72d3eea8dae999596f79b0aef2d8ba8f1c1a47633809db34158e53ed7eb1b48f

Analysis

max time kernel
138s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2024, 19:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

72d3eea8dae999596f79b0aef2d8ba8f1c1a47633809db34158e53ed7eb1b48f.exe
Size

8.0MB
MD5

1df2e3f5b6b4ab7b9624d24786c13418
SHA1

946f6d664b691a8924b3a842303d1eca16448380
SHA256

72d3eea8dae999596f79b0aef2d8ba8f1c1a47633809db34158e53ed7eb1b48f
SHA512

042babb37047fd743f44c85210cb4a11965a82bd264372c94b96e460e8ffa87418c06f73be2b4d6156a3c23382b6613885eb3d0441b1d17907b3cc5a9d4d10ac
SSDEEP

196608:G16TAZIPhQ2QKVWsHLI1bK2Q+7u/A/tinN0vV4Y:G17IPKTKcV1nQ+7u/A/tiWV4Y

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 9 IoCs

pid	Process
1580	alg.exe
1392	elevation_service.exe
776	elevation_service.exe
4128	maintenanceservice.exe
1828	OSE.EXE
3280	DiagnosticsHub.StandardCollector.Service.exe
3512	fxssvc.exe
1976	msdtc.exe
2460	PerceptionSimulationService.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	72d3eea8dae999596f79b0aef2d8ba8f1c1a47633809db34158e53ed7eb1b48f.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\58264791a5bf65ce.bin	alg.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	alg.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F35FF801-892D-4097-8445-619F9779BCC8}\Policy = "3"	72d3eea8dae999596f79b0aef2d8ba8f1c1a47633809db34158e53ed7eb1b48f.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F35FF801-892D-4097-8445-619F9779BCC8}	72d3eea8dae999596f79b0aef2d8ba8f1c1a47633809db34158e53ed7eb1b48f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F35FF801-892D-4097-8445-619F9779BCC8}\AppName = "72d3eea8dae999596f79b0aef2d8ba8f1c1a47633809db34158e53ed7eb1b48f.exe"	72d3eea8dae999596f79b0aef2d8ba8f1c1a47633809db34158e53ed7eb1b48f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F35FF801-892D-4097-8445-619F9779BCC8}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp"	72d3eea8dae999596f79b0aef2d8ba8f1c1a47633809db34158e53ed7eb1b48f.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
680	Process not Found
680	Process not Found

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3696	72d3eea8dae999596f79b0aef2d8ba8f1c1a47633809db34158e53ed7eb1b48f.exe
Token: SeDebugPrivilege	1580	alg.exe
Token: SeDebugPrivilege	1580	alg.exe
Token: SeDebugPrivilege	1580	alg.exe
Token: SeTakeOwnershipPrivilege	1392	elevation_service.exe
Token: SeAuditPrivilege	3512	fxssvc.exe

C:\Users\Admin\AppData\Local\Temp\72d3eea8dae999596f79b0aef2d8ba8f1c1a47633809db34158e53ed7eb1b48f.exe
"C:\Users\Admin\AppData\Local\Temp\72d3eea8dae999596f79b0aef2d8ba8f1c1a47633809db34158e53ed7eb1b48f.exe"
1⤵
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
PID:3696

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:1580

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1392

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:776

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1828

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4128

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:3280

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:3600

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3512

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
PID:1976

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:2460

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
PID:3560

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:4140

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
PID:2228

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:4372

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
PID:2548

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:4412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4984

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:2204

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:3712

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:3716

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2496

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
PID:2348
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:5336
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
  2⤵
  PID:5360

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:3780

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:1592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
1.4MB

MD5
e15c5a41c701865f29d54b71b1dbba27

SHA1
249845484a909c3d42224f68fc7beed4020a472c

SHA256
3c9e60405c0cd1b9cbede96f65ea3253677c922c446a18dc5d0f4deaa0130bac

SHA512
c80c92414f2eb17c589597b67f6d39be8d9811789312c307623c6a9c63ce54e9337757df9a929a8553d1c3a4dbafbf7feb86766fc49b5f637ec0c0d1d308eb04

Download Submit
C:\Windows\SysWOW64\perfhost.exe

Filesize
833KB

MD5
a574a32243f2dd3c26d8376281fa7384

SHA1
f553921de7d87a9e2ba22bee7a1dc3ee9950320a

SHA256
3629fe6cd78f5e32237ca55625453e200392f936a47ca00f657e011902a3a6da

SHA512
dc443c76d33ec1026794696b94f31952551e697cabe60c96502f0c3ada377cf1ae2f45062ac60139be35813d515ab04a997b892b48fe3e975d734168529464a8

Download Submit
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

Filesize
1.3MB

MD5
6121e70933a2ee71b0cc0557b6f20265

SHA1
6710fbdb1f96492c88da28380d860cf7816ef70d

SHA256
ab5b6535c42f8b51b041ec1dbcc5f1b934a49fb069d42f254d2aaebd25dbfd3b

SHA512
fd91ecf4b7a4da792b27cee019e0afe9f0854f48c211547b68c78c3749c4b057e572f560612e8d751c1a116c536a5e298ea3a20dab1b6d2db013c51eafe96622

Download Submit
C:\Windows\System32\FXSSVC.exe

Filesize
1.2MB

MD5
9ca536b7bcf88d628eb82a54bd12122e

SHA1
36e170ae2efc977a8dcdd4e328358e81b7841457

SHA256
695e6fee3136cc3890cfae24c1f4fcb3142623bc46769d951d2144abd6de4be2

SHA512
48443c7a367c6579542c68ddcaa074227c0448d9f540bdde9316976b76965d5a6f76a6b9c5dc51762d18c65c14217e2ea7f5cce893dc03b90633140543ebf22b

Download Submit
C:\Windows\System32\Locator.exe

Filesize
405KB

MD5
c562273f79ab5c0102116137f93d45c3

SHA1
74f92d7bf078e20950e6de1f08dea669dbb4ac9c

SHA256
b5b85a877faaed927199664f7f7df8f29a985bd92b845b7c3f5aedbbcc3f89ee

SHA512
7fe04ed003a4093a36d1ec84d6459001b2f19cf0cd0481bdddf452e067985ffd705cbdfc7022b070ab1de7f3a9d77d6b86b09b7baed88f22a29e31da74c657f8

Download Submit
C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

Filesize
1.3MB

MD5
c573e56512cea6fb844d2d54fa359662

SHA1
017e245c78f663c6dca57cbb46c660cb26821049

SHA256
f23d9896d8490eab108352492e2231377cd597de39811e85c6c76db2b408dbf4

SHA512
ac513dc2dfbd737934f56a01aff7a180f7ec5a33de7c50ae443f2e3423889bbad7bd670780bcb03a050c6a8f3e983ffa9f8b92d3df49f193bf3f8557a51ffbe3

Download Submit
C:\Windows\System32\SensorDataService.exe

Filesize
92KB

MD5
f7e751de2663b59193d848dcc91f440c

SHA1
2230bc2c22cefdc0baafbb09a2f6a86a7e067e6c

SHA256
16dc557a586cf42275401053c60ccfc612dd62f160d88960e35cb9cb8513f30f

SHA512
c854756b5f3a706c614a5287a6752e50aaa3da0c743e6a0b6fd9c2ffb6dd9bfd5395b0e424f2d5335df6e04284e3b5e6eceaa7a47a3165afc30030ec8bdc6aab

Download Submit
C:\Windows\System32\alg.exe

Filesize
103KB

MD5
abc4bd0d4b3dfe85b247c97f839fcae5

SHA1
257a4aaceb8f556b6f47ad92fbf6cb6040e8146f

SHA256
d8284183af29eb78b2eaf40c1d7da715c2e5335b1c851ff63f8278e53c5a5718

SHA512
c57a0917da0612cacf3ad45a8799b7b24f925eb0cb2fe60fe978535a361a8a15fdc155e96c03a9eee14e13a8795db9e4561c61a16ed491863d1300930c23c27a

Download Submit
C:\Windows\System32\msdtc.exe

Filesize
1.3MB

MD5
0a9c27c5bf34f17409520c4dcc248a8d

SHA1
e3eb61d8cf9f25e94d30246719a217f7d6c0836f

SHA256
7e6f5d4a8607960dc76be0940bb6e13cb02693bb84c3083c67a5195aac344034

SHA512
261a4e78b3de2526f1273c5fb31811ecf701da33bc016e6bcef152ac0ca3c401f57ade70a603ee82fad1b10afc1d3358947e0310b6f1bcc950437b509527c644

Download Submit
memory/776-39-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/776-46-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/776-197-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/776-40-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/1392-35-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Filesize
384KB

Download
memory/1392-29-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/1392-28-0x0000000000D40000-0x0000000000DA0000-memory.dmp

Filesize
384KB

Download
memory/1392-196-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/1580-149-0x0000000140000000-0x00000001401E9000-memory.dmp

Filesize
1.9MB

Download
memory/1580-14-0x0000000140000000-0x00000001401E9000-memory.dmp

Filesize
1.9MB

Download
memory/1580-23-0x0000000000500000-0x0000000000560000-memory.dmp

Filesize
384KB

Download
memory/1580-16-0x0000000000500000-0x0000000000560000-memory.dmp

Filesize
384KB

Download
memory/1580-22-0x0000000000500000-0x0000000000560000-memory.dmp

Filesize
384KB

Download
memory/1592-401-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/1592-538-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/1592-409-0x0000000000AF0000-0x0000000000B50000-memory.dmp

Filesize
384KB

Download
memory/1828-73-0x00000000008D0000-0x0000000000930000-memory.dmp

Filesize
384KB

Download
memory/1828-65-0x00000000008D0000-0x0000000000930000-memory.dmp

Filesize
384KB

Download
memory/1828-198-0x0000000140000000-0x000000014020E000-memory.dmp

Filesize
2.1MB

Download
memory/1828-66-0x0000000140000000-0x000000014020E000-memory.dmp

Filesize
2.1MB

Download
memory/1976-272-0x0000000140000000-0x00000001401F8000-memory.dmp

Filesize
2.0MB

Download
memory/1976-312-0x0000000140000000-0x00000001401F8000-memory.dmp

Filesize
2.0MB

Download
memory/1976-281-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Filesize
384KB

Download
memory/2204-439-0x0000000140000000-0x0000000140221000-memory.dmp

Filesize
2.1MB

Download
memory/2204-371-0x0000000140000000-0x0000000140221000-memory.dmp

Filesize
2.1MB

Download
memory/2204-379-0x00000000008A0000-0x0000000000900000-memory.dmp

Filesize
384KB

Download
memory/2228-318-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/2228-326-0x0000000000760000-0x00000000007C0000-memory.dmp

Filesize
384KB

Download
memory/2228-382-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/2348-452-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/2348-461-0x00000000006B0000-0x0000000000710000-memory.dmp

Filesize
384KB

Download
memory/2460-286-0x0000000140000000-0x00000001401EA000-memory.dmp

Filesize
1.9MB

Download
memory/2460-294-0x0000000000680000-0x00000000006E0000-memory.dmp

Filesize
384KB

Download
memory/2460-350-0x0000000140000000-0x00000001401EA000-memory.dmp

Filesize
1.9MB

Download
memory/2496-447-0x00000000004C0000-0x0000000000520000-memory.dmp

Filesize
384KB

Download
memory/2496-441-0x0000000140000000-0x0000000140205000-memory.dmp

Filesize
2.0MB

Download
memory/2548-352-0x0000000000660000-0x00000000006C0000-memory.dmp

Filesize
384KB

Download
memory/2548-342-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/2548-412-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/3280-251-0x00000000006C0000-0x0000000000720000-memory.dmp

Filesize
384KB

Download
memory/3280-283-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/3280-244-0x00000000006C0000-0x0000000000720000-memory.dmp

Filesize
384KB

Download
memory/3280-245-0x0000000140000000-0x00000001401E8000-memory.dmp

Filesize
1.9MB

Download
memory/3512-256-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Filesize
384KB

Download
memory/3512-264-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Filesize
384KB

Download
memory/3512-255-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/3512-270-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/3512-271-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Filesize
384KB

Download
memory/3560-365-0x0000000000400000-0x00000000005D6000-memory.dmp

Filesize
1.8MB

Download
memory/3560-301-0x0000000000400000-0x00000000005D6000-memory.dmp

Filesize
1.8MB

Download
memory/3696-6-0x0000000000DF0000-0x0000000000E57000-memory.dmp

Filesize
412KB

Download
memory/3696-7-0x0000000000DF0000-0x0000000000E57000-memory.dmp

Filesize
412KB

Download
memory/3696-15-0x0000000000400000-0x0000000000C0F000-memory.dmp

Filesize
8.1MB

Download
memory/3696-0-0x0000000000400000-0x0000000000C0F000-memory.dmp

Filesize
8.1MB

Download
memory/3696-1-0x0000000000DF0000-0x0000000000E57000-memory.dmp

Filesize
412KB

Download
memory/3712-396-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/3712-383-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/3712-392-0x0000000000750000-0x00000000007B0000-memory.dmp

Filesize
384KB

Download
memory/3712-397-0x0000000000750000-0x00000000007B0000-memory.dmp

Filesize
384KB

Download
memory/3716-435-0x0000000000C00000-0x0000000000C60000-memory.dmp

Filesize
384KB

Download
memory/3716-428-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/3780-422-0x0000000000580000-0x00000000005E0000-memory.dmp

Filesize
384KB

Download
memory/3780-414-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/4128-57-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Filesize
384KB

Download
memory/4128-50-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Filesize
384KB

Download
memory/4128-51-0x0000000140000000-0x0000000140209000-memory.dmp

Filesize
2.0MB

Download
memory/4128-60-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Filesize
384KB

Download
memory/4128-62-0x0000000140000000-0x0000000140209000-memory.dmp

Filesize
2.0MB

Download
memory/4140-369-0x0000000140000000-0x00000001401D4000-memory.dmp

Filesize
1.8MB

Download
memory/4140-304-0x0000000140000000-0x00000001401D4000-memory.dmp

Filesize
1.8MB

Download
memory/4140-313-0x0000000000680000-0x00000000006E0000-memory.dmp

Filesize
384KB

Download
memory/4372-339-0x0000000000760000-0x00000000007C0000-memory.dmp

Filesize
384KB

Download
memory/4372-331-0x0000000140000000-0x00000001401D5000-memory.dmp

Filesize
1.8MB

Download
memory/4372-399-0x0000000140000000-0x00000001401D5000-memory.dmp

Filesize
1.8MB

Download
memory/4412-366-0x0000000000440000-0x00000000004A0000-memory.dmp

Filesize
384KB

Download
memory/4412-357-0x0000000140000000-0x0000000140241000-memory.dmp

Filesize
2.3MB

Download
memory/4412-426-0x0000000140000000-0x0000000140241000-memory.dmp

Filesize
2.3MB

Download
memory/5360-546-0x0000020738BA0000-0x0000020738BB0000-memory.dmp

Filesize
64KB

Download
memory/5360-545-0x00000207380A0000-0x00000207380B0000-memory.dmp

Filesize
64KB

Download