Overview

overview

10

Static

static

10

eaebce2b99...18.exe

windows7-x64

10

eaebce2b99...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    19-09-2024 08:14

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    eaebce2b9917a560ddd79922aea1597b_JaffaCakes118.exe

  • Size

    807KB

  • MD5

    eaebce2b9917a560ddd79922aea1597b

  • SHA1

    1fa5a717ba8f2cfaedb676dcc1603848dccc57bd

  • SHA256

    cee537907eb28082f4e544c6249f835fe88badda4e17d5223d510d94037797da

  • SHA512

    d43e21bd8611ab0328e2dc7b8bb9761daccfbe17aa1ed47549aec030c379062602c947960b3f08a30cee7a7df58837e9398c5095b5f0f2255b7bc3fe7127f02a

  • SSDEEP

    24576:FYkjlUgR+tmbs1t9qgYohxfloUZhjaoJKwbgy:FYsUhtmMKcoUvPJKwbgy

Score
10/10
modiloaderponycredential_accessdiscoveryevasionpersistenceratspywarestealertrojanupx

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • ModiLoader Second Stage 9 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • UPX packed file 17 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 54 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 2 IoCs
  • Maps connected drives based on registry 3 TTPs 4 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 23 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 18 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\csrss.exe
    %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
    1⤵
    • Executes dropped EXE
    • Drops desktop.ini file(s)
    • Suspicious use of UnmapMainImage
    PID:336
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    1⤵
      PID:852
    • C:\Windows\Explorer.EXE
      C:\Windows\Explorer.EXE
      1⤵
        PID:1200
        • C:\Users\Admin\AppData\Local\Temp\eaebce2b9917a560ddd79922aea1597b_JaffaCakes118.exe
          "C:\Users\Admin\AppData\Local\Temp\eaebce2b9917a560ddd79922aea1597b_JaffaCakes118.exe"
          2⤵
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1660
          • C:\Users\Admin\AppData\Local\Temp\eaebce2b9917a560ddd79922aea1597b_JaffaCakes118.exe
            eaebce2b9917a560ddd79922aea1597b_JaffaCakes118.exe
            3⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1384
            • C:\Users\Admin\eQDewf74.exe
              C:\Users\Admin\eQDewf74.exe
              4⤵
              • Modifies visiblity of hidden/system files in Explorer
              • Executes dropped EXE
              • Loads dropped DLL
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:2856
              • C:\Users\Admin\duofue.exe
                "C:\Users\Admin\duofue.exe"
                5⤵
                • Modifies visiblity of hidden/system files in Explorer
                • Executes dropped EXE
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of SetWindowsHookEx
                PID:2216
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c tasklist&&del eQDewf74.exe
                5⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2144
                • C:\Windows\SysWOW64\tasklist.exe
                  tasklist
                  6⤵
                  • Enumerates processes with tasklist
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2756
            • C:\Users\Admin\aihost.exe
              C:\Users\Admin\aihost.exe
              4⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2940
              • C:\Users\Admin\aihost.exe
                aihost.exe
                5⤵
                • Executes dropped EXE
                • Maps connected drives based on registry
                • Suspicious behavior: EnumeratesProcesses
                PID:2752
            • C:\Users\Admin\bihost.exe
              C:\Users\Admin\bihost.exe
              4⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1780
              • C:\Users\Admin\bihost.exe
                bihost.exe
                5⤵
                • Executes dropped EXE
                • Maps connected drives based on registry
                • Suspicious behavior: EnumeratesProcesses
                PID:2420
            • C:\Users\Admin\cihost.exe
              C:\Users\Admin\cihost.exe
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Adds Run key to start application
              • Drops file in Program Files directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:2972
              • C:\Users\Admin\cihost.exe
                C:\Users\Admin\cihost.exe startC:\Users\Admin\AppData\Roaming\7D1AB\27265.exe%C:\Users\Admin\AppData\Roaming\7D1AB
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2536
              • C:\Users\Admin\cihost.exe
                C:\Users\Admin\cihost.exe startC:\Program Files (x86)\ABAFA\lvvm.exe%C:\Program Files (x86)\ABAFA
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:2844
              • C:\Program Files (x86)\LP\6587\474D.tmp
                "C:\Program Files (x86)\LP\6587\474D.tmp"
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:484
            • C:\Users\Admin\dihost.exe
              C:\Users\Admin\dihost.exe
              4⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1816
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\system32\cmd.exe"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:764
            • C:\Users\Admin\eihost.exe
              C:\Users\Admin\eihost.exe
              4⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:676
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c tasklist&&del eaebce2b9917a560ddd79922aea1597b_JaffaCakes118.exe
              4⤵
              • Deletes itself
              • System Location Discovery: System Language Discovery
              PID:2424
              • C:\Windows\SysWOW64\tasklist.exe
                tasklist
                5⤵
                • Enumerates processes with tasklist
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:2140
      • C:\Windows\system32\msiexec.exe
        C:\Windows\system32\msiexec.exe /V
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:808
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
        • Boot or Logon Autostart Execution: Active Setup
        • Modifies registry class
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:400
      • C:\Windows\system32\DllHost.exe
        C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
        1⤵
          PID:3040
        • C:\Windows\system32\AUDIODG.EXE
          C:\Windows\system32\AUDIODG.EXE 0x5c0
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:536

        Network

        MITRE ATT&CK Enterprise v15

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Persistence

        Boot or Logon Autostart Execution

        2
        T1547

        Active Setup

        1
        T1547.014

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Privilege Escalation

        Boot or Logon Autostart Execution

        2
        T1547

        Active Setup

        1
        T1547.014

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Defense Evasion

        Hide Artifacts

        1
        T1564

        Hidden Files and Directories

        1
        T1564.001

        Modify Registry

        4
        T1112

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        3
        T1552

        Credentials In Files

        3
        T1552.001

        Discovery

        Peripheral Device Discovery

        1
        T1120

        Process Discovery

        1
        T1057

        Query Registry

        3
        T1012

        System Information Discovery

        2
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        Lateral Movement

        Collection

        Data from Local System

        2
        T1005

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Roaming\7D1AB\BAFA.D1A
          Filesize

          600B

          MD5

          24443449accc8d18b82522fadfc3b11a

          SHA1

          13b5a5d228f4b38a2a9162aa59798b7c5c88c8ee

          SHA256

          c89d3a79c10c5cf222845d658312ea5ed1af0e5ef26c74bb615f185f074657fa

          SHA512

          da2346934099385dbc333ff5a766837e0b755c0f80fef040a4cd4a10b1e1453f0dd2bfa3e11db9ab66dc5739de87ca6c962c9a0b4f5106a59df4d8f80b7c6b52

          Download Submit

        • C:\Users\Admin\AppData\Roaming\7D1AB\BAFA.D1A
          Filesize

          996B

          MD5

          f96318d2c9d720b1d0a603971372f877

          SHA1

          607f1518e88063f0bcf8e9576fd420def60ea85e

          SHA256

          b1e9afae59bc9a497955bf4d65956f9817820fb51a88d452d2e0d10375ab3c75

          SHA512

          7c08c7843c3b1a1600954ddabf85be039d8252205d396ac8580f38d9ae9734d0b9885445733c68fb91adedd6c8c9584b80f9f788dc359e89acd2bc33c58ebe1e

          Download Submit

        • C:\Users\Admin\AppData\Roaming\7D1AB\BAFA.D1A
          Filesize

          1KB

          MD5

          fa5b9a7d536d534eb157e434c52f75f1

          SHA1

          63d16b22582f34083747b18e175403d1d67c5c8e

          SHA256

          6f3a65d1a68e0b3bc049285e4741bd39f4abb65d51f0b9e0fbe944e233bef045

          SHA512

          3591fd8c214f8963f1add432221399a155039282d55a6969c2b0a895b2dc961f811b0beb9d1f52561a94a3117b7e2463653466f0951d50553ee264bf23d21b25

          Download Submit

        • C:\Users\Admin\duofue.exe
          Filesize

          180KB

          MD5

          2508592718c81785ed3fbd6208d82993

          SHA1

          4fa63ffd4d942757f96f454f2b3f0bd0407699f1

          SHA256

          da5eee4dc36bc15a734a92e7d0868b360831a3a1f6de7071a85cc04bca32bcca

          SHA512

          e7ef6cecc2e7b0b74f9292b016d8cbf7f6c1895df91cae2cd970051e2e4f56d3508c9d8ff9a45fc2c978034858ad33397df6f97195d22d69d5a4a96426b6e63e

          Download Submit

        • C:\Windows\system32\consrv.dll
          Filesize

          53KB

          MD5

          63e99b675a1337db6d8430195ea3efd2

          SHA1

          1baead2bf8f433dc82f9b2c03fd65ce697a92155

          SHA256

          6616179477849205eb4075b75a042056d196f45d67f78929dbb3317a35ccbea9

          SHA512

          f5b986eafa38dbc9ad7759784ac887ecbb9c8d8009a3f33e91b9c9ceeaf043ed3e4ddab8e6b6b77e54aed9fcecab02442c8ff253f2136ea06996d05ddd68199f

          Download Submit

        • \??\globalroot\systemroot\assembly\temp\@
          Filesize

          2KB

          MD5

          9909e4cbd44b3dafc0ccffd12c257d59

          SHA1

          3a16e01a5ce36beca06bd84e6c7de8930d45efcd

          SHA256

          9b78591fc3a55baac3b4a8f9c9f8358e91c436a7902faf8b76524069cbd9b156

          SHA512

          f0c2274a42d332a3778bd927038000cde9df1b9d1678eddba808e780abe2622ab79eb951e1dc752f42192f117531ad320ce823658938f2bf2f0ecda50c143e28

          Download Submit

        • \Program Files (x86)\LP\6587\474D.tmp
          Filesize

          100KB

          MD5

          4c04ec47c44bc997519e18ce5f20e9d6

          SHA1

          680968fe85eaa19ac68b8dabf3371dd81684ed83

          SHA256

          446ddf0822deef56cedbfa0910143c744835ed765d128408d9ea994a569581a2

          SHA512

          e33e959e25d09152c1f64d60a7733f7c7a1dfd9f0bee6ed1f8aa18cf5e5248442e365d211c4555e0723b4e23e97c0a99d43b8fe6538cc9c77f0d39fd73616279

          Download Submit

        • \Users\Admin\aihost.exe
          Filesize

          229KB

          MD5

          c7b9733430c4bf7f56a0c89d7f2dd9cf

          SHA1

          0a894c98e17a8c81a378a37c2230cf188932d21e

          SHA256

          8047916855a52a9b5e97c010e8fc2dc01a9ed91d2798a6869f8669ea4a92940d

          SHA512

          4aefe0746e896c00bc908128ba63e13d2abed9e839d13da14042365afb81d85bf75537292f7323a56694258ddec7a88b57202721b62651cfcbef2932c0cb2464

          Download Submit

        • \Users\Admin\bihost.exe
          Filesize

          119KB

          MD5

          386fef8fdb975e7c102921910db7f9fb

          SHA1

          cdf3f86411189db08c8c0f887f26c2572ecc0889

          SHA256

          ae06d784c51702aff587d235d48de3b1162872069fac4602d921d023527efae0

          SHA512

          6ab8c2721c81bdff414e8cdbd7ca006abf3ed8c0155510d6c92555885038f33c1cf08372302b6465196f69aa15a7305fb05eb2e12026f1fc96a797646b8d2352

          Download Submit

        • \Users\Admin\cihost.exe
          Filesize

          279KB

          MD5

          4df3241b8f53ad2d1c0bba6dc1b97e02

          SHA1

          f0c43893143a3442a453f56c9c4f740941b1d097

          SHA256

          407e0425757e28262c3054c1dc981a9f41cf83cd67ecfbf37d3b8fe74db54199

          SHA512

          e90e4a8b708fb9d3213f73e641fa39625a38fa969270ef1123206fb30d04837f018b9838aa02a234265c0b9ba765f567b748a7b73c437b96daba7a15e5e38663

          Download Submit

        • \Users\Admin\dihost.exe
          Filesize

          244KB

          MD5

          88537f3fd69e60683c4467e89b7651af

          SHA1

          2c14a9010bed93b0622efe283a34de343ca33244

          SHA256

          4a7897e22ad30c516920e6441dc360a98114f15d9652b89909758f4966029692

          SHA512

          b3d070628092558770e08386eeabf69efc613ce163ce1f50cc00a81a78cbec6b667a84a4f09144b7f0c145ec28929b78deee4f7cab10ce7ac9a2f9c536ce8084

          Download Submit

        • \Users\Admin\eQDewf74.exe
          Filesize

          180KB

          MD5

          42836a2ee8ce9deef8d846272ef3949f

          SHA1

          79f698c53e56c96c859a0155e02a24c93e120145

          SHA256

          5569f623253918233149531fbd49bd624af013695bf0f7d8b53ef58b062e6a37

          SHA512

          786802f71512228215ddac4d23a7eec6e8cfb8ab4c02ba0a03b06241431e70c202e845ce08222945f668218d91dd6630e9e5499be0b44fda7b3dc29e98231d85

          Download Submit

        • \Users\Admin\eihost.exe
          Filesize

          28KB

          MD5

          f06f7a3945f4f78ee2c6d1ed35cbb5be

          SHA1

          ac1ab0f60a94286b6f01b40431e6f87f6e9899bf

          SHA256

          a2c720d07e18b73143b040ab817bad7da98ed2a262d55e6119b9cbd8b93dbbe3

          SHA512

          23f1fc1f15aab030c3d19a1c166479a52659b91dac00fff1301ddfd6e5e62279d45ec176f2e891098eb0d613d1f148952bf71341227b35f52c3bc2bf5fcdad14

          Download Submit

        • \Windows\assembly\GAC_32\Desktop.ini
          Filesize

          4KB

          MD5

          758f90d425814ea5a1d2694e44e7e295

          SHA1

          64d61731255ef2c3060868f92f6b81b4c9b5fe29

          SHA256

          896221147d8172197cbbf06c45d461141ce6b4af38027c1a22d57c1165026433

          SHA512

          11858e498309f611ee6241c026a402d6d979bffe28d4cbf7c9d5a89c3f3de25e1d253ab552ef7bc7cc43dd056307bd625e2e4f09beb21f0214c3946113b97ca9

          Download Submit

        • memory/1384-102-0x0000000000400000-0x0000000000515000-memory.dmp

          Filesize

          1.1MB

          Download

        • memory/1384-6-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1384-3-0x0000000000400000-0x0000000000515000-memory.dmp

          Filesize

          1.1MB

          Download

        • memory/1384-0-0x0000000000400000-0x0000000000515000-memory.dmp

          Filesize

          1.1MB

          Download

        • memory/1384-11-0x0000000000400000-0x0000000000515000-memory.dmp

          Filesize

          1.1MB

          Download

        • memory/1384-5-0x0000000000400000-0x0000000000515000-memory.dmp

          Filesize

          1.1MB

          Download

        • memory/1384-377-0x0000000000400000-0x0000000000515000-memory.dmp

          Filesize

          1.1MB

          Download

        • memory/1384-12-0x0000000000400000-0x0000000000515000-memory.dmp

          Filesize

          1.1MB

          Download

        • memory/1384-14-0x0000000000400000-0x0000000000515000-memory.dmp

          Filesize

          1.1MB

          Download

        • memory/1384-2-0x0000000000400000-0x0000000000515000-memory.dmp

          Filesize

          1.1MB

          Download

        • memory/1660-10-0x0000000000400000-0x0000000000417000-memory.dmp

          Filesize

          92KB

          Download

        • memory/1780-89-0x0000000000400000-0x0000000000416000-memory.dmp

          Filesize

          88KB

          Download

        • memory/1816-129-0x00000000003B0000-0x00000000003EC000-memory.dmp

          Filesize

          240KB

          Download

        • memory/1816-200-0x00000000003B0000-0x00000000003EC000-memory.dmp

          Filesize

          240KB

          Download

        • memory/1816-138-0x0000000000400000-0x000000000045D000-memory.dmp

          Filesize

          372KB

          Download

        • memory/1816-136-0x00000000003B0000-0x00000000003EC000-memory.dmp

          Filesize

          240KB

          Download

        • memory/1816-132-0x00000000003B0000-0x00000000003EC000-memory.dmp

          Filesize

          240KB

          Download

        • memory/2420-87-0x0000000000400000-0x0000000000427000-memory.dmp

          Filesize

          156KB

          Download

        • memory/2420-92-0x0000000000400000-0x0000000000427000-memory.dmp

          Filesize

          156KB

          Download

        • memory/2420-94-0x0000000000400000-0x0000000000427000-memory.dmp

          Filesize

          156KB

          Download

        • memory/2420-79-0x0000000000400000-0x0000000000427000-memory.dmp

          Filesize

          156KB

          Download

        • memory/2420-93-0x0000000000400000-0x0000000000427000-memory.dmp

          Filesize

          156KB

          Download

        • memory/2420-81-0x0000000000400000-0x0000000000427000-memory.dmp

          Filesize

          156KB

          Download

        • memory/2420-124-0x0000000000400000-0x0000000000427000-memory.dmp

          Filesize

          156KB

          Download

        • memory/2420-83-0x0000000000400000-0x0000000000427000-memory.dmp

          Filesize

          156KB

          Download

        • memory/2536-127-0x0000000000400000-0x000000000046B000-memory.dmp

          Filesize

          428KB

          Download

        • memory/2752-123-0x0000000000400000-0x0000000000437000-memory.dmp

          Filesize

          220KB

          Download

        • memory/2752-52-0x0000000000400000-0x0000000000437000-memory.dmp

          Filesize

          220KB

          Download

        • memory/2752-54-0x0000000000400000-0x0000000000437000-memory.dmp

          Filesize

          220KB

          Download

        • memory/2752-56-0x0000000000400000-0x0000000000437000-memory.dmp

          Filesize

          220KB

          Download

        • memory/2752-60-0x0000000000400000-0x0000000000437000-memory.dmp

          Filesize

          220KB

          Download

        • memory/2752-62-0x0000000000400000-0x0000000000437000-memory.dmp

          Filesize

          220KB

          Download

        • memory/2752-66-0x0000000000400000-0x0000000000437000-memory.dmp

          Filesize

          220KB

          Download

        • memory/2752-70-0x0000000000400000-0x0000000000437000-memory.dmp

          Filesize

          220KB

          Download

        • memory/2856-43-0x0000000003790000-0x000000000424A000-memory.dmp

          Filesize

          10.7MB

          Download

        • memory/2940-67-0x0000000000400000-0x0000000000416000-memory.dmp

          Filesize

          88KB

          Download

        • memory/2972-125-0x0000000000400000-0x000000000046B000-memory.dmp

          Filesize

          428KB

          Download