Overview

overview

10

Static

static

10

4dd17d4de1...18.exe

windows7-x64

10

4dd17d4de1...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    16/10/2024, 16:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4dd17d4de1ec04037ee72d221596ecd9_JaffaCakes118.exe

  • Size

    807KB

  • MD5

    4dd17d4de1ec04037ee72d221596ecd9

  • SHA1

    02e02a6c826d46b878be8b0c232bc3f16f9c7e76

  • SHA256

    337aae8a7c7ce29aa069f7ae1784a32355e0e22136c1161d5d8400e2f87febdd

  • SHA512

    8a647d783457c444917f7dc46539985fb470375df757eec7e7a9837c3193cf0def25e3f69513c9dd62ce7d1145ddf1c81183ab4fb0a1c5e633c2c87a27fbb3a9

  • SSDEEP

    24576:FYkjlMgR+tmbs1t9qgYohxfloUZhjaoJKwbgy:FYsMhtmMKcoUvPJKwbgy

Score
10/10
modiloaderponycredential_accessdiscoveryevasionpersistenceratspywarestealertrojanupx

Malware Config

Signatures

  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
    evasion
  • Pony,Fareit

    Pony is a Remote Access Trojan application that steals information.

    ratspywarestealerpony
  • ModiLoader Second Stage 9 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables taskbar notifications via registry modification
    evasion
  • Deletes itself 1 IoCs
  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 17 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Adds Run key to start application 2 TTPs 54 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 2 IoCs
  • Maps connected drives based on registry 3 TTPs 4 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Enumerates processes with tasklist 1 TTPs 2 IoCs
    discovery
  • Suspicious use of SetThreadContext 4 IoCs
  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 22 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\csrss.exe
    %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
    1⤵
    • Executes dropped EXE
    • Drops desktop.ini file(s)
    • Suspicious use of UnmapMainImage
    PID:332
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k netsvcs
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:848
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:1192
      • C:\Users\Admin\AppData\Local\Temp\4dd17d4de1ec04037ee72d221596ecd9_JaffaCakes118.exe
        "C:\Users\Admin\AppData\Local\Temp\4dd17d4de1ec04037ee72d221596ecd9_JaffaCakes118.exe"
        2⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2720
        • C:\Users\Admin\AppData\Local\Temp\4dd17d4de1ec04037ee72d221596ecd9_JaffaCakes118.exe
          4dd17d4de1ec04037ee72d221596ecd9_JaffaCakes118.exe
          3⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2580
          • C:\Users\Admin\eQDewf74.exe
            C:\Users\Admin\eQDewf74.exe
            4⤵
            • Modifies visiblity of hidden/system files in Explorer
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2596
            • C:\Users\Admin\naopee.exe
              "C:\Users\Admin\naopee.exe"
              5⤵
              • Modifies visiblity of hidden/system files in Explorer
              • Executes dropped EXE
              • Adds Run key to start application
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of SetWindowsHookEx
              PID:324
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c tasklist&&del eQDewf74.exe
              5⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:672
              • C:\Windows\SysWOW64\tasklist.exe
                tasklist
                6⤵
                • Enumerates processes with tasklist
                • System Location Discovery: System Language Discovery
                • Suspicious use of AdjustPrivilegeToken
                PID:1152
          • C:\Users\Admin\aihost.exe
            C:\Users\Admin\aihost.exe
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1140
            • C:\Users\Admin\aihost.exe
              aihost.exe
              5⤵
              • Executes dropped EXE
              • Maps connected drives based on registry
              • Suspicious behavior: EnumeratesProcesses
              PID:1260
          • C:\Users\Admin\bihost.exe
            C:\Users\Admin\bihost.exe
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2964
            • C:\Users\Admin\bihost.exe
              bihost.exe
              5⤵
              • Executes dropped EXE
              • Maps connected drives based on registry
              • Suspicious behavior: EnumeratesProcesses
              PID:1304
          • C:\Users\Admin\cihost.exe
            C:\Users\Admin\cihost.exe
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Drops file in Program Files directory
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:2864
            • C:\Users\Admin\cihost.exe
              C:\Users\Admin\cihost.exe startC:\Users\Admin\AppData\Roaming\5A5B2\E4023.exe%C:\Users\Admin\AppData\Roaming\5A5B2
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1760
            • C:\Users\Admin\cihost.exe
              C:\Users\Admin\cihost.exe startC:\Program Files (x86)\B29C3\lvvm.exe%C:\Program Files (x86)\B29C3
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1492
            • C:\Program Files (x86)\LP\2315\2EE.tmp
              "C:\Program Files (x86)\LP\2315\2EE.tmp"
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:2260
          • C:\Users\Admin\dihost.exe
            C:\Users\Admin\dihost.exe
            4⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1220
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe"
              5⤵
              • System Location Discovery: System Language Discovery
              PID:1420
          • C:\Users\Admin\eihost.exe
            C:\Users\Admin\eihost.exe
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:1032
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c tasklist&&del 4dd17d4de1ec04037ee72d221596ecd9_JaffaCakes118.exe
            4⤵
            • Deletes itself
            • System Location Discovery: System Language Discovery
            PID:2348
            • C:\Windows\SysWOW64\tasklist.exe
              tasklist
              5⤵
              • Enumerates processes with tasklist
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              PID:2504
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:544
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
      • Boot or Logon Autostart Execution: Active Setup
      • Modifies registry class
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:1236
    • C:\Windows\system32\DllHost.exe
      C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
      1⤵
        PID:2148

      Network

      MITRE ATT&CK Enterprise v15

      Reconnaissance

      Resource Development

      Initial Access

      Execution

      Persistence

      Boot or Logon Autostart Execution

      2
      T1547

      Active Setup

      1
      T1547.014

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Privilege Escalation

      Boot or Logon Autostart Execution

      2
      T1547

      Active Setup

      1
      T1547.014

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Defense Evasion

      Hide Artifacts

      1
      T1564

      Hidden Files and Directories

      1
      T1564.001

      Modify Registry

      4
      T1112

      Credential Access

      Credentials from Password Stores

      1
      T1555

      Credentials from Web Browsers

      1
      T1555.003

      Unsecured Credentials

      3
      T1552

      Credentials In Files

      3
      T1552.001

      Discovery

      Peripheral Device Discovery

      1
      T1120

      Process Discovery

      1
      T1057

      Query Registry

      3
      T1012

      System Information Discovery

      2
      T1082

      System Location Discovery

      1
      T1614

      System Language Discovery

      1
      T1614.001

      Lateral Movement

      Collection

      Data from Local System

      2
      T1005

      Command and Control

      Exfiltration

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\5A5B2\29C3.A5B
        Filesize

        300B

        MD5

        1be931f616debf0c389f16015cd38121

        SHA1

        7d847a93f7b327fc7bc333eb3ee194f8ae535854

        SHA256

        50602aae1a04030f379b319c9ac217d6ed614d456109ec77a6f33e443d5ee831

        SHA512

        f00cd9dd948cefc8feef01c73048a7cadb9d03e91b7a0af00adc771cc25faed29528ed0146b681c14972d760fa2d3c81aa36d3179600da36ba1305f03c615143

        Download Submit

      • C:\Users\Admin\AppData\Roaming\5A5B2\29C3.A5B
        Filesize

        600B

        MD5

        dec7d670afd7cd71b39100233ca876c8

        SHA1

        9705004a08bf7dd80f300e374de2c20c7c923473

        SHA256

        8ccb682b328ec0cbaf659feb2d4f8f36fe91623ba19d96ea550f8d2df2759bcd

        SHA512

        2688803fee94a97d0f4f443c9ef88f2947acf728ba2e603633fee7b11fcbeac19a88a1d6368115342e20edb7a9b360365e7169c797a16605e39e94ce3c2c9ab7

        Download Submit

      • C:\Users\Admin\AppData\Roaming\5A5B2\29C3.A5B
        Filesize

        996B

        MD5

        60353305a7ff9ebcb7662920f8e5a1a3

        SHA1

        bb07e9a15a0c240914de5f8e02ef299248103f7a

        SHA256

        4e2192aead72087a1b5383de9677cbc31a1dc2ad2c06010ca7f36cb1de4b04ae

        SHA512

        034d4993416585c91a9b96ffc47802eef410270e307a7a5256ecf1852a7cfe7b047adaac0cfad2e46901229a43cfbe958f151d2033d1ea133cc344fbee37ccf3

        Download Submit

      • C:\Users\Admin\AppData\Roaming\5A5B2\29C3.A5B
        Filesize

        1KB

        MD5

        cca5c084617d68b6df0e69eb6dcf9507

        SHA1

        937fa4b4c00061e39560090397bcf9f3997bb463

        SHA256

        4c3bd7f345f8c4bccee9c3b78a301bd13f705d91b339562c693e93db37fdf37d

        SHA512

        39c1b53d1e734734a162146b0dcf485276baece761ad54d7e2c4410c7a499bcb76c72368eb34a9ac8e1d128295102bad3405cefeb0e44ff337df4565840f7d30

        Download Submit

      • C:\Users\Admin\aihost.exe
        Filesize

        229KB

        MD5

        c7b9733430c4bf7f56a0c89d7f2dd9cf

        SHA1

        0a894c98e17a8c81a378a37c2230cf188932d21e

        SHA256

        8047916855a52a9b5e97c010e8fc2dc01a9ed91d2798a6869f8669ea4a92940d

        SHA512

        4aefe0746e896c00bc908128ba63e13d2abed9e839d13da14042365afb81d85bf75537292f7323a56694258ddec7a88b57202721b62651cfcbef2932c0cb2464

        Download Submit

      • C:\Users\Admin\bihost.exe
        Filesize

        119KB

        MD5

        386fef8fdb975e7c102921910db7f9fb

        SHA1

        cdf3f86411189db08c8c0f887f26c2572ecc0889

        SHA256

        ae06d784c51702aff587d235d48de3b1162872069fac4602d921d023527efae0

        SHA512

        6ab8c2721c81bdff414e8cdbd7ca006abf3ed8c0155510d6c92555885038f33c1cf08372302b6465196f69aa15a7305fb05eb2e12026f1fc96a797646b8d2352

        Download Submit

      • C:\Users\Admin\eihost.exe
        Filesize

        28KB

        MD5

        f06f7a3945f4f78ee2c6d1ed35cbb5be

        SHA1

        ac1ab0f60a94286b6f01b40431e6f87f6e9899bf

        SHA256

        a2c720d07e18b73143b040ab817bad7da98ed2a262d55e6119b9cbd8b93dbbe3

        SHA512

        23f1fc1f15aab030c3d19a1c166479a52659b91dac00fff1301ddfd6e5e62279d45ec176f2e891098eb0d613d1f148952bf71341227b35f52c3bc2bf5fcdad14

        Download Submit

      • C:\Windows\system32\consrv.dll
        Filesize

        53KB

        MD5

        63e99b675a1337db6d8430195ea3efd2

        SHA1

        1baead2bf8f433dc82f9b2c03fd65ce697a92155

        SHA256

        6616179477849205eb4075b75a042056d196f45d67f78929dbb3317a35ccbea9

        SHA512

        f5b986eafa38dbc9ad7759784ac887ecbb9c8d8009a3f33e91b9c9ceeaf043ed3e4ddab8e6b6b77e54aed9fcecab02442c8ff253f2136ea06996d05ddd68199f

        Download Submit

      • \??\globalroot\systemroot\assembly\temp\@
        Filesize

        2KB

        MD5

        dfec2d8d7ce58e06469e7fc2d9f10c1f

        SHA1

        b451c731a1d082a74d580566ecc065af6c1f4e73

        SHA256

        41fe7604f8a082e600da4f91b423cf14d0a6c45caa3c4d86c5fe7cdbcdaebd5f

        SHA512

        5a7ab315a45daf42463155886d9f1e3378005685fcedd9f1f47f5364bb785aa612b8a83495559eaa40a47ea81cb581c4ab9e2c78f05e0ecff7dc15486b1b63ab

        Download Submit

      • \Program Files (x86)\LP\2315\2EE.tmp
        Filesize

        100KB

        MD5

        4c04ec47c44bc997519e18ce5f20e9d6

        SHA1

        680968fe85eaa19ac68b8dabf3371dd81684ed83

        SHA256

        446ddf0822deef56cedbfa0910143c744835ed765d128408d9ea994a569581a2

        SHA512

        e33e959e25d09152c1f64d60a7733f7c7a1dfd9f0bee6ed1f8aa18cf5e5248442e365d211c4555e0723b4e23e97c0a99d43b8fe6538cc9c77f0d39fd73616279

        Download Submit

      • \Users\Admin\cihost.exe
        Filesize

        279KB

        MD5

        4df3241b8f53ad2d1c0bba6dc1b97e02

        SHA1

        f0c43893143a3442a453f56c9c4f740941b1d097

        SHA256

        407e0425757e28262c3054c1dc981a9f41cf83cd67ecfbf37d3b8fe74db54199

        SHA512

        e90e4a8b708fb9d3213f73e641fa39625a38fa969270ef1123206fb30d04837f018b9838aa02a234265c0b9ba765f567b748a7b73c437b96daba7a15e5e38663

        Download Submit

      • \Users\Admin\dihost.exe
        Filesize

        244KB

        MD5

        88537f3fd69e60683c4467e89b7651af

        SHA1

        2c14a9010bed93b0622efe283a34de343ca33244

        SHA256

        4a7897e22ad30c516920e6441dc360a98114f15d9652b89909758f4966029692

        SHA512

        b3d070628092558770e08386eeabf69efc613ce163ce1f50cc00a81a78cbec6b667a84a4f09144b7f0c145ec28929b78deee4f7cab10ce7ac9a2f9c536ce8084

        Download Submit

      • \Users\Admin\eQDewf74.exe
        Filesize

        180KB

        MD5

        42836a2ee8ce9deef8d846272ef3949f

        SHA1

        79f698c53e56c96c859a0155e02a24c93e120145

        SHA256

        5569f623253918233149531fbd49bd624af013695bf0f7d8b53ef58b062e6a37

        SHA512

        786802f71512228215ddac4d23a7eec6e8cfb8ab4c02ba0a03b06241431e70c202e845ce08222945f668218d91dd6630e9e5499be0b44fda7b3dc29e98231d85

        Download Submit

      • \Users\Admin\naopee.exe
        Filesize

        180KB

        MD5

        25a2a81c055f4b1c68dc9f4d1122ee4a

        SHA1

        eab678794db7edbebe0cd442bf08644aa7e77b34

        SHA256

        ca791d730b9a0834d9d83ea9ed171b49b9fcd3c3e35b603cde222b85657d5078

        SHA512

        dbecf04a6735dd6276ef51dc88bb8cb5aa78720261e6a81c6c2a042f041c95ad8383c0eeb19136b65362e387cd682a4aa34c96383f258bef3970896a5d87f1ec

        Download Submit

      • \Windows\assembly\GAC_32\Desktop.ini
        Filesize

        4KB

        MD5

        758f90d425814ea5a1d2694e44e7e295

        SHA1

        64d61731255ef2c3060868f92f6b81b4c9b5fe29

        SHA256

        896221147d8172197cbbf06c45d461141ce6b4af38027c1a22d57c1165026433

        SHA512

        11858e498309f611ee6241c026a402d6d979bffe28d4cbf7c9d5a89c3f3de25e1d253ab552ef7bc7cc43dd056307bd625e2e4f09beb21f0214c3946113b97ca9

        Download Submit

      • memory/1140-70-0x0000000000400000-0x0000000000416000-memory.dmp

        Filesize

        88KB

        Download

      • memory/1220-226-0x0000000000380000-0x00000000003BC000-memory.dmp

        Filesize

        240KB

        Download

      • memory/1220-161-0x0000000000380000-0x00000000003BC000-memory.dmp

        Filesize

        240KB

        Download

      • memory/1220-157-0x0000000000380000-0x00000000003BC000-memory.dmp

        Filesize

        240KB

        Download

      • memory/1220-165-0x0000000000380000-0x00000000003BC000-memory.dmp

        Filesize

        240KB

        Download

      • memory/1220-167-0x0000000000400000-0x000000000045D000-memory.dmp

        Filesize

        372KB

        Download

      • memory/1260-57-0x0000000000400000-0x0000000000437000-memory.dmp

        Filesize

        220KB

        Download

      • memory/1260-67-0x0000000000400000-0x0000000000437000-memory.dmp

        Filesize

        220KB

        Download

      • memory/1260-55-0x0000000000400000-0x0000000000437000-memory.dmp

        Filesize

        220KB

        Download

      • memory/1260-63-0x0000000000400000-0x0000000000437000-memory.dmp

        Filesize

        220KB

        Download

      • memory/1260-71-0x0000000000400000-0x0000000000437000-memory.dmp

        Filesize

        220KB

        Download

      • memory/1260-152-0x0000000000400000-0x0000000000437000-memory.dmp

        Filesize

        220KB

        Download

      • memory/1260-60-0x0000000000400000-0x0000000000437000-memory.dmp

        Filesize

        220KB

        Download

      • memory/1260-53-0x0000000000400000-0x0000000000437000-memory.dmp

        Filesize

        220KB

        Download

      • memory/1304-95-0x0000000000400000-0x0000000000427000-memory.dmp

        Filesize

        156KB

        Download

      • memory/1304-80-0x0000000000400000-0x0000000000427000-memory.dmp

        Filesize

        156KB

        Download

      • memory/1304-93-0x0000000000400000-0x0000000000427000-memory.dmp

        Filesize

        156KB

        Download

      • memory/1304-84-0x0000000000400000-0x0000000000427000-memory.dmp

        Filesize

        156KB

        Download

      • memory/1304-88-0x0000000000400000-0x0000000000427000-memory.dmp

        Filesize

        156KB

        Download

      • memory/1304-92-0x0000000000400000-0x0000000000427000-memory.dmp

        Filesize

        156KB

        Download

      • memory/1304-82-0x0000000000400000-0x0000000000427000-memory.dmp

        Filesize

        156KB

        Download

      • memory/1760-156-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/2580-402-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2580-15-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2580-6-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2580-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

        Download

      • memory/2580-0-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2580-2-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2580-3-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2580-103-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2580-12-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2580-13-0x0000000000400000-0x0000000000515000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/2596-44-0x0000000003970000-0x000000000442A000-memory.dmp

        Filesize

        10.7MB

        Download

      • memory/2720-10-0x0000000000400000-0x0000000000417000-memory.dmp

        Filesize

        92KB

        Download

      • memory/2864-154-0x0000000000400000-0x000000000046B000-memory.dmp

        Filesize

        428KB

        Download

      • memory/2964-90-0x0000000000400000-0x0000000000416000-memory.dmp

        Filesize

        88KB

        Download