Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

07537a8f7e...18.exe

windows7-x64

10

07537a8f7e...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/04/2024, 09:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    07537a8f7e1a4207eb82c253fe296a8f_JaffaCakes118.exe

  • Size

    5.5MB

  • MD5

    07537a8f7e1a4207eb82c253fe296a8f

  • SHA1

    85d2beb1cd30e8342eabacb82bcdaa9f01018857

  • SHA256

    b30e0fbf03f4bc7481aae8d625a127105c8a601096408f99ed62878a9579425e

  • SHA512

    c29529f41f382b66a77952949795bb0bb48127070db97436cf1efa3538a257a0e562824177665aa570c5d11adf17ab7cc5d66f0c9aca76d8b85d82a8fb7d269a

  • SSDEEP

    98304:XfN28AUgZFJiJaOht/IIn3qWw7spWOpJoCt6XEki7/A5DDyb3dQLBDlhaHkwEA5L:vA7UgZFJiJJ/IIn1YOICtENJ5D2ZoBO7

Score
10/10
azorultkpotdiscoveryevasioninfostealerpersistencespywarestealertrojan

Malware Config

Extracted

Family

azorult

C2

http://163.172.175.132/1A6B3831-A96D-4936-815A-6F7C904EF9C0/index.php

Signatures

  • Azorult

    An information stealer that was first discovered in 2016, targeting browsing history and passwords.

    trojaninfostealerazorult
  • KPOT

    KPOT is an information stealer that steals user data and account credentials.

    trojanstealerkpot
  • KPOT Core Executable 1 IoCs
  • Drops file in Drivers directory 3 IoCs
  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 12 IoCs
  • Loads dropped DLL 3 IoCs
  • Modifies system executable filetype association 2 TTPs 4 IoCs
    persistence
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Registers COM server for autorun 1 TTPs 3 IoCs
    persistence
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Program Files directory 57 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 14 IoCs
    adwarespyware
  • Modifies registry class 32 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious use of WriteProcessMemory 56 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\07537a8f7e1a4207eb82c253fe296a8f_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\07537a8f7e1a4207eb82c253fe296a8f_JaffaCakes118.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1492
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\Setup1829.exe" /verysilent
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1212
      • C:\Users\Admin\AppData\Local\Temp\Setup1829.exe
        "C:\Users\Admin\AppData\Local\Temp\Setup1829.exe" /verysilent
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Suspicious use of WriteProcessMemory
        PID:4760
        • C:\Program Files (x86)\Crystall Idea\Uninstall Tool\1.exe
          "C:\Program Files (x86)\Crystall Idea\Uninstall Tool\1.exe" /silent
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1284
          • C:\Users\Admin\AppData\Local\Temp\is-HP6B8.tmp\1.tmp
            "C:\Users\Admin\AppData\Local\Temp\is-HP6B8.tmp\1.tmp" /SL5="$30200,3102762,185856,C:\Program Files (x86)\Crystall Idea\Uninstall Tool\1.exe" /silent
            5⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:4328
            • C:\Windows\system32\regsvr32.exe
              "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Uninstall Tool\utshellext.dll"
              6⤵
              • Loads dropped DLL
              • Modifies system executable filetype association
              • Registers COM server for autorun
              • Modifies registry class
              PID:1044
            • C:\Windows\system32\regsvr32.exe
              "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Uninstall Tool\utshellext_x86.dll"
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:532
              • C:\Windows\SysWOW64\regsvr32.exe
                /s "C:\Program Files\Uninstall Tool\utshellext_x86.dll"
                7⤵
                • Loads dropped DLL
                • Modifies system executable filetype association
                • Modifies registry class
                PID:4936
            • C:\Program Files\Uninstall Tool\UninstallTool.exe
              "C:\Program Files\Uninstall Tool\UninstallTool.exe" /install_service_silent
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4308
              • C:\Windows\SYSTEM32\rundll32.exe
                rundll32.exe setupapi.dll, InstallHinfSection DefaultInstall 132 .\CisUtMonitor.inf
                7⤵
                • Drops file in Drivers directory
                • Adds Run key to start application
                • Suspicious use of WriteProcessMemory
                PID:3316
                • C:\Windows\system32\runonce.exe
                  "C:\Windows\system32\runonce.exe" -r
                  8⤵
                  • Checks processor information in registry
                  • Suspicious use of WriteProcessMemory
                  PID:2136
                  • C:\Windows\System32\grpconv.exe
                    "C:\Windows\System32\grpconv.exe" -o
                    9⤵
                      PID:4100
              • C:\Program Files\Uninstall Tool\UninstallTool.exe
                "C:\Program Files\Uninstall Tool\UninstallTool.exe" /init
                6⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:3480
              • C:\Program Files\Uninstall Tool\UninstallTool.exe
                "C:\Program Files\Uninstall Tool\UninstallTool.exe" /add_control_panel_icon
                6⤵
                • Executes dropped EXE
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:452
              • C:\Program Files\Uninstall Tool\UninstallTool.exe
                "C:\Program Files\Uninstall Tool\UninstallTool.exe" /pin_to_taskbar
                6⤵
                • Checks computer location settings
                • Executes dropped EXE
                • Loads dropped DLL
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:2156
              • C:\Program Files\Uninstall Tool\UninstallToolExec.exe
                "C:\Program Files\Uninstall Tool\UninstallToolExec.exe"
                6⤵
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Suspicious use of WriteProcessMemory
                PID:1184
                • C:\Program Files\Uninstall Tool\UninstallTool.exe
                  "C:\Program Files\Uninstall Tool\UninstallTool.exe"
                  7⤵
                  • Checks computer location settings
                  • Executes dropped EXE
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:4216
                  • C:\Program Files\Uninstall Tool\UninstallToolHelper.exe
                    UninstallToolHelper.exe
                    8⤵
                    • Executes dropped EXE
                    PID:2312
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\File001.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2768
        • C:\Users\Admin\AppData\Local\Temp\File001.exe
          "C:\Users\Admin\AppData\Local\Temp\File001.exe"
          3⤵
          • Executes dropped EXE
          PID:3128
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\File002.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4620
        • C:\Users\Admin\AppData\Local\Temp\File002.exe
          "C:\Users\Admin\AppData\Local\Temp\File002.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:4812
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 1612
            4⤵
            • Program crash
            PID:3520
    • C:\Program Files (x86)\Internet Explorer\ielowutil.exe
      "C:\Program Files (x86)\Internet Explorer\ielowutil.exe" -CLSID:{0002DF01-0000-0000-C000-000000000046} -Embedding
      1⤵
        PID:820
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1680
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1680 CREDAT:17410 /prefetch:2
          2⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:4356
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4812 -ip 4812
        1⤵
          PID:1732

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\PROGRA~1\UNINST~2\CISUTM~1.SYS
          Filesize

          52KB

          MD5

          ce7f6aef1b27d41e7365700e74afc969

          SHA1

          eca24811ab520c1b3fc7dc07179311dc76ea8be8

          SHA256

          d03ae146525b6a0b43f9cc94cac672d65f91a57b9898e1093932561b22fdb50e

          SHA512

          e65b5871c1e711b3e3f866cb7c91fb62bde24bc6b1a1c1b5cf4a32cfd577a86b4615f44fb2bb629bca92b6e87deaa8fa6d8f0b00ad1677e3e75a3bb6dd7c6bc1

          Download Submit

        • C:\Program Files (x86)\Crystall Idea\Uninstall Tool\1.exe
          Filesize

          3.5MB

          MD5

          cc54a313a8e23a64e501056c6ba25bc7

          SHA1

          83a34de9ce945da1c8d582b322047a0ce9db1a4d

          SHA256

          1242f58b0f3825ca07e262e9c37e32731bf687374642870550bdbfb092e3bb97

          SHA512

          72092129f64a790a7a608fdb350ab6b635150ee4b4e76b694d1a2d354d505532b24b1d40b45aa9880d0d30ced7b2c3bcc9b8e779f836c13a77ed99a0da3cb3d0

          Download Submit

        • C:\Program Files (x86)\Crystall Idea\Uninstall Tool\Uninstall.exe
          Filesize

          97KB

          MD5

          9607e8cc411112371a34e7701a80b230

          SHA1

          e471940c6d0ab75ed87f41e1ebeafde459fe60b4

          SHA256

          da0d9e96f00c804e968ad99e683dcfb5a9e9703fda1291f09a9db2918c2be567

          SHA512

          d812fb36ed2df7be9e5b152a53205c5bb35979300097399b0be6f334a2cb64f62d53027cf30424eda26d0b1678ff772a792fb607b8523ce4c9098fb497d8ed2f

          Download Submit

        • C:\Program Files\Uninstall Tool\CisUtMonitor.inf
          Filesize

          2KB

          MD5

          ab33006d71573c73ea639a4d90923bf7

          SHA1

          3fb74cc71b41ca0c2abec7008e88737fef9ad66c

          SHA256

          416ca112938536cdc8191eea469479398e6ce01ec25a4830991d93142a46422f

          SHA512

          35df4cad9d9cfecc1e649b25daa052141d530dfafc57607fc806e3b7267fb802529867bbf5c508b14f82ac320a472d883b7e62fef081dfe865d7a1c61c77cc32

          Download Submit

        • C:\Program Files\Uninstall Tool\UninstallTool.exe
          Filesize

          4.6MB

          MD5

          07acf83bda719741025b34a0671fc754

          SHA1

          426e6e512fb52290f49bd606a05bf12abb05e7ba

          SHA256

          61d9f616d3c1f22df0e7668e181b1c7910ea48a51b57519837dd5cadebc1cf04

          SHA512

          f27f17ccb2c486310fa1ee33115d349fa7a7708b5be216366a9ecc031d6d1a84073604446624568230fbcd4792beb6112f4b9f960213b517d5ba22a9ec26366a

          Download Submit

        • C:\Program Files\Uninstall Tool\UninstallToolExec.exe
          Filesize

          218KB

          MD5

          ccda58e3bcd4da4fe22d5e80c3cfb27f

          SHA1

          71c23b3b6bc611d0030dde422d98e4a3659a4319

          SHA256

          f52683e6b16634a5ed2f5e99ec1d6e1f1d585e7f3feae88a47b200fea70375a7

          SHA512

          52a1bb1dbf2e50c66cca1aa81583daa0e1e55b42f6940334c5ed524e65d71bd3c49742f9664dd436772f3fc37406b800cb9284ab55b03814d61b5003a62f11ca

          Download Submit

        • C:\Program Files\Uninstall Tool\UninstallToolHelper.exe
          Filesize

          423KB

          MD5

          4d454f8abe7860306da91c55ba9be042

          SHA1

          a83ce432ada547eac181e20e0249ea9c4b484843

          SHA256

          d323ce72e2cf82f061b4a62dfc212472f7850b4dffd3658193298c2232a04d0b

          SHA512

          1f099152c4f81135a18a5c8b52f4543505dba145c16879f37ff62815cd5adccd9b332d3b9164736acb411443f05ce4ef3e89c2d605e94b3593e770f0f8dce21b

          Download Submit

        • C:\Program Files\Uninstall Tool\languages\English.xml
          Filesize

          36KB

          MD5

          0fdb3264d678d048ecae17799df05cb4

          SHA1

          df4887043e8f437aa2a879b47772040f8347fc9f

          SHA256

          cd9a38aa64c6cfa2391a5f89b0c7cdf4cbfd63bf6d69d6620f12c736ce4d5892

          SHA512

          a4c9e76fd22c1ec8e44193d26355f6fdb067e6bdfe2084f6993ddbb18d790dacc71d6c9e28553dc6118ec31a96e9241cc5d38db6b53671ad6a69576ba611dedd

          Download Submit

        • C:\Program Files\Uninstall Tool\utshellext.dll
          Filesize

          379KB

          MD5

          b45a9b037e1686b7c217bc406bc933af

          SHA1

          c3ef67fb58ced40c1312f0855d5c897c08b4e1bb

          SHA256

          e589ba19b06772570ab1d36675fe1f0a201760f6b16f1a1f3b374b695070fe7f

          SHA512

          6b47f29d9df2ab22735bfe7cede43ac3af7cefc75a58c90daeebf10c2e5fd92a1132f035d78e47573524ad0091152422779b74957be897e6777ef6a9de065919

          Download Submit

        • C:\Program Files\Uninstall Tool\utshellext_x86.dll
          Filesize

          335KB

          MD5

          2f9c5a77aec3e3e4387320267d996f89

          SHA1

          a023bd77be6784e80b6381010e5a867c5f7ce542

          SHA256

          595df900ddd426ba124198782a027a09d356cfe7924b7f69fa51696377535e0f

          SHA512

          f283d6a163ad08348a35c347dd7f0c92746a6ebfb9709e8029f608eb0ba97309726c7aa17414f58a77672e56d8c6dacc062a537ab44dd552bc9110e726b1c220

          Download Submit

        • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Uninstall Tool\UnÑ–nstall Tool.lnk
          Filesize

          945B

          MD5

          2735d476771cc00ef345f41e9ffa4459

          SHA1

          6691a12311f026a90d5313fadcd1e2148ea65445

          SHA256

          4940d64b99da9d1e2af0f929708d2ddc86fbf92b310b343eb215ded44ae8efe3

          SHA512

          7cd6c455a021a49c0aa94803d532f27f51168c0232c6b700aaf58125377cf939453e799b504dc014f8ca303213827a623ee29a472ac7fa30d1e6e912b887a653

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\File001.exe
          Filesize

          481KB

          MD5

          3372d01659f43b8dffd5b14914b03890

          SHA1

          9c09efd4ff70674eafd1238525fc1bb127948404

          SHA256

          68d658155beff9b517aae6a26c3735c26ca6e1e026089403876e188cb23848a6

          SHA512

          5830689beaf260f2cbdc0d90029bf0b73246cf46f3346e4825c8d6613ce92c926132de35f9fe016f00441a5aa79a7c4288f6883566c15e54d89422dc2ea1dada

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\File002.exe
          Filesize

          195KB

          MD5

          71ca31e32c62557a91c072255c79b9ad

          SHA1

          1c03cc0471ac7b289b49f4ef9b2691d4282d3f5c

          SHA256

          59b790491d763421741300e1473d1d302ad96130cc26c1c87edaf7469d4d5885

          SHA512

          13691125da737a3915784db6ef9e990850ebb6f78c034ab98ca9676f9bf4b1b2b7bc8195f00e0a47d598c0a84582c7bf3291d1691d099c4374e7b1a1beba5876

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\Setup1829.exe
          Filesize

          3.7MB

          MD5

          811c36d10c8cb9d7eb4023755939c389

          SHA1

          f77c8cc3369d341fe5f4e8a0ada22aacbe5dd2d6

          SHA256

          0b37b021a61d3352ff8e5d43f185d08ad1245938ab22123c9b58d661ff731620

          SHA512

          c16cb83746b0108566d2c74c86cafd03ded6cc6d57fd0e71f44598f8ad72fed03ebe6f2d4fa4d33937477656e1231bb38104a53ff26a9ce744c08e57d07effe7

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\is-HP6B8.tmp\1.tmp
          Filesize

          1.2MB

          MD5

          b7d0813e1f27e5b6b01b65a518731759

          SHA1

          b942b56e9cf826ea46c7e27b139f75e6d2605cfc

          SHA256

          7c0a7db43a4b649b3cd9e5ca8c1e0041a167a7339668b75dd1ec1c972b20fac4

          SHA512

          cbb7d217197af7ac375910df142d09c68d1c118f4e44652339494a1de5d7d57cc223c0b08d62597b66d01a6fba325ea1c94cce11d4bce128e0e7c1d03ecf1604

          Download Submit

        • C:\Users\Admin\AppData\Roaming\CrystalIdea Software\Uninstall Tool\CachedData.dat
          Filesize

          2KB

          MD5

          65b65862d48178a71d0cb4da54b62c96

          SHA1

          4b19796cf5fc94d30788ee61ced090d1d6ac299f

          SHA256

          647f68b03c9a5d7f21d2a0c27f5bbd72d8559ab4e17a365e24be937155f5c033

          SHA512

          a37d98cb6deb56ee9fdde13c91bca88e918ff7041632373730ce447fb8e2443cbcf5f43b69c99c542d2bdc96ec2dd8157a9438956d812d106239b11be0782384

          Download Submit

        • C:\Users\Admin\AppData\Roaming\CrystalIdea Software\Uninstall Tool\preferences.xml
          Filesize

          1KB

          MD5

          b686c239de5bc638271322d247c89bb4

          SHA1

          4986d1748bf439e299f19bf64df4d721770cfb77

          SHA256

          c0af4a2d740c7a45a69ff544b5173ad1ea6038e75af87b5306242f30fd3a6882

          SHA512

          ab2d036746e4f25f38710b26594a9fd463600d63da2d6ad8fcc0553f39c162738ed43e39b507e729690c67be993e34ee99d0cc13688532a79fb9a35a3350e067

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\269c0465f0b4b6ee.customDestinations-ms
          Filesize

          1KB

          MD5

          f67b90fc9441580b7e1a13fa66638e2d

          SHA1

          70852dec6239ab4749538c25217dc8d383641c4b

          SHA256

          706841416b4dd847c7a6740583cb14ca9213d188056c44251bab90b589722e08

          SHA512

          ac54b9dcc0767fcf47066b68f6dc856bd89fc650dc98d600ccc8bfa28c9b35f8150086432cf949011a065681a83aebc4d95a15ac2fbce0415a81d0241429528d

          Download Submit

        • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\269c0465f0b4b6ee.customDestinations-ms
          Filesize

          1KB

          MD5

          1554d1be8b28d4ff1c2cb12ed8e33ee9

          SHA1

          8fd74e7961d16d00a4f86bded326f80addde04b4

          SHA256

          d54a993d6f4d19a300d4e3009e6add0155a21e1398be69ce36a5a361efbe81e0

          SHA512

          f5c454787d233f97de25c4f752f8060a0c9c9cd6b13c84d2600e6437443de61bfb7a61dab2455c1c4569d7c6f45ed6d546eb1c101a64ed35d0eaec6252d600e9

          Download Submit

        • memory/1284-237-0x0000000000400000-0x0000000000437000-memory.dmp

          Filesize

          220KB

          Download

        • memory/1284-42-0x0000000000400000-0x0000000000437000-memory.dmp

          Filesize

          220KB

          Download

        • memory/1492-0-0x0000000000400000-0x0000000000FAB000-memory.dmp

          Filesize

          11.7MB

          Download

        • memory/1492-3-0x00000000779A0000-0x00000000779A1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1492-1-0x0000000000400000-0x0000000000FAB000-memory.dmp

          Filesize

          11.7MB

          Download

        • memory/1492-272-0x0000000000400000-0x0000000000FAB000-memory.dmp

          Filesize

          11.7MB

          Download

        • memory/1492-271-0x0000000001460000-0x00000000014BF000-memory.dmp

          Filesize

          380KB

          Download

        • memory/1492-270-0x0000000001460000-0x00000000014BF000-memory.dmp

          Filesize

          380KB

          Download

        • memory/2312-247-0x0000000000400000-0x000000000046B000-memory.dmp

          Filesize

          428KB

          Download

        • memory/2312-274-0x0000000000400000-0x000000000046B000-memory.dmp

          Filesize

          428KB

          Download

        • memory/3128-32-0x0000000000400000-0x000000000047D000-memory.dmp

          Filesize

          500KB

          Download

        • memory/3128-273-0x0000000000400000-0x000000000047D000-memory.dmp

          Filesize

          500KB

          Download

        • memory/3128-277-0x0000000000400000-0x000000000047D000-memory.dmp

          Filesize

          500KB

          Download

        • memory/3128-280-0x0000000000400000-0x000000000047D000-memory.dmp

          Filesize

          500KB

          Download

        • memory/4328-236-0x0000000000400000-0x000000000053D000-memory.dmp

          Filesize

          1.2MB

          Download

        • memory/4760-41-0x0000000000400000-0x0000000000433000-memory.dmp

          Filesize

          204KB

          Download

        • memory/4812-229-0x0000000000400000-0x0000000000919000-memory.dmp

          Filesize

          5.1MB

          Download