731dc5a059dde7fdf6c71f7e1c216e8d6f3

          SHA256

          05c5f725a9a4b53343dd755a2083726fa53445714dcaa25a873390153ca0bc35

          SHA512

          c00eae82e4dd9856eb87e6b152b41ce3fc53557d257ea091a43d001d94adb774f21c6c8b19cebf8c6e7715acb9777fef119cf63324c72350cce75df0736bdc85

          Download Submit

        • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d573e2e4-60bb-46fe-80f3-ad29a58548be}\apps.csg
          Filesize

          444B

          MD5

          5475132f1c603298967f332dc9ffb864

          SHA1

          4749174f29f34c7d75979c25f31d79774a49ea46

          SHA256

          0b0af873ef116a51fc2a2329dc9102817ce923f32a989c7a6846b4329abd62cd

          SHA512

          54433a284a6b7185c5f2131928b636d6850babebc09acc5ee6a747832f9e37945a60a7192f857a2f6b4dd20433ca38f24b8e438ba1424cc5c73f0aa2d8c946ff

          Download Submit

        • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d573e2e4-60bb-46fe-80f3-ad29a58548be}\apps.schema
          Filesize

          150B

          MD5

          1659677c45c49a78f33551da43494005

          SHA1

          ae588ef3c9ea7839be032ab4323e04bc260d9387

          SHA256

          5af0fc2a0b5ccecdc04e54b3c60f28e3ff5c7d4e1809c6d7c8469f0567c090bb

          SHA512

          740a1b6fd80508f29f0f080a8daddec802aabed467d8c5394468b0cf79d7628c1cb5b93cf69ed785999e8d4e2b0f86776b428d4fa0d1afcdf3cbf305615e5030

          Download Submit

        • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d573e2e4-60bb-46fe-80f3-ad29a58548be}\appsconversions.txt
          Filesize

          1.4MB

          MD5

          2bef0e21ceb249ffb5f123c1e5bd0292

          SHA1

          86877a464a0739114e45242b9d427e368ebcc02c

          SHA256

          8b9fae5ea9dd21c2313022e151788b276d995c8b9115ee46832b804a914e6307

          SHA512

          f5b49f08b44a23f81198b6716195b868e76b2a23a388449356b73f8261107733f05baa027f8cdb8e469086a9869f4a64983c76da0dc978beb4ec1cb257532c6b

          Download Submit

        • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d573e2e4-60bb-46fe-80f3-ad29a58548be}\appsglobals.txt
          Filesize

          343KB

          MD5

          931b27b3ec2c5e9f29439fba87ec0dc9

          SHA1

          dd5e78f004c55bbebcd1d66786efc5ca4575c9b4

          SHA256

          541dfa71a3728424420f082023346365cca013af03629fd243b11d8762e3403e

          SHA512

          4ba517f09d9ad15efd3db5a79747e42db53885d3af7ccc425d52c711a72e15d24648f8a38bc7e001b3b4cc2180996c6cac3949771aa1c278ca3eb7542eae23fd

          Download Submit

        • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d573e2e4-60bb-46fe-80f3-ad29a58548be}\appssynonyms.txt
          Filesize

          237KB

          MD5

          06a69ad411292eca66697dc17898e653

          SHA1

          fbdcfa0e1761ddcc43a0fb280bbcd2743ba8820d

          SHA256

          2aa90f795a65f0e636154def7d84094af2e9a5f71b1b73f168a6ea23e74476d1

          SHA512

          ceb4b102309dffb65804e3a0d54b8627fd88920f555b334c3eac56b13eeb5075222d794c3cdbc3cda8bf1658325fdecf6495334e2c89b5133c9a967ec0d15693

          Download Submit

        • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d573e2e4-60bb-46fe-80f3-ad29a58548be}\settings.csg
          Filesize

          454B

          MD5

          411d53fc8e09fb59163f038ee9257141

          SHA1

          cb67574c7872f684e586b438d55cab7144b5303d

          SHA256

          1844105bb927dbc405685d3bf5546be47fa2fc5846b763c9f2ba2b613ec6bc48

          SHA512

          67b342c434d8f3a8b9e9ac8a4cbd4c3ef83ddfc450fe7e6ad6f375dba9c8a4977a15a08b49f5ad7644fbde092396e6da08865aa54d399836e5444cb177a33444

          Download Submit

        • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d573e2e4-60bb-46fe-80f3-ad29a58548be}\settings.schema
          Filesize

          162B

          MD5

          ac68ac6bffd26dbea6b7dbd00a19a3dd

          SHA1

          a3d70e56249db0b4cc92ba0d1fc46feb540bc83f

          SHA256

          d6bdeaa9bc0674ae9e8c43f2e9f68a2c7bb8575b3509685b481940fda834e031

          SHA512

          6c3fcce2f73e9a5fc6094f16707109d03171d4a7252cf3cb63618243dbb25adb40045de9be27cad7932fd98205bdaf0f557d282b2ba92118bba26efcf1cd2a02

          Download Submit

        • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d573e2e4-60bb-46fe-80f3-ad29a58548be}\settingsconversions.txt
          Filesize

          520KB

          MD5

          721134982ff8900b0e68a9c5f6f71668

          SHA1

          fca3e3eb8f49dd8376954b499c20a7b7cad6b0f1

          SHA256

          2541db95c321472c4cb91864cdfa2f1ed0f0069ac7f9cec86e10822283985c13

          SHA512

          5d1c305b938e52a82216b3d0cee0eead2dc793fac35da288061942b2bd281fb48c7bd18f5fdaa93a88aa42c88b2a0cce1f0513effb193782670d46164d277a59

          Download Submit

        • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d573e2e4-60bb-46fe-80f3-ad29a58548be}\settingsglobals.txt
          Filesize

          43KB

          MD5

          bbeadc734ad391f67be0c31d5b9cbf7b

          SHA1

          8fd5391c482bfbca429aec17da69b2ca00ed81ae

          SHA256

          218042bc243a1426dd018d484f9122662dba2c44a0594c37ffb3b3d1d0fb454a

          SHA512

          a046600c7ad6c30b003a1ac33841913d7d316606f636c747a0989425697457b4bc78da6607edd4b8510bd4e9b86011b5bd108a5590a2ba722d44e51633ed784f

          Download Submit

        • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{d573e2e4-60bb-46fe-80f3-ad29a58548be}\settingssynonyms.txt
          Filesize

          101KB

          MD5

          003ece80b3820c43eb83878928b8469d

          SHA1

          790af92ff0eb53a926412e16113c5d35421c0f42

          SHA256

          12d00eee26e5f261931e51cfa56e04c54405eb32d1c4b440e35bd2b48d5fcf07

          SHA512

          b2d6d9b843124f5e8e06a35a89e34228af9e05cbfa2ae1fe3d9bc4ddbebda4d279ce52a99066f2148817a498950e37a7f0b73fe477c0c6c39c7016aa647079a5

          Download Submit

        • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{d8cba740-e751-41b0-bb8b-3de2ddeba57f}\0.1.filtertrie.intermediate.txt
          Filesize

          5B

          MD5

          34bd1dfb9f72cf4f86e6df6da0a9e49a

          SHA1

          5f96d66f33c81c0b10df2128d3860e3cb7e89563

          SHA256

          8e1e6a3d56796a245d0c7b0849548932fee803bbdb03f6e289495830e017f14c

          SHA512

          e3787de7c4bc70ca62234d9a4cdc6bd665bffa66debe3851ee3e8e49e7498b9f1cbc01294bf5e9f75de13fb78d05879e82fa4b89ee45623fe5bf7ac7e48eda96

          Download Submit

        • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{d8cba740-e751-41b0-bb8b-3de2ddeba57f}\0.2.filtertrie.intermediate.txt
          Filesize

          5B

          MD5

          c204e9faaf8565ad333828beff2d786e

          SHA1

          7d23864f5e2a12c1a5f93b555d2d3e7c8f78eec1

          SHA256

          d65b6a3bf11a27a1ced1f7e98082246e40cf01289fd47fe4a5ed46c221f2f73f

          SHA512

          e72f4f79a4ae2e5e40a41b322bc0408a6dec282f90e01e0a8aaedf9fb9d6f04a60f45a844595727539c1643328e9c1b989b90785271cc30a6550bbda6b1909f8

          Download Submit

        • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133866980918251495.txt
          Filesize

          71KB

          MD5

          64d0157c5688c22b41e14095fe099fde

          SHA1

          8f02ee31d173d881c0f24fe040ee8b7a6c4638ee

          SHA256

          51f1f64f2f8be5424bc8bfebf267e5f4d53385e1e3c6efff725d0a9a25ad1539

          SHA512

          48d33730925b1f523a444b3499f6bddab9fd70031c97e7f41f83983816906d7942e8e3647ad2b7214b374b0f35f28e2f3c53d4561da42f0393d96b1014a472db

          Download Submit

        • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133866981011111166.txt
          Filesize

          18KB

          MD5

          32c64d5d334902f10e1a96f6292e5dd3

          SHA1

          8a32af4f4cb4b914eb64b7cd5e7bb442ca39325c

          SHA256

          7e790e9a27baf19f7748f81ee2777baf78759bef0ba6cda0a2832738ff94f7c4

          SHA512

          2852576b64531c11fab7d35179b6773d19da7fdba24f6934f9c8112ca72d470fa6431abf5489a17dd1013eede106a83b11291b61c7eaedf0d354b3415e26159b

          Download Submit

        • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchUnifiedTileModelCache.dat
          Filesize

          24KB

          MD5

          2d0b30b2f50298bceb9fb6937ba336a1

          SHA1

          b04890047cd1d104057394856bddce3d1cdb3bd9

          SHA256

          395adf42965b2da96ead316736ae55a15690f5ff3500542d41373b25d3fe4e8c

          SHA512

          e795f86fb1ca96e8131b63f9d0922d4773af6f5b5afc0d3bf8d2c50a9619e2bbdce4504be55ed7c731cf658ad8454e4d52f59566f9a0edbdceef7e4d362f1bcd

          Download Submit

        • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchUnifiedTileModelCache.dat
          Filesize

          21KB

          MD5

          9cc19a235effe683523c394e5c48c876

          SHA1

          d39f4cdd0b5520ba72438910680193199eead6c0

          SHA256

          59ec23fc20bef3eaf36776038a1501f295a3cbd374bb87700cce60eaa8a56cf2

          SHA512

          610647e458e942cabbc615e0e1cfb3daa91ad702870e19f65e880a0fe3968c4cfd937fde88650f51a993f864da64c483cb0ce40d70e614d0e15446cba1efd0fc

          Download Submit

        • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchUnifiedTileModelCache.dat
          Filesize

          24KB

          MD5

          5d89383eddeb3fa39339dcecb98980f8

          SHA1

          cc6291c4051c9e6a7e33f2190986f19b7e4f79f5

          SHA256

          7e7fb8fe3219d3837fac8b1f22b39ce6896639c40c204030f2d5ba8e0cd7023c

          SHA512

          9fa706a0821fa9cf974c1a9063c8db529167157855f2400884767e4490af429eed45e7716e1ede1a0cc28bd17c714aa948645a7f08917a3752e6f934aec1ee35

          Download Submit

        • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchUnifiedTileModelCache.dat
          Filesize

          22KB

          MD5

          d200634d09f446a6071c61a03a6fd4e9

          SHA1

          8297e4068f6c921a009478ae3c743939ab746b85

          SHA256

          06c6bd175c4f5d942be755ce1bd2ee7b23de01f91fa0c812e75b5831e85ca31b

          SHA512

          62db3db084964df3704bfbc27effb37173e7798138b6fff63acde97eaafe4c9f53103e70bf1a80d84b506c2413fae093c39dc076e65db80838f0314f0c1d2e34

          Download Submit

        • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SettingsCache.txt
          Filesize

          846KB

          MD5

          766f5efd9efca73b6dfd0fb3d648639f

          SHA1

          71928a29c3affb9715d92542ef4cf3472e7931fe

          SHA256

          9111e9a5093f97e15510bf3d3dc36fd4a736981215f79540454ce86893993fdc

          SHA512

          1d4bb423d9cc9037f6974a389ff304e5b9fbd4bfd013a09d4ceeff3fd2a87ad81fe84b2ee880023984978391daf11540f353d391f35a4236b241ccced13a3434

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rn10gu4w.od5.ps1
          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\tmp1583.tmp
          Filesize

          100KB

          MD5

          1b942faa8e8b1008a8c3c1004ba57349

          SHA1

          cd99977f6c1819b12b33240b784ca816dfe2cb91

          SHA256

          555ccb7ecd9ae52a75135fdd81ab443a49d5785b0621ed6468d28c4234e46ccc

          SHA512

          5aee3d59478d41ddd5885c99b394c9c4983064e2b3528db1a3f7fc289662bced4f57d072517bbe7573c6d1789435e987ef1aa9cc91f372bcfd30bc016675fa43

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\tmp7CEF.tmp.bat
          Filesize

          168B

          MD5

          b941fe512a1879e84ea8a4bc0d644841

          SHA1

          92afbb55e9a26d0c070cb379182f89359ee86d27

          SHA256

          1739ecc1f91a54e8ef1c91de623afc115f66ce39f94b4e96f433af30f0057009

          SHA512

          2b7609ee2d73736b231fb07bdc754e914bebe27f9eea9c1e5de6b7b25eb4b0d89414fbdd3320be3fc83405ca55dbf27e2e09f96d1b7d176f741378975bf9f90d

          Download Submit

        • C:\Users\Admin\AppData\Local\Windows Host Service.scr
          Filesize

          81KB

          MD5

          12a225de8199d2a31f049a6f300d8cfa

          SHA1

          24819a452cf1db15167a52b12f258d27baacbd6e

          SHA256

          1399d955881d9db34cbe261c117818a7933a1cc7c8cdabcff8fc22c880053801

          SHA512

          3e321ac6e35b83e0645611721354a03358da7dde8bc42f761e258f87fa2ae8a33c3778aa48b10e0ead87331eded7240b7134f9c05333a823a53258f7a52cac32

          Download Submit

        • memory/2184-2-0x00007FFAB78B0000-0x00007FFAB8372000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/2184-3-0x00007FFAB78B0000-0x00007FFAB8372000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/2184-4-0x00000267F8680000-0x00000267F86A2000-memory.dmp

          Filesize

          136KB

          Download

        • memory/2184-13-0x00007FFAB78B0000-0x00007FFAB8372000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/2184-14-0x00007FFAB78B0000-0x00007FFAB8372000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/2184-17-0x00007FFAB78B0000-0x00007FFAB8372000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/3224-71-0x000000001E830000-0x000000001ED58000-memory.dmp

          Filesize

          5.2MB

          Download

        • memory/3224-70-0x000000001D9E0000-0x000000001DA90000-memory.dmp

          Filesize

          704KB

          Download

        • memory/3224-1-0x0000000000890000-0x00000000008AA000-memory.dmp

          Filesize

          104KB

          Download

        • memory/3224-52-0x00007FFAB78B0000-0x00007FFAB8372000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/3224-53-0x00007FFAB78B0000-0x00007FFAB8372000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/3224-63-0x0000000000F10000-0x0000000000F4A000-memory.dmp

          Filesize

          232KB

          Download

        • memory/3224-68-0x0000000000FD0000-0x0000000000FDC000-memory.dmp

          Filesize

          48KB

          Download

        • memory/3224-79-0x00007FFAB78B0000-0x00007FFAB8372000-memory.dmp

          Filesize

          10.8MB

          Download

        • memory/3224-0-0x00007FFAB78B3000-0x00007FFAB78B5000-memory.dmp

          Filesize

          8KB

          Download

        • memory/5492-278-0x00000263CA800000-0x00000263CA900000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/5492-186-0x00000263A73F0000-0x00000263A74F0000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/5492-187-0x00000263A73F0000-0x00000263A74F0000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/5492-185-0x00000263A73F0000-0x00000263A74F0000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/5492-284-0x00000263CA1C0000-0x00000263CA1E0000-memory.dmp

          Filesize

          128KB

          Download

        • memory/5692-274-0x000001964C820000-0x000001964C821000-memory.dmp

          Filesize

          4KB

          Download

        • memory/5692-247-0x000001964C6D0000-0x000001964C6D1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/5692-282-0x000001964C840000-0x000001964C841000-memory.dmp

          Filesize

          4KB

          Download

        • memory/5692-280-0x000001964C840000-0x000001964C841000-memory.dmp

          Filesize

          4KB

          Download

        • memory/5692-281-0x000001964C840000-0x000001964C841000-memory.dmp

          Filesize

          4KB

          Download

        • memory/5692-314-0x000001964C850000-0x000001964C851000-memory.dmp

          Filesize

          4KB

          Download

        • memory/5692-279-0x000001964C840000-0x000001964C841000-memory.dmp

          Filesize

          4KB

          Download

        • memory/5692-315-0x000001964C960000-0x000001964C961000-memory.dmp

          Filesize

          4KB

          Download

        • memory/5692-275-0x000001964C840000-0x000001964C841000-memory.dmp

          Filesize

          4KB

          Download

        • memory/5692-277-0x000001964C840000-0x000001964C841000-memory.dmp

          Filesize

          4KB

          Download

        • memory/5692-276-0x000001964C840000-0x000001964C841000-memory.dmp

          Filesize

          4KB

          Download

        • memory/5692-255-0x000001964C820000-0x000001964C821000-memory.dmp

          Filesize

          4KB

          Download

        • memory/5692-256-0x000001964C820000-0x000001964C821000-memory.dmp

          Filesize

          4KB

          Download

        • memory/5692-254-0x000001964C810000-0x000001964C811000-memory.dmp

          Filesize

          4KB

          Download

        • memory/5692-250-0x000001964C810000-0x000001964C811000-memory.dmp

          Filesize

          4KB

          Download

        • memory/5692-312-0x000001964C840000-0x000001964C841000-memory.dmp

          Filesize

          4KB

          Download

        • memory/5692-208-0x00000196443A0000-0x00000196443B0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/5692-224-0x00000196444A0000-0x00000196444B0000-memory.dmp

          Filesize

          64KB

          Download

        • memory/5692-313-0x000001964C850000-0x000001964C851000-memory.dmp

          Filesize

          4KB

          Download

        • memory/5692-303-0x000001964C840000-0x000001964C841000-memory.dmp

          Filesize

          4KB

          Download

        • memory/5692-304-0x000001964C840000-0x000001964C841000-memory.dmp

          Filesize

          4KB

          Download

        • memory/5692-305-0x000001964C840000-0x000001964C841000-memory.dmp

          Filesize

          4KB

          Download

        • memory/5692-311-0x000001964C840000-0x000001964C841000-memory.dmp

          Filesize

          4KB

          Download

        • memory/5692-309-0x000001964C840000-0x000001964C841000-memory.dmp

          Filesize

          4KB

          Download

        • memory/5692-310-0x000001964C840000-0x000001964C841000-memory.dmp

          Filesize

          4KB

          Download

        • memory/5692-306-0x000001964C840000-0x000001964C841000-memory.dmp

          Filesize

          4KB

          Download

        • memory/5692-308-0x000001964C840000-0x000001964C841000-memory.dmp

          Filesize

          4KB

          Download

        • memory/5692-307-0x000001964C840000-0x000001964C841000-memory.dmp

          Filesize

          4KB

          Download

        • memory/5692-283-0x000001964C840000-0x000001964C841000-memory.dmp

          Filesize

          4KB

          Download