Overview

overview

10

Static

static

3

3a132d79ff...4d.exe

windows7-x64

10

3a132d79ff...4d.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    95s
  • max time network
    166s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31-12-2023 14:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3a132d79ff5b577c8ea00bad8da6304d.exe

  • Size

    283KB

  • MD5

    3a132d79ff5b577c8ea00bad8da6304d

  • SHA1

    3347daee9fa051b316b93c1541bbb0908696c2f8

  • SHA256

    c8ca2cde76eafffe4bb6640ef8f9eb5acefaf0efaec37048ff058400248ab019

  • SHA512

    9ac5912a9771f76c423f62bc6d7a0cc941ed6f1f59429ddc70d18d614f8d7378f62324eeea244e0af17cb5183c4d8fcb99c2f3f07078803d53b48752c76d610a

  • SSDEEP

    6144:VDplsxscrEZGUT1eIbLNPSkLpwDDMfZbwVts92qo1bY:1byEZTeWsJDMdwV292qo1b

Score
10/10
ponydiscoveryevasionpersistenceratspywarestealerupx

Malware Config

Signatures

  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Disables taskbar notifications via registry modification
    evasion
  • Modifies Installed Components in the registry 2 TTPs 3 IoCs
    persistence
  • Executes dropped EXE 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 6 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 57 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\3a132d79ff5b577c8ea00bad8da6304d.exe
    "C:\Users\Admin\AppData\Local\Temp\3a132d79ff5b577c8ea00bad8da6304d.exe"
    1⤵
    • Modifies security service
    • Adds Run key to start application
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4836
    • C:\Users\Admin\AppData\Local\Temp\3a132d79ff5b577c8ea00bad8da6304d.exe
      C:\Users\Admin\AppData\Local\Temp\3a132d79ff5b577c8ea00bad8da6304d.exe startC:\Users\Admin\AppData\Roaming\DEDFA\31743.exe%C:\Users\Admin\AppData\Roaming\DEDFA
      2⤵
        PID:4348
      • C:\Program Files (x86)\LP\43AD\8690.tmp
        "C:\Program Files (x86)\LP\43AD\8690.tmp"
        2⤵
        • Executes dropped EXE
        PID:1820
      • C:\Users\Admin\AppData\Local\Temp\3a132d79ff5b577c8ea00bad8da6304d.exe
        C:\Users\Admin\AppData\Local\Temp\3a132d79ff5b577c8ea00bad8da6304d.exe startC:\Program Files (x86)\FA811\lvvm.exe%C:\Program Files (x86)\FA811
        2⤵
          PID:4280
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:64
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2696
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4920
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1680
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3416
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:4180
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of SendNotifyMessage
        PID:772
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
          PID:3140
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:4680
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:2896
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
              PID:3076
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:2352
              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                1⤵
                  PID:2508
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                    PID:4248
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    1⤵
                      PID:4048
                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                      1⤵
                        PID:4896
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                          PID:3600
                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                          1⤵
                            PID:1372
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                              PID:4360
                            • C:\Windows\explorer.exe
                              explorer.exe
                              1⤵
                                PID:4324
                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                1⤵
                                  PID:3156
                                • C:\Windows\explorer.exe
                                  explorer.exe
                                  1⤵
                                    PID:3656
                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                    1⤵
                                      PID:3992
                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                      1⤵
                                        PID:3912
                                      • C:\Windows\explorer.exe
                                        explorer.exe
                                        1⤵
                                          PID:4476
                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                          1⤵
                                            PID:4472
                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                            1⤵
                                              PID:3624
                                            • C:\Windows\explorer.exe
                                              explorer.exe
                                              1⤵
                                                PID:1716
                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                1⤵
                                                  PID:3744
                                                • C:\Windows\explorer.exe
                                                  explorer.exe
                                                  1⤵
                                                    PID:116
                                                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                    1⤵
                                                      PID:3088
                                                    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                      1⤵
                                                        PID:3616

                                                      Network

                                                      MITRE ATT&CK Enterprise v15

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      • C:\Program Files (x86)\LP\43AD\8690.tmp
                                                        Filesize

                                                        99KB

                                                        MD5

                                                        8512e7236d6f175a95604ed7d843b20a

                                                        SHA1

                                                        7f35c53dce0af6129bca3d199a84235df9bd6ef4

                                                        SHA256

                                                        1cd98423b66062336bd5d06de36b0747482abeb4e526a9719d3d659bc3fc0edd

                                                        SHA512

                                                        2031122102d22b834d33eecfb123f422bab250222774f2d2ce1f2d3e9df87a27202979f0cbf42592d92c5c164a133b56272202da1a61d3a84549ddb32fd70542

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                        Filesize

                                                        471B

                                                        MD5

                                                        5602e90c116a6e753f35080486765f70

                                                        SHA1

                                                        138eab99c4a8aa2550ef0504029d16ceb4f563f2

                                                        SHA256

                                                        cfdb79c520113b533729270407ff70f36d444ed61ead4b10791e5ce26c9ee088

                                                        SHA512

                                                        d4b50dcf2598585a0c1a269c53fd9ab8b6004fcb171713853a694b1a809e7c4c793f267710b662690f60b2a287ce8d23ba6dccd5fcff6ea02873c135ecc3a5d8

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
                                                        Filesize

                                                        412B

                                                        MD5

                                                        28c38a52a3ce2dd23f9daec492eccdd5

                                                        SHA1

                                                        9142b300d59a5086803adc6343b9b59b564187ed

                                                        SHA256

                                                        21a7ac8d2a17eb8dcaaf2d98f0c26195d95c3efcaed96d09cddd29129d6a1f1c

                                                        SHA512

                                                        ba380f0daedcac50911a69d51c59d98a0186c5152a639af11d72b6c6ac0047b6d451edc43a08b68e47f58bb24e91797eb27a189488c9d2b379c39ce088a6fd3f

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
                                                        Filesize

                                                        2KB

                                                        MD5

                                                        9a7a749ec27a4f33257001d2ba2c38ff

                                                        SHA1

                                                        216d2dbe12378fc2b15f4f130147c017dee852d0

                                                        SHA256

                                                        5db62800b423fce5afee3af06595e2da965031b42fd0b7afea22d21c95c014fa

                                                        SHA512

                                                        7d71b9ae0acc6f79d703d3a10621a390660d0e03f8c22f182d1b95a35686856db5493af83603724257b618f4a0f4f937aef6730f0b60307017d59363ab0ad6da

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133493969197529474.txt
                                                        Filesize

                                                        74KB

                                                        MD5

                                                        c09e63e4b960a163934b3c29f3bd2cc9

                                                        SHA1

                                                        d3a43b35c14ae2e353a1a15c518ab2595f6a0399

                                                        SHA256

                                                        308deca5e1ef4d875fbe0aff3ce4b0b575b28e643dffda819d4390ec77faf157

                                                        SHA512

                                                        5ca3321034dff47e3afe0b0bdfaffc08782991660910a29375a8e0363794b78247282aba65dbd882ae225aa140ae63927dfd0946a441ee6fa64a1d8c146777b9

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\0A55C1OB\microsoft.windows[1].xml
                                                        Filesize

                                                        97B

                                                        MD5

                                                        291a3f3ebf21195c8af7c2f120ca4dfc

                                                        SHA1

                                                        1cade2dac000db3bca92e2daee371beffd2c0bee

                                                        SHA256

                                                        fbe32bda6ca669397ca6d02b329f235aee87a8f36b09a589548e969c19cb78de

                                                        SHA512

                                                        ed2dea282f97d25171e0e95fe718103e04e37f13a1edf79373af204ac344cdb9a0fca34d82e45d3475a9845ee92644a99a1c2733f8858fe384e3b6958331f287

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Roaming\DEDFA\A811.EDF
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        3a618ba91f1269c41917e7c9236470ef

                                                        SHA1

                                                        85e4eadc90814d24157e7463fdf3c42a0af97344

                                                        SHA256

                                                        9ea2c8c3433ffda1ecea9c417fa6a698396c219e3690e828f35c46d3612321e0

                                                        SHA512

                                                        7baec6ba4715ad579da0c15d444eddb272680b84ddc626fea1368ef7454f80625df68e0d099c933307f5a17491182dc2a57a93c108fad8a3225cd8cf87072c3d

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Roaming\DEDFA\A811.EDF
                                                        Filesize

                                                        1KB

                                                        MD5

                                                        3e31005dde374e90de143422b7be9cac

                                                        SHA1

                                                        14f105aa5a7a38fe19f3b176e3213cc495c9a9f4

                                                        SHA256

                                                        7713b591356403495b370748d29f5b38563181f91668c6ddef87cbb36c622018

                                                        SHA512

                                                        7f248dadbf67336a6d60afeb1cc19a456492f5f3a9f898cc8f21b31e1a3a87a278a0dcf179ea26761f3b67170f91eb90b4d66a2963233996469cf7738e58ea16

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Roaming\DEDFA\A811.EDF
                                                        Filesize

                                                        300B

                                                        MD5

                                                        8102685f0d4bc7a0a250b9a8a873e212

                                                        SHA1

                                                        e4fec9a62302557dedaf137c5293cd8e522c80a6

                                                        SHA256

                                                        f4909abc78c3989c53fbfe119cd11d4026f36538eb29b813d0b2ad70762fd605

                                                        SHA512

                                                        6f8774807c1b40ee79c12b408f99a137e908d943f095d09b1447761119359a44b68d0b650bdb9b57aec93749f6dda49bc7d0cc2c3b7801149f6212e971107848

                                                        Download Submit

                                                      • C:\Users\Admin\AppData\Roaming\DEDFA\A811.EDF
                                                        Filesize

                                                        897B

                                                        MD5

                                                        e019b1a6659aa4ebf76a297e5f6837eb

                                                        SHA1

                                                        6caab988b7436c13f9380b18470ba2ba88576757

                                                        SHA256

                                                        90b9f5b2e098737135cd92516fa5479810848720c9fd0c92831cb0db2de600a5

                                                        SHA512

                                                        174e79150081871f0012889adccd2e717e7aef6c762be2cbef3edcf0260bb40486b3f1c3079d13ae36cef52df004ffb3cb523ca9c8d714fe5b621e414557d674

                                                        Download Submit

                                                      • memory/772-243-0x00000000047B0000-0x00000000047B1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/1680-30-0x000001C212730000-0x000001C212750000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/1680-26-0x000001C212320000-0x000001C212340000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/1680-23-0x000001C212360000-0x000001C212380000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/1820-57-0x0000000000400000-0x000000000041C000-memory.dmp

                                                        Filesize

                                                        112KB

                                                        Download

                                                      • memory/1820-58-0x0000000000450000-0x0000000000550000-memory.dmp

                                                        Filesize

                                                        1024KB

                                                        Download

                                                      • memory/1820-171-0x0000000000400000-0x000000000041C000-memory.dmp

                                                        Filesize

                                                        112KB

                                                        Download

                                                      • memory/2696-17-0x0000000004850000-0x0000000004851000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/3600-295-0x0000000004850000-0x0000000004851000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/3624-352-0x000001E2152E0000-0x000001E215300000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/3624-349-0x000001E215320000-0x000001E215340000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/3624-355-0x000001E215980000-0x000001E2159A0000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/3656-317-0x00000000034B0000-0x00000000034B1000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/3912-329-0x0000024F18020000-0x0000024F18040000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/3912-327-0x0000024F17C20000-0x0000024F17C40000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/3912-325-0x0000024F17C60000-0x0000024F17C80000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/4248-270-0x0000000004070000-0x0000000004071000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/4280-175-0x0000000000400000-0x000000000046B000-memory.dmp

                                                        Filesize

                                                        428KB

                                                        Download

                                                      • memory/4280-177-0x0000000000400000-0x000000000046B000-memory.dmp

                                                        Filesize

                                                        428KB

                                                        Download

                                                      • memory/4280-176-0x0000000000500000-0x0000000000600000-memory.dmp

                                                        Filesize

                                                        1024KB

                                                        Download

                                                      • memory/4348-61-0x0000000000400000-0x000000000046B000-memory.dmp

                                                        Filesize

                                                        428KB

                                                        Download

                                                      • memory/4348-62-0x00000000005D0000-0x00000000006D0000-memory.dmp

                                                        Filesize

                                                        1024KB

                                                        Download

                                                      • memory/4360-307-0x0000026336970000-0x0000026336990000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/4360-309-0x0000026336EE0000-0x0000026336F00000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/4360-302-0x00000263368A0000-0x00000263368C0000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/4476-341-0x0000000003F30000-0x0000000003F31000-memory.dmp

                                                        Filesize

                                                        4KB

                                                        Download

                                                      • memory/4680-251-0x000001CFA1C70000-0x000001CFA1C90000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/4680-255-0x000001CFA20F0000-0x000001CFA2110000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/4680-253-0x000001CFA1C30000-0x000001CFA1C50000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/4836-3-0x0000000000400000-0x000000000046B000-memory.dmp

                                                        Filesize

                                                        428KB

                                                        Download

                                                      • memory/4836-5-0x00000000006E0000-0x00000000007E0000-memory.dmp

                                                        Filesize

                                                        1024KB

                                                        Download

                                                      • memory/4836-7-0x0000000000400000-0x000000000046B000-memory.dmp

                                                        Filesize

                                                        428KB

                                                        Download

                                                      • memory/4836-237-0x0000000000400000-0x000000000046B000-memory.dmp

                                                        Filesize

                                                        428KB

                                                        Download

                                                      • memory/4836-2-0x00000000006E0000-0x00000000007E0000-memory.dmp

                                                        Filesize

                                                        1024KB

                                                        Download

                                                      • memory/4836-1-0x0000000000400000-0x000000000046B000-memory.dmp

                                                        Filesize

                                                        428KB

                                                        Download

                                                      • memory/4836-174-0x0000000000400000-0x000000000046B000-memory.dmp

                                                        Filesize

                                                        428KB

                                                        Download

                                                      • memory/4836-60-0x0000000000400000-0x000000000046B000-memory.dmp

                                                        Filesize

                                                        428KB

                                                        Download

                                                      • memory/4896-284-0x0000024AE0220000-0x0000024AE0240000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/4896-282-0x0000024ADFE20000-0x0000024ADFE40000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download

                                                      • memory/4896-278-0x0000024ADFE60000-0x0000024ADFE80000-memory.dmp

                                                        Filesize

                                                        128KB

                                                        Download