Overview

overview

10

Static

static

10

9ba9faee4b...3N.exe

windows7-x64

10

9ba9faee4b...3N.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    120s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/11/2024, 08:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    9ba9faee4b7e73efc9570128448c870f1979a209f33f50763b9d8f835f080293N.exe

  • Size

    2.6MB

  • MD5

    96eb7e99f0364070a0e8d3471d231e10

  • SHA1

    55fc4d4d24ff2f37064b1a7d5c12ad365eeb0fd9

  • SHA256

    9ba9faee4b7e73efc9570128448c870f1979a209f33f50763b9d8f835f080293

  • SHA512

    7bedca620ff5a2a7525bebb952833f80d0dfc4112b087f9bfdaa009dc16f258cce32cb3fac0ed6e295f2c9e22ad3262a78b77cc80619449aba936aa924277573

  • SSDEEP

    49152:xxTc2H2tFvduyS9xnsHyjtk2MYC5GDo0agE3nfmuO7diyvJFzcOt:3cy2Lk9xnsmtk2afaEPmuO7Iyv/zb

Score
10/10
gh0stratpurplefoxxredbackdoordiscoverypersistenceratrootkittrojanupx

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes
  • email

    [email protected]

  • payload_url

    http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

    https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

    http://xred.site50.net/syn/SUpdate.ini

    https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

    https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

    http://xred.site50.net/syn/Synaptics.rar

    https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

    https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

    http://xred.site50.net/syn/SSLLibrary.dll

Signatures

  • Detect PurpleFox Rootkit 10 IoCs

    Detect PurpleFox Rootkit.

    rootkit
  • Gh0st RAT payload 10 IoCs
  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat
  • Gh0strat family
    gh0strat
  • PurpleFox

    PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.

    rootkittrojanpurplefox
  • Purplefox family
    purplefox
  • Xred

    Xred is backdoor written in Delphi.

    backdoorxred
  • Xred family
    xred
  • Drops file in Drivers directory 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • UPX packed file 12 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 44 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 12 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of SetWindowsHookEx 34 IoCs
  • Suspicious use of WriteProcessMemory 55 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9ba9faee4b7e73efc9570128448c870f1979a209f33f50763b9d8f835f080293N.exe
    "C:\Users\Admin\AppData\Local\Temp\9ba9faee4b7e73efc9570128448c870f1979a209f33f50763b9d8f835f080293N.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1668
    • C:\Users\Admin\AppData\Local\Temp\RVN.exe
      C:\Users\Admin\AppData\Local\Temp\\RVN.exe
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2316
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:4968
        • C:\Windows\SysWOW64\PING.EXE
          ping -n 2 127.0.0.1
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:1468
    • C:\Users\Admin\AppData\Local\Temp\HD_9ba9faee4b7e73efc9570128448c870f1979a209f33f50763b9d8f835f080293N.exe
      C:\Users\Admin\AppData\Local\Temp\HD_9ba9faee4b7e73efc9570128448c870f1979a209f33f50763b9d8f835f080293N.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4396
      • C:\Users\Admin\AppData\Local\Temp\._cache_HD_9ba9faee4b7e73efc9570128448c870f1979a209f33f50763b9d8f835f080293N.exe
        "C:\Users\Admin\AppData\Local\Temp\._cache_HD_9ba9faee4b7e73efc9570128448c870f1979a209f33f50763b9d8f835f080293N.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4656
        • C:\VoiceRecorder\VoiceRecorder.exe
          "C:\VoiceRecorder\VoiceRecorder.exe"
          4⤵
          • Checks computer location settings
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3376
          • C:\Windows\SysWOW64\control.exe
            "C:\Windows\System32\control.exe" mmsys.cpl,,1
            5⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:3624
            • C:\Windows\SysWOW64\rundll32.exe
              "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL mmsys.cpl,,1
              6⤵
              • System Location Discovery: System Language Discovery
              PID:3828
          • C:\Windows\explorer.exe
            "C:\Windows\explorer.exe" /n, /select, "C:\Users\Admin\Desktop\Voice.mp3"
            5⤵
              PID:3340
            • C:\Windows\explorer.exe
              "C:\Windows\explorer.exe" /n, /select, "C:\Users\Admin\Desktop\Voice.mp3"
              5⤵
                PID:4732
              • C:\Windows\explorer.exe
                "C:\Windows\explorer.exe" /n, /select, "C:\Users\Admin\Desktop\Voice.mp3"
                5⤵
                  PID:4228
                • C:\Windows\explorer.exe
                  "C:\Windows\explorer.exe" /n, /select, "C:\Users\Admin\Desktop\Voice.mp3"
                  5⤵
                    PID:3540
                  • C:\Windows\explorer.exe
                    "C:\Windows\explorer.exe" /n, /select, "C:\Users\Admin\Desktop\Voice.mp3"
                    5⤵
                      PID:2100
                    • C:\Windows\explorer.exe
                      "C:\Windows\explorer.exe" /n, /select, "C:\Users\Admin\Desktop\Voice.mp3"
                      5⤵
                        PID:632
                      • C:\Windows\explorer.exe
                        "C:\Windows\explorer.exe" /n, /select, "C:\Users\Admin\Desktop\Voice.mp3"
                        5⤵
                          PID:4320
                        • C:\Windows\explorer.exe
                          "C:\Windows\explorer.exe" /n, /select, "C:\Users\Admin\Desktop\Voice.mp3"
                          5⤵
                            PID:680
                          • C:\Windows\explorer.exe
                            "C:\Windows\explorer.exe" /n, /select, "C:\Users\Admin\Desktop\Voice.mp3"
                            5⤵
                              PID:1696
                            • C:\Windows\explorer.exe
                              "C:\Windows\explorer.exe" /n, /select, "C:\Users\Admin\Desktop\Voice.mp3"
                              5⤵
                                PID:4996
                              • C:\Windows\explorer.exe
                                "C:\Windows\explorer.exe" /n, /select, "C:\Users\Admin\Desktop\Voice.mp3"
                                5⤵
                                  PID:3068
                            • C:\ProgramData\Synaptics\Synaptics.exe
                              "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
                              3⤵
                              • Checks computer location settings
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:4512
                              • C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe
                                "C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate
                                4⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                PID:3744
                        • C:\Windows\SysWOW64\TXPlatforn.exe
                          C:\Windows\SysWOW64\TXPlatforn.exe -auto
                          1⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:3560
                          • C:\Windows\SysWOW64\TXPlatforn.exe
                            C:\Windows\SysWOW64\TXPlatforn.exe -acsi
                            2⤵
                            • Drops file in Drivers directory
                            • Sets service image path in registry
                            • Executes dropped EXE
                            • Suspicious behavior: LoadsDriver
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3044
                        • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                          "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                          1⤵
                          • Checks processor information in registry
                          • Enumerates system info in registry
                          • Suspicious behavior: AddClipboardFormatListener
                          • Suspicious use of SetWindowsHookEx
                          PID:2012
                        • C:\Windows\system32\AUDIODG.EXE
                          C:\Windows\system32\AUDIODG.EXE 0x4ec 0x4ac
                          1⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1376
                        • C:\Windows\System32\rundll32.exe
                          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                          1⤵
                            PID:4776
                          • C:\Windows\explorer.exe
                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious behavior: AddClipboardFormatListener
                            • Suspicious use of SetWindowsHookEx
                            PID:4988
                          • C:\Windows\explorer.exe
                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious behavior: AddClipboardFormatListener
                            • Suspicious use of SetWindowsHookEx
                            PID:524
                          • C:\Windows\explorer.exe
                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious behavior: AddClipboardFormatListener
                            • Suspicious use of SetWindowsHookEx
                            PID:4788
                          • C:\Windows\explorer.exe
                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious behavior: AddClipboardFormatListener
                            • Suspicious use of SetWindowsHookEx
                            PID:4208
                          • C:\Windows\explorer.exe
                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious behavior: AddClipboardFormatListener
                            • Suspicious use of SetWindowsHookEx
                            PID:4040
                          • C:\Windows\explorer.exe
                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious behavior: AddClipboardFormatListener
                            • Suspicious use of SetWindowsHookEx
                            PID:3204
                          • C:\Windows\explorer.exe
                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious behavior: AddClipboardFormatListener
                            • Suspicious use of SetWindowsHookEx
                            PID:1944
                          • C:\Windows\explorer.exe
                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious behavior: AddClipboardFormatListener
                            • Suspicious use of SetWindowsHookEx
                            PID:3252
                          • C:\Windows\explorer.exe
                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious behavior: AddClipboardFormatListener
                            • Suspicious use of SetWindowsHookEx
                            PID:1532
                          • C:\Windows\explorer.exe
                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious behavior: AddClipboardFormatListener
                            • Suspicious use of SetWindowsHookEx
                            PID:3724
                          • C:\Windows\explorer.exe
                            C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                            1⤵
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            • Suspicious behavior: AddClipboardFormatListener
                            • Suspicious use of SetWindowsHookEx
                            PID:4308

                          Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Temp\._cache_HD_9ba9faee4b7e73efc9570128448c870f1979a209f33f50763b9d8f835f080293N.exe
                                  Filesize

                                  1.2MB

                                  MD5

                                  7160b7a1f3955696d5ee7cb492c4db93

                                  SHA1

                                  ed7ae36ab42b319362025ac6f8dcc64d85b83b3f

                                  SHA256

                                  ddbd3385f560d2d5061d26c9ad74465e4fa56be3bd112f7a77092fa2624b8567

                                  SHA512

                                  5f07b12b1500bd10ab927e8a8e5698bc4fc626b689c68eb20df018a070e1f5617a622a94ef4d544e401ed62c36de61fd24f703582c5faf880c0e6fe928954911

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\B2D75E00
                                  Filesize

                                  22KB

                                  MD5

                                  261f29e6ead3c8a2cf4d18c65728f9ef

                                  SHA1

                                  5e20b6bb5b464e2e34e36d00080aefe707129fd6

                                  SHA256

                                  724c074503260cdd84386bd4513267c79c8a189a2c2b59db382e6d28f20379d2

                                  SHA512

                                  05e58a5bad9d405e9a2e9ccafbd094b8af2dbc66f47cb9cb6219763d1e4b35ccf1ab8ec90c175e74911382798fedcf24f1c370a7fec22a508aa5f9dbf0ac6c5f

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\HD_9ba9faee4b7e73efc9570128448c870f1979a209f33f50763b9d8f835f080293N.exe
                                  Filesize

                                  2.0MB

                                  MD5

                                  87731a0da9c52858fb470dcb6566a5cb

                                  SHA1

                                  d2afe4486ae3314bea12b2951f467d0d48779024

                                  SHA256

                                  c0a13b107b3128203822d063e21c392663110f09280008749939901704586201

                                  SHA512

                                  a0882c5c67747056dc5037b503a141e331466314af40564ef7b8858f11b06fac845388c3e8b80f626d3cc22f7090fa072af2cb9c80967cacef6b08888a001905

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\RVN.exe
                                  Filesize

                                  377KB

                                  MD5

                                  80ade1893dec9cab7f2e63538a464fcc

                                  SHA1

                                  c06614da33a65eddb506db00a124a3fc3f5be02e

                                  SHA256

                                  57a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd

                                  SHA512

                                  fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4

                                  Download Submit

                                • C:\Users\Admin\AppData\Local\Temp\eKj4zZ2j.xlsm
                                  Filesize

                                  17KB

                                  MD5

                                  e566fc53051035e1e6fd0ed1823de0f9

                                  SHA1

                                  00bc96c48b98676ecd67e81a6f1d7754e4156044

                                  SHA256

                                  8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15

                                  SHA512

                                  a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04

                                  Download Submit

                                • C:\VoiceRecorder\VoiceRecorder.exe
                                  Filesize

                                  2.4MB

                                  MD5

                                  8e1ea51fc6e52bef4d4d82a3a7cf5e04

                                  SHA1

                                  401a12aa949ea67dbfbcb2efe7489115e84280cb

                                  SHA256

                                  cfa0551ea138c1382129247117fa2e50e9e4dda07d183a88b2336f0d1c77c96d

                                  SHA512

                                  1bfd6fef09e6342f9694e6706abd2f9d313a801527cfbddf7217eccffa69938c64be601e02315671af03f00bc5b9d107cabe33eece3bb0bb177bcfe38795c392

                                  Download Submit

                                • C:\\VoiceRecorder\lame_enc.dll
                                  Filesize

                                  380KB

                                  MD5

                                  09c1c1f8cc22889cfaf6409a5bd1b44a

                                  SHA1

                                  798634aab2a364410d6733d46942261a89589910

                                  SHA256

                                  de6bf1467ba398d3fbc11e1e5adddf7f8dc78394503f365942f7963f73e31dcb

                                  SHA512

                                  ffc0e82ffe0c8079a1291f116a92b37d65a8079d37231ecdb785ad27aecf93ce3b83acd151fdab87305ed168226a0ef1b18b41f6556d5fd3b126bc79756c5de7

                                  Download Submit

                                • C:\\VoiceRecorder\lame_enc.dll.COPYING
                                  Filesize

                                  24KB

                                  MD5

                                  c46bda00ffbb0ba1dac22f8d087f54d9

                                  SHA1

                                  1679b0cb5406c6e4624f779c02e32985497f7aa7

                                  SHA256

                                  bfe4a52dc4645385f356a8e83cc54216a293e3b6f1cb4f79f5fc0277abf937fd

                                  SHA512

                                  5a8c5f4fc81fa2810a6901bcbd03a42d33330d54dfb29309c3033b3c9d33d28a73800342da5347b19903f2163493ec5ece3bb6b859cc85d3db721566b43e9741

                                  Download Submit

                                • C:\\VoiceRecorder\lame_enc.dll.LICENSE
                                  Filesize

                                  707B

                                  MD5

                                  d83cc5a5e2fc3067b816c3dde356828f

                                  SHA1

                                  2309bbf695618cf23da8edd9b316c59f977bbd5a

                                  SHA256

                                  65bf0bf783b664daf3fa3e7e58d2238f26cceb5f3d05ef2371f8391689eb2b38

                                  SHA512

                                  6a4b83ae42a19971f1767cd8bfd5d477255180ebf7050b22216fd623d38381f3b220a5ec83c33aceff68162e6b33a3ddd80fb587bc660c40a253a981341e5ba4

                                  Download Submit

                                • C:\\VoiceRecorder\lame_enc.dll.README
                                  Filesize

                                  1KB

                                  MD5

                                  98ec33313365031dd0bbdec70cef20e4

                                  SHA1

                                  525cbfe27188525ea394db9df459aba0c0efb290

                                  SHA256

                                  05c2c2b5b9e74190a22ce1bd9d4f6c2fd4df3537e7a67fdef7c0930c09712cbc

                                  SHA512

                                  c33c611edfe1fb3674f1c129fb85d4782d74c64ad80ae249e98d0a51ae874ab376e73252f4bac575ededaff6895fd47c3c97ed62714baff3af449a5a09ea7ea1

                                  Download Submit

                                • memory/2012-210-0x00007FFCD7B40000-0x00007FFCD7B50000-memory.dmp

                                  Filesize

                                  64KB

                                  Download

                                • memory/2012-209-0x00007FFCD7B40000-0x00007FFCD7B50000-memory.dmp

                                  Filesize

                                  64KB

                                  Download

                                • memory/2012-194-0x00007FFCDA170000-0x00007FFCDA180000-memory.dmp

                                  Filesize

                                  64KB

                                  Download

                                • memory/2012-193-0x00007FFCDA170000-0x00007FFCDA180000-memory.dmp

                                  Filesize

                                  64KB

                                  Download

                                • memory/2012-195-0x00007FFCDA170000-0x00007FFCDA180000-memory.dmp

                                  Filesize

                                  64KB

                                  Download

                                • memory/2012-192-0x00007FFCDA170000-0x00007FFCDA180000-memory.dmp

                                  Filesize

                                  64KB

                                  Download

                                • memory/2012-196-0x00007FFCDA170000-0x00007FFCDA180000-memory.dmp

                                  Filesize

                                  64KB

                                  Download

                                • memory/2316-13-0x0000000010000000-0x00000000101B6000-memory.dmp

                                  Filesize

                                  1.7MB

                                  Download

                                • memory/2316-26-0x0000000010000000-0x00000000101B6000-memory.dmp

                                  Filesize

                                  1.7MB

                                  Download

                                • memory/2316-9-0x0000000010000000-0x00000000101B6000-memory.dmp

                                  Filesize

                                  1.7MB

                                  Download

                                • memory/2316-14-0x0000000010000000-0x00000000101B6000-memory.dmp

                                  Filesize

                                  1.7MB

                                  Download

                                • memory/2316-12-0x0000000010000000-0x00000000101B6000-memory.dmp

                                  Filesize

                                  1.7MB

                                  Download

                                • memory/3044-127-0x0000000010000000-0x00000000101B6000-memory.dmp

                                  Filesize

                                  1.7MB

                                  Download

                                • memory/3044-122-0x0000000010000000-0x00000000101B6000-memory.dmp

                                  Filesize

                                  1.7MB

                                  Download

                                • memory/3560-25-0x0000000010000000-0x00000000101B6000-memory.dmp

                                  Filesize

                                  1.7MB

                                  Download

                                • memory/3560-24-0x0000000010000000-0x00000000101B6000-memory.dmp

                                  Filesize

                                  1.7MB

                                  Download

                                • memory/3560-27-0x0000000010000000-0x00000000101B6000-memory.dmp

                                  Filesize

                                  1.7MB

                                  Download

                                • memory/3560-33-0x0000000010000000-0x00000000101B6000-memory.dmp

                                  Filesize

                                  1.7MB

                                  Download

                                • memory/3560-23-0x0000000010000000-0x00000000101B6000-memory.dmp

                                  Filesize

                                  1.7MB

                                  Download

                                • memory/4396-144-0x0000000000400000-0x00000000005F9000-memory.dmp

                                  Filesize

                                  2.0MB

                                  Download

                                • memory/4396-17-0x0000000002250000-0x0000000002251000-memory.dmp

                                  Filesize

                                  4KB

                                  Download

                                • memory/4512-257-0x0000000000400000-0x00000000005F9000-memory.dmp

                                  Filesize

                                  2.0MB

                                  Download

                                • memory/4512-263-0x0000000000400000-0x00000000005F9000-memory.dmp

                                  Filesize

                                  2.0MB

                                  Download

                                • memory/4512-292-0x0000000000400000-0x00000000005F9000-memory.dmp

                                  Filesize

                                  2.0MB

                                  Download