Overview

overview

10

Static

static

10

304d553299...18.exe

windows7-x64

10

304d553299...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    10-10-2024 14:17

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    304d553299e245f0b907b0b50a50d3ad_JaffaCakes118.exe

  • Size

    875KB

  • MD5

    304d553299e245f0b907b0b50a50d3ad

  • SHA1

    63348283b822c25960133717aadccb2ed02f37af

  • SHA256

    09da4f36e931cb15393834e79fce688ce21ff8a6bb082193a7e1e66df91feed3

  • SHA512

    f312734df4f1c80ddd3c11539375de93d8335223e53855d3ab75c693cf60f4effc4f61bc182289d67585f3dee7377ddb08c20ee4d644abe9e8cca424f1e48a8f

  • SSDEEP

    24576:B5T0kUJQbdHVFQlyOW8oooiAhYJWtA7q:B53UEHVFQAp5iAOgtAG

Score
10/10
modiloaderponycredential_accessdiscoveryevasionpersistenceratspywarestealertrojanupx

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader
  • Modifies security service 2 TTPs 1 IoCs
    evasion
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • ModiLoader Second Stage 9 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 19 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 54 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 2 IoCs
  • Maps connected drives based on registry 3 TTPs 4 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of SetThreadContext 4 IoCs
  • UPX packed file 15 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 22 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\csrss.exe
    %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
    1⤵
    • Executes dropped EXE
    • Drops desktop.ini file(s)
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:332
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:844
  • C:\Users\Admin\AppData\Local\Temp\304d553299e245f0b907b0b50a50d3ad_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\304d553299e245f0b907b0b50a50d3ad_JaffaCakes118.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2520
    • C:\Users\Admin\AppData\Local\Temp\304d553299e245f0b907b0b50a50d3ad_JaffaCakes118.exe
      304d553299e245f0b907b0b50a50d3ad_JaffaCakes118.exe
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3060
      • C:\Users\Admin\Ww9OoYLk.exe
        C:\Users\Admin\Ww9OoYLk.exe
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2556
        • C:\Users\Admin\peeziag.exe
          "C:\Users\Admin\peeziag.exe"
          4⤵
          • Modifies visiblity of hidden/system files in Explorer
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          PID:2732
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c tasklist&&del Ww9OoYLk.exe
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2748
          • C:\Windows\SysWOW64\tasklist.exe
            tasklist
            5⤵
            • Enumerates processes with tasklist
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            PID:2880
      • C:\Users\Admin\athost.exe
        C:\Users\Admin\athost.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2852
        • C:\Users\Admin\athost.exe
          athost.exe
          4⤵
          • Executes dropped EXE
          • Maps connected drives based on registry
          • Suspicious behavior: EnumeratesProcesses
          PID:2896
      • C:\Users\Admin\bthost.exe
        C:\Users\Admin\bthost.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2408
        • C:\Users\Admin\bthost.exe
          bthost.exe
          4⤵
          • Executes dropped EXE
          • Maps connected drives based on registry
          • Suspicious behavior: EnumeratesProcesses
          PID:860
      • C:\Users\Admin\cthost.exe
        C:\Users\Admin\cthost.exe
        3⤵
        • Modifies security service
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:1968
        • C:\Users\Admin\cthost.exe
          C:\Users\Admin\cthost.exe startC:\Users\Admin\AppData\Roaming\FFABF\85DB3.exe%C:\Users\Admin\AppData\Roaming\FFABF
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2280
        • C:\Users\Admin\cthost.exe
          C:\Users\Admin\cthost.exe startC:\Program Files (x86)\BF0C0\lvvm.exe%C:\Program Files (x86)\BF0C0
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2640
        • C:\Program Files (x86)\LP\B3EF\4598.tmp
          "C:\Program Files (x86)\LP\B3EF\4598.tmp"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          PID:2632
      • C:\Users\Admin\dthost.exe
        C:\Users\Admin\dthost.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2416
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2088
      • C:\Users\Admin\ethost.exe
        C:\Users\Admin\ethost.exe
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        PID:1524
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c tasklist&&del 304d553299e245f0b907b0b50a50d3ad_JaffaCakes118.exe
        3⤵
        • Deletes itself
        • System Location Discovery: System Language Discovery
        PID:2180
        • C:\Windows\SysWOW64\tasklist.exe
          tasklist
          4⤵
          • Enumerates processes with tasklist
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:2640
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:872
  • C:\Windows\system32\DllHost.exe
    C:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}
    1⤵
    • Loads dropped DLL
    PID:2084
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2980
  • C:\Windows\system32\DllHost.exe
    C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
    1⤵
      PID:2476

    Network

    MITRE ATT&CK Enterprise v15

    Reconnaissance

    Resource Development

    Initial Access

    Execution

    Persistence

    Boot or Logon Autostart Execution

    2
    T1547

    Active Setup

    1
    T1547.014

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Create or Modify System Process

    1
    T1543

    Windows Service

    1
    T1543.003

    Privilege Escalation

    Boot or Logon Autostart Execution

    2
    T1547

    Active Setup

    1
    T1547.014

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Create or Modify System Process

    1
    T1543

    Windows Service

    1
    T1543.003

    Defense Evasion

    Hide Artifacts

    1
    T1564

    Hidden Files and Directories

    1
    T1564.001

    Modify Registry

    5
    T1112

    Credential Access

    Credentials from Password Stores

    1
    T1555

    Credentials from Web Browsers

    1
    T1555.003

    Unsecured Credentials

    3
    T1552

    Credentials In Files

    3
    T1552.001

    Discovery

    Peripheral Device Discovery

    1
    T1120

    Process Discovery

    1
    T1057

    Query Registry

    3
    T1012

    System Information Discovery

    2
    T1082

    System Location Discovery

    1
    T1614

    System Language Discovery

    1
    T1614.001

    Lateral Movement

    Collection

    Data from Local System

    2
    T1005

    Command and Control

    Exfiltration

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\LP\B3EF\4598.tmp
      Filesize

      95KB

      MD5

      a1d80ed250788260ffd66258555a4876

      SHA1

      10b81c2cdc4a7d645f9058c220587fac79281351

      SHA256

      d4d9a7028cda13828d7a6796dd12369ab1d4af80946776aa5b5c0369dd322fb3

      SHA512

      fee72d46425a0c1f755de2e34ad742ff579a86b2a3bff3485a15ddcbcf55d60c6297bb588650a9a673aa0a5e8f35f1ae0bc1a454154d26848c49cab700d7e5d8

      Download Submit

    • C:\Users\Admin\AppData\Roaming\FFABF\F0C0.FAB
      Filesize

      600B

      MD5

      3c324688af181fbb2c8e8b9248435c48

      SHA1

      045b47a2dd4625cd94e74c9e31c44563c3a65d18

      SHA256

      77667c3e012a05b279c2c378f412e8d166ba433fef4004ac81fccc6f26760bc5

      SHA512

      041dff8b392e60d5e93dca12700736c3698fa327669aacfc9d785682a0255e310fbedc7cd7b1f5f610494d771ca0a101e9d4079f2c0bb3b1ad7eaebf1379b548

      Download Submit

    • C:\Users\Admin\AppData\Roaming\FFABF\F0C0.FAB
      Filesize

      996B

      MD5

      ff5073548352b3a57b360fe767e60f3a

      SHA1

      2ac9ce725477dba9f44448b0d96f49091734926a

      SHA256

      310c74a514381712a412a5efbf7bbcf03ec807d4589c43c51293f5eaab210f0e

      SHA512

      e45fdfd6d8a5d1ae5b963de000e7f9a4ad5726b166fee0725d5222008c322b315b5f868c764e583fda4c1e8571cf6c5e87571495005e0f9aa60f56fe3fddf8b0

      Download Submit

    • C:\Users\Admin\AppData\Roaming\FFABF\F0C0.FAB
      Filesize

      1KB

      MD5

      38ca845880545ddc87e29cd754aece64

      SHA1

      c80f42530c18a586451148057794abade30e8dab

      SHA256

      b1ca7deee65d6d1497e88f48626fd4a5d6c900b7b54d26a396551e9b2c77d0b0

      SHA512

      fd82daa0277f8ad4e6531c8ad69e27af1b4d2a956e49b5f3b3ce057c89477d357e01cdb8dbcbcef9babf692b15c12f180d07d4acb1c1be0f549fb4be556ec0df

      Download Submit

    • C:\Windows\system32\consrv.dll
      Filesize

      53KB

      MD5

      63e99b675a1337db6d8430195ea3efd2

      SHA1

      1baead2bf8f433dc82f9b2c03fd65ce697a92155

      SHA256

      6616179477849205eb4075b75a042056d196f45d67f78929dbb3317a35ccbea9

      SHA512

      f5b986eafa38dbc9ad7759784ac887ecbb9c8d8009a3f33e91b9c9ceeaf043ed3e4ddab8e6b6b77e54aed9fcecab02442c8ff253f2136ea06996d05ddd68199f

      Download Submit

    • \??\globalroot\systemroot\assembly\temp\@
      Filesize

      2KB

      MD5

      2f69b8ff5cb623c9ef0846535fd6c4ea

      SHA1

      bbdc170e586d7777b9a30b5f0c814b297a4f6b7e

      SHA256

      a3f172c907008c5050fe8efc60a6e8dcc5775626825bc131f24d263e0c85ba86

      SHA512

      6f640f7c9703bae6e1e38f4f368291c506486c3ac1c1a7f3d70993c8b835415027308ccbd067530d5cc0415c4b620758c938fecdb40deaf246a45645f764b8c9

      Download Submit

    • \Users\Admin\Ww9OoYLk.exe
      Filesize

      256KB

      MD5

      77e425fe955cbc4b6245cf8a3ed645b3

      SHA1

      921dad95a28283f2138e8c36d4cbf295572d33ac

      SHA256

      86b35dd61f186218356ecced37723e647b612cb8c44ef904917f4c783e424809

      SHA512

      ee0a6ac25c021baf6974a23afd999bcdd519da465ee849ebd52d99ff437812165650fe8f05e5ff72f6eadf8d5a44d5c7c73853e4d5e00f8fbab45444fd56a44b

      Download Submit

    • \Users\Admin\athost.exe
      Filesize

      263KB

      MD5

      6b7d559166467ef651497836feef65e3

      SHA1

      9edda6cd07a1960ba52abe17fc7402ff93d44ce6

      SHA256

      6151ab998d7821e147551b5ff24b11d3194c207c3ff8322fe2e2860a8b978bb0

      SHA512

      d58ddfe8ce3b9f4092d554713502065c351a46251ff0ce126dd05528771cd727bf636f15a4c76224d8db22117234d39b1a2bf8030b55aadcf98087a5a1814356

      Download Submit

    • \Users\Admin\bthost.exe
      Filesize

      153KB

      MD5

      f28e94ce33674d8cf13f31bb5f20f745

      SHA1

      e79332b18af7b31caa195956c23303d35c2808c8

      SHA256

      42f40ac82f47f4eb009dbd11d7233ed2e67f80392dd4fa770faa68dd973ded2f

      SHA512

      8bcb1311302bbf1b6cfbbb863cffa95d5934c9bfc613cd2dc2abd425fe39ad2ec9cae7dca1e5b60d2acec4c9d422a35aeb5ab7b0433f25c01202ab3b4ca96112

      Download Submit

    • \Users\Admin\cthost.exe
      Filesize

      278KB

      MD5

      d0bf4ea3b6fc02afd2c6ed5f4b0d142e

      SHA1

      2187968df184c18f945497dd410f90f4b6ff186d

      SHA256

      3c7ee6117b9c2e39593f452e163f16334ab1b9196b5b5616c9ff7496bb4676a0

      SHA512

      e0efb8672a81a8aa6c11a0f1f871033b10c6a5c6b28d30eab4f8ef7509fca8710c417b9cbbbf7844888f02858295304c23bf217e41d157e2bed594a39c2641f4

      Download Submit

    • \Users\Admin\dthost.exe
      Filesize

      227KB

      MD5

      d39d17b38909180b0c65cb4081154100

      SHA1

      b7a11d389d940273b91dd9ddb11137404eedceea

      SHA256

      590aaa3add5efffd271c2b9cfc10fc304faf6caf83f2f9dd494a40a35b1053d3

      SHA512

      5a0ccc785b15e92d38bf1436522dbe81645d2b16093f20f09dfd81602e9f496693a6b27a62f88e50cdf027147b89a21db1e15532d0d4e7c2fd65710ee2071fa6

      Download Submit

    • \Users\Admin\ethost.exe
      Filesize

      24KB

      MD5

      b38b2a8c25efb39b245dbfa6c1ccc29b

      SHA1

      62fda766006bfbccbfaade649ceb29764c216ea4

      SHA256

      1fee129dadbd67f7fab68c8fa285b5da0141785100b35bc7b66d55b10d24364d

      SHA512

      8cdbb4e9404783ad4a2665a05a1e64e8ab393689c2425834e854933f58904910e248dfebc57c717313abbc62105d76875ebafd206ada15417beedd58bbd7e22d

      Download Submit

    • \Users\Admin\peeziag.exe
      Filesize

      256KB

      MD5

      27b01ec3b37f753b376d3ced7f6bdc4c

      SHA1

      32854724b721d240990d04b1208078a39360a90b

      SHA256

      0f71b9df8010da8c1b84c26c20ca5f992bf7531369bbd94efa503087db334f77

      SHA512

      9439962d398fed4672912e768db3c00aa106f279df26885ebc3f9a5515dbab61f01a7b8392652d055d83df2a81f497bf2946a7c2f72e6df55a8bc1256ce8d18d

      Download Submit

    • \Windows\assembly\GAC_32\Desktop.ini
      Filesize

      4KB

      MD5

      758f90d425814ea5a1d2694e44e7e295

      SHA1

      64d61731255ef2c3060868f92f6b81b4c9b5fe29

      SHA256

      896221147d8172197cbbf06c45d461141ce6b4af38027c1a22d57c1165026433

      SHA512

      11858e498309f611ee6241c026a402d6d979bffe28d4cbf7c9d5a89c3f3de25e1d253ab552ef7bc7cc43dd056307bd625e2e4f09beb21f0214c3946113b97ca9

      Download Submit

    • \Windows\assembly\GAC_64\Desktop.ini
      Filesize

      5KB

      MD5

      92f9cdae857253a3895faffa85b3d8b9

      SHA1

      d28352ff5a02eeb98334e3d0f845a259b2aacff3

      SHA256

      5653db84679ab49eec2e32127271dacd802b8ed53a5199c5fd5fe998be32a36b

      SHA512

      f23ec0a005b5d84d26527cd6c26d494b9ecff4b099adfd780fe7953f5affb0f295f92dc663d79bcb60d42f82d249b7e61acb39a38bdbd66185da5bf6126737a6

      Download Submit

    • memory/332-132-0x0000000002560000-0x0000000002572000-memory.dmp

      Filesize

      72KB

      Download

    • memory/860-82-0x0000000000400000-0x0000000000427000-memory.dmp

      Filesize

      156KB

      Download

    • memory/860-80-0x0000000000400000-0x0000000000427000-memory.dmp

      Filesize

      156KB

      Download

    • memory/860-84-0x0000000000400000-0x0000000000427000-memory.dmp

      Filesize

      156KB

      Download

    • memory/860-88-0x0000000000400000-0x0000000000427000-memory.dmp

      Filesize

      156KB

      Download

    • memory/860-95-0x0000000000400000-0x0000000000427000-memory.dmp

      Filesize

      156KB

      Download

    • memory/860-94-0x0000000000400000-0x0000000000427000-memory.dmp

      Filesize

      156KB

      Download

    • memory/860-93-0x0000000000400000-0x0000000000427000-memory.dmp

      Filesize

      156KB

      Download

    • memory/2280-148-0x0000000000400000-0x000000000046B000-memory.dmp

      Filesize

      428KB

      Download

    • memory/2408-91-0x0000000000400000-0x000000000041E000-memory.dmp

      Filesize

      120KB

      Download

    • memory/2416-124-0x0000000000380000-0x00000000003C5000-memory.dmp

      Filesize

      276KB

      Download

    • memory/2416-123-0x0000000000380000-0x00000000003C5000-memory.dmp

      Filesize

      276KB

      Download

    • memory/2416-152-0x0000000000400000-0x0000000000466000-memory.dmp

      Filesize

      408KB

      Download

    • memory/2416-126-0x0000000000380000-0x00000000003C5000-memory.dmp

      Filesize

      276KB

      Download

    • memory/2416-114-0x0000000000380000-0x00000000003C5000-memory.dmp

      Filesize

      276KB

      Download

    • memory/2416-118-0x0000000000380000-0x00000000003C5000-memory.dmp

      Filesize

      276KB

      Download

    • memory/2416-122-0x0000000000380000-0x00000000003C5000-memory.dmp

      Filesize

      276KB

      Download

    • memory/2520-10-0x0000000000400000-0x000000000041F000-memory.dmp

      Filesize

      124KB

      Download

    • memory/2556-43-0x00000000036C0000-0x000000000417A000-memory.dmp

      Filesize

      10.7MB

      Download

    • memory/2852-68-0x0000000000400000-0x000000000041E000-memory.dmp

      Filesize

      120KB

      Download

    • memory/2896-163-0x0000000000400000-0x0000000000437000-memory.dmp

      Filesize

      220KB

      Download

    • memory/2896-57-0x0000000000400000-0x0000000000437000-memory.dmp

      Filesize

      220KB

      Download

    • memory/2896-55-0x0000000000400000-0x0000000000437000-memory.dmp

      Filesize

      220KB

      Download

    • memory/2896-53-0x0000000000400000-0x0000000000437000-memory.dmp

      Filesize

      220KB

      Download

    • memory/2896-63-0x0000000000400000-0x0000000000437000-memory.dmp

      Filesize

      220KB

      Download

    • memory/2896-71-0x0000000000400000-0x0000000000437000-memory.dmp

      Filesize

      220KB

      Download

    • memory/2896-67-0x0000000000400000-0x0000000000437000-memory.dmp

      Filesize

      220KB

      Download

    • memory/2896-60-0x0000000000400000-0x0000000000437000-memory.dmp

      Filesize

      220KB

      Download

    • memory/3060-13-0x0000000000400000-0x0000000000535000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/3060-109-0x00000000002D0000-0x0000000000336000-memory.dmp

      Filesize

      408KB

      Download

    • memory/3060-0-0x0000000000400000-0x0000000000535000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/3060-4-0x0000000000400000-0x0000000000535000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/3060-2-0x0000000000400000-0x0000000000535000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/3060-6-0x0000000000400000-0x0000000000535000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/3060-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3060-12-0x0000000000400000-0x0000000000535000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/3060-15-0x0000000000400000-0x0000000000535000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/3060-359-0x0000000000400000-0x0000000000535000-memory.dmp

      Filesize

      1.2MB

      Download

    • memory/3060-105-0x0000000000400000-0x0000000000535000-memory.dmp

      Filesize

      1.2MB

      Download