0dbf1b710c3e35fd74c2fe81e4b4ce93f24f4da810a8c75d8189286fa3742548

Analysis

max time kernel
141s
max time network
121s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-06-2024 19:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0dbf1b710c3e35fd74c2fe81e4b4ce93f24f4da810a8c75d8189286fa3742548_NeikiAnalytics.exe
Size

504KB
MD5

c49d0b6efefe3e62e468ab069ded99d0
SHA1

27e403a0c8d39f441aad8d81e41482acc2d16539
SHA256

0dbf1b710c3e35fd74c2fe81e4b4ce93f24f4da810a8c75d8189286fa3742548
SHA512

d44cb147d6aea089affb6a02dd3dec2b0b5933b07214bd96b3bb005131e63a54f341a01cebc79926dc5fc86e56998e18b0079e17d69434d4aedd00b10fe9f60d
SSDEEP

12288:tPmTkT0+nXTv1d5Jo/H4a6ZeUOHFVS9Qg:Vmo4IXhd81rS

Score

7^/10

adware persistence stealer upx

Malware Config

Signatures

Executes dropped EXE 3 IoCs

Processes:

Explorrer.exeExplorrer.exeExplorrer.exe

pid process

2408 Explorrer.exe
2412 Explorrer.exe
1720 Explorrer.exe

pid	process
2408	Explorrer.exe
2412	Explorrer.exe
1720	Explorrer.exe

Loads dropped DLL 4 IoCs

Processes:

0dbf1b710c3e35fd74c2fe81e4b4ce93f24f4da810a8c75d8189286fa3742548_NeikiAnalytics.exeregsvr32.exeregsvr32.exe

pid	process
2112	0dbf1b710c3e35fd74c2fe81e4b4ce93f24f4da810a8c75d8189286fa3742548_NeikiAnalytics.exe
2112	0dbf1b710c3e35fd74c2fe81e4b4ce93f24f4da810a8c75d8189286fa3742548_NeikiAnalytics.exe
2004	regsvr32.exe
1668	regsvr32.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1928-0-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral1/memory/1928-3-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral1/memory/1928-4-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral1/memory/1928-23-0x0000000000400000-0x000000000049C000-memory.dmp	upx
\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe	upx
behavioral1/memory/2408-36-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral1/memory/2408-40-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral1/memory/2408-42-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral1/memory/2408-77-0x0000000000400000-0x000000000049C000-memory.dmp	upx
behavioral1/memory/2408-74-0x0000000000400000-0x000000000049C000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\Explorrer = "C:\\Users\\Admin\\AppData\\Roaming\\AppsData\\Explorrer.exe -notray"	reg.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

regsvr32.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{DE274C2C-2133-4B4B-93B3-8F21486DABC0}\NoExplorer = "1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DE274C2C-2133-4B4B-93B3-8F21486DABC0}	regsvr32.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

0dbf1b710c3e35fd74c2fe81e4b4ce93f24f4da810a8c75d8189286fa3742548_NeikiAnalytics.exeExplorrer.exe

description	pid	process	target process
PID 1928 set thread context of 2112	1928	0dbf1b710c3e35fd74c2fe81e4b4ce93f24f4da810a8c75d8189286fa3742548_NeikiAnalytics.exe	0dbf1b710c3e35fd74c2fe81e4b4ce93f24f4da810a8c75d8189286fa3742548_NeikiAnalytics.exe
PID 2408 set thread context of 2412	2408	Explorrer.exe	Explorrer.exe
PID 2408 set thread context of 1720	2408	Explorrer.exe	Explorrer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command and Scripting Interpreter
T1059

Processes:

ipconfig.exe

pid process

1812 ipconfig.exe

pid	process
1812	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

Processes:

Explorrer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Approved Extensions	Explorrer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Approved Extensions\{3543619C-D563-43f7-95EA-4DA7E1CC396A} = 51667a6c4c1d3b1b003ad2d87fc9ac0780c431c2a3933e7f	Explorrer.exe

Modifies registry class 5 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DE274C2C-2133-4B4B-93B3-8F21486DABC0}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DE274C2C-2133-4B4B-93B3-8F21486DABC0}\ = "IE MANAGER"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DE274C2C-2133-4B4B-93B3-8F21486DABC0}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DE274C2C-2133-4B4B-93B3-8F21486DABC0}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Roaming\\IE\\bho.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DE274C2C-2133-4B4B-93B3-8F21486DABC0}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

696 reg.exe

pid	process
696	reg.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

0dbf1b710c3e35fd74c2fe81e4b4ce93f24f4da810a8c75d8189286fa3742548_NeikiAnalytics.exe0dbf1b710c3e35fd74c2fe81e4b4ce93f24f4da810a8c75d8189286fa3742548_NeikiAnalytics.exeExplorrer.exeExplorrer.exe

pid	process
1928	0dbf1b710c3e35fd74c2fe81e4b4ce93f24f4da810a8c75d8189286fa3742548_NeikiAnalytics.exe
2112	0dbf1b710c3e35fd74c2fe81e4b4ce93f24f4da810a8c75d8189286fa3742548_NeikiAnalytics.exe
2408	Explorrer.exe
2412	Explorrer.exe

Suspicious use of WriteProcessMemory 62 IoCs

Processes:

0dbf1b710c3e35fd74c2fe81e4b4ce93f24f4da810a8c75d8189286fa3742548_NeikiAnalytics.exe0dbf1b710c3e35fd74c2fe81e4b4ce93f24f4da810a8c75d8189286fa3742548_NeikiAnalytics.exeExplorrer.exeExplorrer.exeipconfig.execmd.exeExplorrer.exe

description	pid	process	target process
PID 1928 wrote to memory of 2112	1928	0dbf1b710c3e35fd74c2fe81e4b4ce93f24f4da810a8c75d8189286fa3742548_NeikiAnalytics.exe	0dbf1b710c3e35fd74c2fe81e4b4ce93f24f4da810a8c75d8189286fa3742548_NeikiAnalytics.exe
PID 1928 wrote to memory of 2112	1928	0dbf1b710c3e35fd74c2fe81e4b4ce93f24f4da810a8c75d8189286fa3742548_NeikiAnalytics.exe	0dbf1b710c3e35fd74c2fe81e4b4ce93f24f4da810a8c75d8189286fa3742548_NeikiAnalytics.exe
PID 1928 wrote to memory of 2112	1928	0dbf1b710c3e35fd74c2fe81e4b4ce93f24f4da810a8c75d8189286fa3742548_NeikiAnalytics.exe	0dbf1b710c3e35fd74c2fe81e4b4ce93f24f4da810a8c75d8189286fa3742548_NeikiAnalytics.exe
PID 1928 wrote to memory of 2112	1928	0dbf1b710c3e35fd74c2fe81e4b4ce93f24f4da810a8c75d8189286fa3742548_NeikiAnalytics.exe	0dbf1b710c3e35fd74c2fe81e4b4ce93f24f4da810a8c75d8189286fa3742548_NeikiAnalytics.exe
PID 1928 wrote to memory of 2112	1928	0dbf1b710c3e35fd74c2fe81e4b4ce93f24f4da810a8c75d8189286fa3742548_NeikiAnalytics.exe	0dbf1b710c3e35fd74c2fe81e4b4ce93f24f4da810a8c75d8189286fa3742548_NeikiAnalytics.exe
PID 1928 wrote to memory of 2112	1928	0dbf1b710c3e35fd74c2fe81e4b4ce93f24f4da810a8c75d8189286fa3742548_NeikiAnalytics.exe	0dbf1b710c3e35fd74c2fe81e4b4ce93f24f4da810a8c75d8189286fa3742548_NeikiAnalytics.exe
PID 1928 wrote to memory of 2112	1928	0dbf1b710c3e35fd74c2fe81e4b4ce93f24f4da810a8c75d8189286fa3742548_NeikiAnalytics.exe	0dbf1b710c3e35fd74c2fe81e4b4ce93f24f4da810a8c75d8189286fa3742548_NeikiAnalytics.exe
PID 1928 wrote to memory of 2112	1928	0dbf1b710c3e35fd74c2fe81e4b4ce93f24f4da810a8c75d8189286fa3742548_NeikiAnalytics.exe	0dbf1b710c3e35fd74c2fe81e4b4ce93f24f4da810a8c75d8189286fa3742548_NeikiAnalytics.exe
PID 1928 wrote to memory of 2112	1928	0dbf1b710c3e35fd74c2fe81e4b4ce93f24f4da810a8c75d8189286fa3742548_NeikiAnalytics.exe	0dbf1b710c3e35fd74c2fe81e4b4ce93f24f4da810a8c75d8189286fa3742548_NeikiAnalytics.exe
PID 2112 wrote to memory of 2408	2112	0dbf1b710c3e35fd74c2fe81e4b4ce93f24f4da810a8c75d8189286fa3742548_NeikiAnalytics.exe	Explorrer.exe
PID 2112 wrote to memory of 2408	2112	0dbf1b710c3e35fd74c2fe81e4b4ce93f24f4da810a8c75d8189286fa3742548_NeikiAnalytics.exe	Explorrer.exe
PID 2112 wrote to memory of 2408	2112	0dbf1b710c3e35fd74c2fe81e4b4ce93f24f4da810a8c75d8189286fa3742548_NeikiAnalytics.exe	Explorrer.exe
PID 2112 wrote to memory of 2408	2112	0dbf1b710c3e35fd74c2fe81e4b4ce93f24f4da810a8c75d8189286fa3742548_NeikiAnalytics.exe	Explorrer.exe
PID 2408 wrote to memory of 2412	2408	Explorrer.exe	Explorrer.exe
PID 2408 wrote to memory of 2412	2408	Explorrer.exe	Explorrer.exe
PID 2408 wrote to memory of 2412	2408	Explorrer.exe	Explorrer.exe
PID 2408 wrote to memory of 2412	2408	Explorrer.exe	Explorrer.exe
PID 2408 wrote to memory of 2412	2408	Explorrer.exe	Explorrer.exe
PID 2408 wrote to memory of 2412	2408	Explorrer.exe	Explorrer.exe
PID 2408 wrote to memory of 2412	2408	Explorrer.exe	Explorrer.exe
PID 2408 wrote to memory of 2412	2408	Explorrer.exe	Explorrer.exe
PID 2408 wrote to memory of 2412	2408	Explorrer.exe	Explorrer.exe
PID 2408 wrote to memory of 1720	2408	Explorrer.exe	Explorrer.exe
PID 2408 wrote to memory of 1720	2408	Explorrer.exe	Explorrer.exe
PID 2408 wrote to memory of 1720	2408	Explorrer.exe	Explorrer.exe
PID 2408 wrote to memory of 1720	2408	Explorrer.exe	Explorrer.exe
PID 2408 wrote to memory of 1720	2408	Explorrer.exe	Explorrer.exe
PID 2408 wrote to memory of 1720	2408	Explorrer.exe	Explorrer.exe
PID 2408 wrote to memory of 1720	2408	Explorrer.exe	Explorrer.exe
PID 2408 wrote to memory of 1720	2408	Explorrer.exe	Explorrer.exe
PID 2408 wrote to memory of 1720	2408	Explorrer.exe	Explorrer.exe
PID 2408 wrote to memory of 1720	2408	Explorrer.exe	Explorrer.exe
PID 2408 wrote to memory of 1720	2408	Explorrer.exe	Explorrer.exe
PID 2408 wrote to memory of 1720	2408	Explorrer.exe	Explorrer.exe
PID 2412 wrote to memory of 1812	2412	Explorrer.exe	ipconfig.exe
PID 2412 wrote to memory of 1812	2412	Explorrer.exe	ipconfig.exe
PID 2412 wrote to memory of 1812	2412	Explorrer.exe	ipconfig.exe
PID 2412 wrote to memory of 1812	2412	Explorrer.exe	ipconfig.exe
PID 2412 wrote to memory of 1812	2412	Explorrer.exe	ipconfig.exe
PID 2412 wrote to memory of 1812	2412	Explorrer.exe	ipconfig.exe
PID 1812 wrote to memory of 2584	1812	ipconfig.exe	cmd.exe
PID 1812 wrote to memory of 2584	1812	ipconfig.exe	cmd.exe
PID 1812 wrote to memory of 2584	1812	ipconfig.exe	cmd.exe
PID 1812 wrote to memory of 2584	1812	ipconfig.exe	cmd.exe
PID 2584 wrote to memory of 696	2584	cmd.exe	reg.exe
PID 2584 wrote to memory of 696	2584	cmd.exe	reg.exe
PID 2584 wrote to memory of 696	2584	cmd.exe	reg.exe
PID 2584 wrote to memory of 696	2584	cmd.exe	reg.exe
PID 1720 wrote to memory of 2004	1720	Explorrer.exe	regsvr32.exe
PID 1720 wrote to memory of 2004	1720	Explorrer.exe	regsvr32.exe
PID 1720 wrote to memory of 2004	1720	Explorrer.exe	regsvr32.exe
PID 1720 wrote to memory of 2004	1720	Explorrer.exe	regsvr32.exe
PID 1720 wrote to memory of 2004	1720	Explorrer.exe	regsvr32.exe
PID 1720 wrote to memory of 2004	1720	Explorrer.exe	regsvr32.exe
PID 1720 wrote to memory of 2004	1720	Explorrer.exe	regsvr32.exe
PID 1720 wrote to memory of 1668	1720	Explorrer.exe	regsvr32.exe
PID 1720 wrote to memory of 1668	1720	Explorrer.exe	regsvr32.exe
PID 1720 wrote to memory of 1668	1720	Explorrer.exe	regsvr32.exe
PID 1720 wrote to memory of 1668	1720	Explorrer.exe	regsvr32.exe
PID 1720 wrote to memory of 1668	1720	Explorrer.exe	regsvr32.exe
PID 1720 wrote to memory of 1668	1720	Explorrer.exe	regsvr32.exe
PID 1720 wrote to memory of 1668	1720	Explorrer.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\0dbf1b710c3e35fd74c2fe81e4b4ce93f24f4da810a8c75d8189286fa3742548_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0dbf1b710c3e35fd74c2fe81e4b4ce93f24f4da810a8c75d8189286fa3742548_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928

C:\Users\Admin\AppData\Local\Temp\0dbf1b710c3e35fd74c2fe81e4b4ce93f24f4da810a8c75d8189286fa3742548_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\0dbf1b710c3e35fd74c2fe81e4b4ce93f24f4da810a8c75d8189286fa3742548_NeikiAnalytics.exe"
2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112

C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe
C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe -notray
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2408

C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe
"C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe"
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412

C:\Windows\SysWOW64\ipconfig.exe
"C:\Windows\system32\ipconfig.exe"
5⤵
- Gathers network information
- Suspicious use of WriteProcessMemory
PID:1812

C:\Windows\SysWOW64\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\GJVVWRPW.bat" "
6⤵
- Suspicious use of WriteProcessMemory
PID:2584

C:\Windows\SysWOW64\reg.exe
REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Explorrer /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe -notray" /f
7⤵
- Adds Run key to start application
- Modifies registry key
PID:696

C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe
"C:\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe"
4⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1720

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /u /s "C:\Users\Admin\AppData\Roaming\IE\bho.dll"
5⤵
- Loads dropped DLL
PID:2004

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s "C:\Users\Admin\AppData\Roaming\IE\bho.dll"
5⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:1668

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\GJVVWRPW.bat
Filesize
153B

MD5
02cbdd547ced25f8f7dc814d9169d567

SHA1
fc9697d828dcda615f6edd3e49a55b9307dbd311

SHA256
ec250cdf89523b18688d45fdc11bc93e46547a574ef59e03426c098f6b887c07

SHA512
cec1b6c5d843408e3cb6345a3430d8469a07c09677e1bd4c522c41ee29dbd941236a8dd9963410c69a165f3913c30aa22cfd206e51a59b9ffd160c38e70cfe3f

Download Submit
C:\Users\Admin\AppData\Roaming\IE\bho.dll
Filesize
87KB

MD5
49a92a33d1775b45b3bd45f8bec24585

SHA1
ea404af50bbdad5cbc9f95f4068bdc30c9fceff6

SHA256
976540cf1b4d04d80be1f1af8ea0f050c3f03a0a8c4e339589b7bb9180fc07f5

SHA512
7d5c4ea5c6f950a41bff386289df88b3f6d78444d7eeaa8a426569ce7698c2dfa916ae02d321af2be839c20e53b2ba9b3bb6a1573cad3b578733b082f0dc292f

Download Submit
\Users\Admin\AppData\Roaming\AppsData\Explorrer.exe
Filesize
504KB

MD5
5569326c79e118112c82a58db41ef501

SHA1
f9258535f6af383df7de2391f549bafcea9e1bda

SHA256
6098f6b5554af242dccdd6aebc597e2bff7e3d56d28f39dcbaf33f29c531ec03

SHA512
fe3ceb8c4f68bd2efa8778508508b26f7550ef7dc440d2a304557a337cd8b8e19958f5fe41c618ad1b12e7fe544f5e5fab00417c30606983683d3fb76d166458

Download Submit
memory/1720-69-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1720-63-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1720-215-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1720-84-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1720-57-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1720-80-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1720-59-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1720-81-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1720-61-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1720-79-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1720-65-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1720-67-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1720-73-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1720-85-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1720-76-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1720-78-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1720-82-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1720-86-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1720-87-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1812-92-0x00000000000C0000-0x00000000000C1000-memory.dmp

Filesize
4KB

Download
memory/1928-6-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/1928-0-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/1928-3-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/1928-5-0x0000000000260000-0x0000000000261000-memory.dmp

Filesize
4KB

Download
memory/1928-23-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/1928-19-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/1928-18-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/1928-4-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/2112-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2112-39-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2112-26-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2112-11-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2112-9-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2112-17-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2112-7-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2408-36-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/2408-74-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/2408-40-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/2408-77-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/2408-42-0x0000000000400000-0x000000000049C000-memory.dmp

Filesize
624KB

Download
memory/2412-99-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download