floxif | fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918

Analysis

max time kernel
120s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16-12-2024 19:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918N.exe
Size

271KB
MD5

104e8d1eeac87bdae748957c3a1c2170
SHA1

cf12406807753a8caff0dda2b855b216544a94d2
SHA256

fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918
SHA512

0768a926ce27add3bc75a356059e71504cc1c824eb86c7c93922c0765b0e7f6d9045c63b47dc61f27a23f79990b4b8e95bbfce7efcb00ee1e2043a11eb2d1375
SSDEEP

6144:XILqdufR6Da5zmR7BV+UdvrEFp7hKlCUx/:4B6Da5zGBjvrEH7e7/

Score

10^/10

floxif backdoor discovery evasion persistence trojan upx

Malware Config

Signatures

Floxif family
floxif
Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral1/files/0x00090000000120f6-2.dat	floxif

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00090000000120f6-2.dat	acprotect

Executes dropped EXE 6 IoCs

pid	Process
2756	fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918n.exe
2748	icsys.icn.exe
2596	explorer.exe
2624	spoolsv.exe
1008	svchost.exe
964	spoolsv.exe

Loads dropped DLL 8 IoCs

pid	Process
2792	fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918N.exe
2792	fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918N.exe
2792	fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918N.exe
2792	fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918N.exe
2748	icsys.icn.exe
2596	explorer.exe
2624	spoolsv.exe
1008	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\e:	fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918N.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2792-4-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/files/0x00090000000120f6-2.dat	upx
behavioral1/files/0x0007000000016de0-15.dat	upx
behavioral1/memory/2792-17-0x00000000003C0000-0x00000000003FD000-memory.dmp	upx
behavioral1/memory/2792-53-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/2756-73-0x0000000000400000-0x000000000043D000-memory.dmp	upx
behavioral1/memory/2792-79-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918N.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918N.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918n.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1640	schtasks.exe
1956	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2792	fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918N.exe
2792	fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918N.exe
2792	fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918N.exe
2792	fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918N.exe
2792	fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918N.exe
2792	fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918N.exe
2792	fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918N.exe
2792	fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918N.exe
2792	fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918N.exe
2792	fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918N.exe
2792	fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918N.exe
2792	fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918N.exe
2792	fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918N.exe
2792	fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918N.exe
2792	fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918N.exe
2792	fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918N.exe
2792	fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918N.exe
2748	icsys.icn.exe
2748	icsys.icn.exe
2748	icsys.icn.exe
2748	icsys.icn.exe
2748	icsys.icn.exe
2748	icsys.icn.exe
2748	icsys.icn.exe
2748	icsys.icn.exe
2748	icsys.icn.exe
2748	icsys.icn.exe
2748	icsys.icn.exe
2748	icsys.icn.exe
2748	icsys.icn.exe
2748	icsys.icn.exe
2748	icsys.icn.exe
2748	icsys.icn.exe
2748	icsys.icn.exe
2596	explorer.exe
2596	explorer.exe
2596	explorer.exe
2596	explorer.exe
2596	explorer.exe
2596	explorer.exe
2596	explorer.exe
2596	explorer.exe
2596	explorer.exe
2596	explorer.exe
2596	explorer.exe
2596	explorer.exe
2596	explorer.exe
2596	explorer.exe
2596	explorer.exe
2596	explorer.exe
1008	svchost.exe
1008	svchost.exe
1008	svchost.exe
1008	svchost.exe
1008	svchost.exe
1008	svchost.exe
1008	svchost.exe
1008	svchost.exe
1008	svchost.exe
1008	svchost.exe
1008	svchost.exe
1008	svchost.exe
1008	svchost.exe
1008	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2596	explorer.exe
1008	svchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2792	fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918N.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
2792	fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918N.exe
2792	fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918N.exe
2748	icsys.icn.exe
2748	icsys.icn.exe
2596	explorer.exe
2596	explorer.exe
2624	spoolsv.exe
2624	spoolsv.exe
1008	svchost.exe
1008	svchost.exe
964	spoolsv.exe
964	spoolsv.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2756	2792	fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918N.exe	30
PID 2792 wrote to memory of 2756	2792	fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918N.exe	30
PID 2792 wrote to memory of 2756	2792	fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918N.exe	30
PID 2792 wrote to memory of 2756	2792	fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918N.exe	30
PID 2792 wrote to memory of 2748	2792	fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918N.exe	31
PID 2792 wrote to memory of 2748	2792	fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918N.exe	31
PID 2792 wrote to memory of 2748	2792	fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918N.exe	31
PID 2792 wrote to memory of 2748	2792	fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918N.exe	31
PID 2748 wrote to memory of 2596	2748	icsys.icn.exe	32
PID 2748 wrote to memory of 2596	2748	icsys.icn.exe	32
PID 2748 wrote to memory of 2596	2748	icsys.icn.exe	32
PID 2748 wrote to memory of 2596	2748	icsys.icn.exe	32
PID 2596 wrote to memory of 2624	2596	explorer.exe	33
PID 2596 wrote to memory of 2624	2596	explorer.exe	33
PID 2596 wrote to memory of 2624	2596	explorer.exe	33
PID 2596 wrote to memory of 2624	2596	explorer.exe	33
PID 2624 wrote to memory of 1008	2624	spoolsv.exe	34
PID 2624 wrote to memory of 1008	2624	spoolsv.exe	34
PID 2624 wrote to memory of 1008	2624	spoolsv.exe	34
PID 2624 wrote to memory of 1008	2624	spoolsv.exe	34
PID 1008 wrote to memory of 964	1008	svchost.exe	35
PID 1008 wrote to memory of 964	1008	svchost.exe	35
PID 1008 wrote to memory of 964	1008	svchost.exe	35
PID 1008 wrote to memory of 964	1008	svchost.exe	35
PID 2596 wrote to memory of 2524	2596	explorer.exe	36
PID 2596 wrote to memory of 2524	2596	explorer.exe	36
PID 2596 wrote to memory of 2524	2596	explorer.exe	36
PID 2596 wrote to memory of 2524	2596	explorer.exe	36
PID 1008 wrote to memory of 1640	1008	svchost.exe	37
PID 1008 wrote to memory of 1640	1008	svchost.exe	37
PID 1008 wrote to memory of 1640	1008	svchost.exe	37
PID 1008 wrote to memory of 1640	1008	svchost.exe	37
PID 1008 wrote to memory of 1956	1008	svchost.exe	41
PID 1008 wrote to memory of 1956	1008	svchost.exe	41
PID 1008 wrote to memory of 1956	1008	svchost.exe	41
PID 1008 wrote to memory of 1956	1008	svchost.exe	41

C:\Users\Admin\AppData\Local\Temp\fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918N.exe
"C:\Users\Admin\AppData\Local\Temp\fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918N.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2792
- \??\c:\users\admin\appdata\local\temp\fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918n.exe
  c:\users\admin\appdata\local\temp\fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918n.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2756
- C:\Windows\Resources\Themes\icsys.icn.exe
  C:\Windows\Resources\Themes\icsys.icn.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2748
- - \??\c:\windows\resources\themes\explorer.exe
    c:\windows\resources\themes\explorer.exe
    3⤵
    - Modifies visiblity of hidden/system files in Explorer
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - \??\c:\windows\resources\spoolsv.exe
      c:\windows\resources\spoolsv.exe SE
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2624
    - - \??\c:\windows\resources\svchost.exe
        
        c:\windows\resources\svchost.exe
        5⤵
        Modifies visiblity of hidden/system files in Explorer
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1008
      - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:964
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 19:08 /f
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1640
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 19:09 /f
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1956
  - - C:\Windows\Explorer.exe
      C:\Windows\Explorer.exe
      4⤵
      PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Resources\Themes\icsys.icn.exe

Filesize
135KB

MD5
1954f8dfe5c17a8d56fd5befee052c3a

SHA1
c3af21ac64d775b9950f2229967d16ed0d6ef957

SHA256
bb16f5b8140e4a947d8c51d4687a2e2d55ed8686d55b54e2608d1838d53a598d

SHA512
43f5cf826888c535e05f19260ecda823491387024477d7f7087337764e65859cc6554bb92708f61d28746a09c616c0f21187ba8214e7c2b536552b9b21cf0a9a

Download Submit
\Program Files\Common Files\System\symsrv.dll

Filesize
67KB

MD5
7574cf2c64f35161ab1292e2f532aabf

SHA1
14ba3fa927a06224dfe587014299e834def4644f

SHA256
de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085

SHA512
4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab

Download Submit
\Users\Admin\AppData\Local\Temp\fd61dfd3efc792e8eee11592226d3e38f43ed0cbe8607a25f38253f2e9f0b918n.exe

Filesize
59KB

MD5
2a0063bb4d8669ddc603064c36bb290b

SHA1
49aefdf9e9f9d7c2f2af35c7f46dac6dc349618f

SHA256
5e84b6a41d3df263a83f67989f1401bd02cf9e13582d124cd44260e7ef9cac08

SHA512
9e1bce5c1c85aa4850ff7cc956147eb1bf231d8142f39152fe1b94f98be97b4f8c4853e9f5523e8b6d1c0aef60e86b02121623ba0b88583905eb69f7b14a8393

Download Submit
\Windows\Resources\Themes\explorer.exe

Filesize
135KB

MD5
a3810d7cc63dedd1cb10ebeba6618f2e

SHA1
0b635e523731448d37ed281e9a009e16795d6ee7

SHA256
5332be73f4848280f8212768d3a2e6af9c28c7c891d29a42fb23b6fd26a2ad7c

SHA512
20261a093c19bca27ed7456b6712cabf440e36892db2d7103369a4c51919768757e3a13e61dfead7746e7da45c4d6f8b940eb4ae2c43e34779dd80aa27cc3c5c

Download Submit
\Windows\Resources\spoolsv.exe

Filesize
135KB

MD5
80795ce16673d85a2cea017ec1356261

SHA1
30483b795c1157c63583817e5312c7664f40afdf

SHA256
4932c2617cb23a04ed277d7c03fbed90acdf18b83ea5e21c35458d6d6612e388

SHA512
bb20dc8b0409caf114462d52a7c8b249608e1b97dbf19c9fe9b77c3c78ad020240b737db69b65253ec2fd98e48f3616128149de3dd216c2bae530a3e6ae14ae0

Download Submit
\Windows\Resources\svchost.exe

Filesize
135KB

MD5
b48014a19842c0e8c0842ce7684653d6

SHA1
4d2dfd75646561e1e55495fe69794580e458786a

SHA256
20425ba45cc7d57b78f1303417d8f6f953130af3f8f7298ed2305ce50f19b361

SHA512
6964b5f93b277c1ce0c462e9591eefa5e8e49dc0bb144b6e1f46ebb4bee7ae6890460991b84f633eca49142b6e9b95aea1fdf8be8ab60cba797f59dd100335e6

Download Submit
memory/964-77-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1008-71-0x00000000002A0000-0x00000000002BF000-memory.dmp

Filesize
124KB

Download
memory/1008-92-0x00000000002A0000-0x00000000002BF000-memory.dmp

Filesize
124KB

Download
memory/1008-90-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2596-89-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2624-78-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2748-80-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2756-73-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2792-70-0x00000000003C0000-0x00000000003FD000-memory.dmp

Filesize
244KB

Download
memory/2792-64-0x00000000003C0000-0x00000000003FD000-memory.dmp

Filesize
244KB

Download
memory/2792-53-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2792-30-0x00000000003C0000-0x00000000003DF000-memory.dmp

Filesize
124KB

Download
memory/2792-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2792-81-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2792-79-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download
memory/2792-17-0x00000000003C0000-0x00000000003FD000-memory.dmp

Filesize
244KB

Download
memory/2792-9-0x000000000040E000-0x0000000000411000-memory.dmp

Filesize
12KB

Download
memory/2792-4-0x0000000010000000-0x0000000010030000-memory.dmp

Filesize
192KB

Download