Overview

overview

10

Static

static

a645affb4d...9b.exe

windows7_x64

10

a645affb4d...9b.exe

windows10_x64

Analysis

  • max time kernel
    62s
  • max time network
    63s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    24-05-2021 01:02

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    a645affb4d4d35477f4eb8b572b85e9b.exe

  • Size

    3.8MB

  • MD5

    a645affb4d4d35477f4eb8b572b85e9b

  • SHA1

    41b6fc892fa01ae136ca68c321a20713ed0bf774

  • SHA256

    e6e11a92390d1e01775514d1a4f047f5b94471070a07bf82b6e9fe5c547d55a8

  • SHA512

    cdf00d8c0ea39e10cdcb3ba8c88146de164cad0a29218c77b2af9e68f1510c2f73b332e02ed0e9f8fa6356ded3abb732aa3d3f0a842fd70e0e7ba99d80dd7870

Score
10/10
plugxredlinesmokeloadervidarbackdoorbootkitdiscoveryevasioninfostealerpersistencespywarestealertrojanupxvmprotect

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://khaleelahmed.com/upload/

http://twvickiassociation.com/upload/

http://www20833.com/upload/

http://cocinasintonterias.com/upload/

http://masaofukunaga.com/upload/

http://gnckids.com/upload/
rc4.i32
rc4.i32

Signatures

  • PlugX

    PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    trojanplugx
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Downloads MZ/PE file
  • Executes dropped EXE 23 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 4 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Drops file in System32 directory 3 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 7 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Browser
    1⤵
      PID:2864
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s WpnService
      1⤵
        PID:2644
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2616
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2472
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
        1⤵
          PID:2456
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
          1⤵
            PID:1852
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s SENS
            1⤵
              PID:1352
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s UserManager
              1⤵
                PID:1276
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s Themes
                1⤵
                  PID:1228
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                  1⤵
                    PID:1104
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                    1⤵
                    • Drops file in System32 directory
                    PID:928
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                    1⤵
                      PID:352
                    • C:\Users\Admin\AppData\Local\Temp\a645affb4d4d35477f4eb8b572b85e9b.exe
                      "C:\Users\Admin\AppData\Local\Temp\a645affb4d4d35477f4eb8b572b85e9b.exe"
                      1⤵
                      • Checks computer location settings
                      • Suspicious use of WriteProcessMemory
                      PID:3100
                      • C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
                        "C:\Users\Admin\AppData\Local\Temp\KRSetp.exe"
                        2⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:1880
                        • C:\Users\Admin\AppData\Roaming\3550276.exe
                          "C:\Users\Admin\AppData\Roaming\3550276.exe"
                          3⤵
                          • Executes dropped EXE
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:372
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 372 -s 1832
                            4⤵
                            • Drops file in Windows directory
                            • Program crash
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4832
                        • C:\Users\Admin\AppData\Roaming\8400904.exe
                          "C:\Users\Admin\AppData\Roaming\8400904.exe"
                          3⤵
                          • Executes dropped EXE
                          • Adds Run key to start application
                          • Suspicious use of WriteProcessMemory
                          PID:1408
                          • C:\ProgramData\Windows Host\Windows Host.exe
                            "C:\ProgramData\Windows Host\Windows Host.exe"
                            4⤵
                            • Executes dropped EXE
                            PID:4824
                        • C:\Users\Admin\AppData\Roaming\5810022.exe
                          "C:\Users\Admin\AppData\Roaming\5810022.exe"
                          3⤵
                          • Executes dropped EXE
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4352
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 4352 -s 2100
                            4⤵
                            • Program crash
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4344
                      • C:\Users\Admin\AppData\Local\Temp\agdsk.exe
                        "C:\Users\Admin\AppData\Local\Temp\agdsk.exe"
                        2⤵
                        • Executes dropped EXE
                        • Modifies system certificate store
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:4168
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd.exe /c taskkill /f /im chrome.exe
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:5032
                          • C:\Windows\SysWOW64\taskkill.exe
                            taskkill /f /im chrome.exe
                            4⤵
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:5080
                      • C:\Users\Admin\AppData\Local\Temp\jg3_3uag.exe
                        "C:\Users\Admin\AppData\Local\Temp\jg3_3uag.exe"
                        2⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:4184
                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\jg3_3uag.exe
                          "C:\Users\Admin\AppData\Local\Temp\RarSFX0\jg3_3uag.exe"
                          3⤵
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          PID:4816
                      • C:\Users\Admin\AppData\Local\Temp\Files.exe
                        "C:\Users\Admin\AppData\Local\Temp\Files.exe"
                        2⤵
                        • Executes dropped EXE
                        • Checks computer location settings
                        • Suspicious use of WriteProcessMemory
                        PID:4220
                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe
                          "C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe"
                          3⤵
                          • Executes dropped EXE
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          PID:4808
                          • C:\Users\Public\run2.exe
                            C:\Users\Public\run2.exe
                            4⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Checks processor information in registry
                            PID:4952
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\System32\cmd.exe" /c taskkill /im run2.exe /f & timeout /t 6 & del /f /q "C:\Users\Public\run2.exe" & del C:\ProgramData\*.dll & exit
                              5⤵
                                PID:6040
                                • C:\Windows\SysWOW64\taskkill.exe
                                  taskkill /im run2.exe /f
                                  6⤵
                                  • Kills process with taskkill
                                  PID:5472
                                • C:\Windows\SysWOW64\timeout.exe
                                  timeout /t 6
                                  6⤵
                                  • Delays execution with timeout.exe
                                  PID:5196
                            • C:\Users\Public\run.exe
                              C:\Users\Public\run.exe
                              4⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              PID:188
                              • C:\Users\Public\run.exe
                                C:\Users\Public\run.exe
                                5⤵
                                • Executes dropped EXE
                                PID:5380
                        • C:\Users\Admin\AppData\Local\Temp\wf-game.exe
                          "C:\Users\Admin\AppData\Local\Temp\wf-game.exe"
                          2⤵
                            PID:4292
                            • C:\Windows\SysWOW64\rUNdlL32.eXe
                              "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",getname
                              3⤵
                              • Loads dropped DLL
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:3200
                          • C:\Users\Admin\AppData\Local\Temp\pub2.exe
                            "C:\Users\Admin\AppData\Local\Temp\pub2.exe"
                            2⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Checks SCSI registry key(s)
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious behavior: MapViewOfSection
                            PID:4408
                          • C:\Users\Admin\AppData\Local\Temp\pzyh.exe
                            "C:\Users\Admin\AppData\Local\Temp\pzyh.exe"
                            2⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:4320
                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                              3⤵
                              • Executes dropped EXE
                              PID:4704
                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                              3⤵
                              • Executes dropped EXE
                              • Suspicious behavior: EnumeratesProcesses
                              PID:5028
                        • \??\c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k netsvcs -s BITS
                          1⤵
                          • Suspicious use of SetThreadContext
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:1804
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                            2⤵
                            • Drops file in System32 directory
                            • Checks processor information in registry
                            • Modifies data under HKEY_USERS
                            • Modifies registry class
                            PID:2368
                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                          1⤵
                          • Drops file in Windows directory
                          • Modifies Internet Explorer settings
                          • Modifies registry class
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of SetWindowsHookEx
                          PID:3872
                        • C:\Windows\system32\browser_broker.exe
                          C:\Windows\system32\browser_broker.exe -Embedding
                          1⤵
                          • Modifies Internet Explorer settings
                          PID:4044
                        • C:\Windows\System32\svchost.exe
                          C:\Windows\System32\svchost.exe -k WerSvcGroup
                          1⤵
                          • Executes dropped EXE
                          • Suspicious use of WriteProcessMemory
                          PID:4292
                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                          1⤵
                          • Modifies registry class
                          • Suspicious use of SetWindowsHookEx
                          PID:4280
                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                          1⤵
                          • Modifies registry class
                          PID:4240
                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                          1⤵
                          • Modifies registry class
                          PID:3796
                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                          1⤵
                          • Drops file in Windows directory
                          • Modifies registry class
                          • Suspicious use of SetWindowsHookEx
                          PID:3800
                        • C:\Windows\system32\browser_broker.exe
                          C:\Windows\system32\browser_broker.exe -Embedding
                          1⤵
                          • Modifies Internet Explorer settings
                          PID:1576
                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                          1⤵
                          • Modifies registry class
                          • Suspicious behavior: MapViewOfSection
                          • Suspicious use of SetWindowsHookEx
                          PID:5296
                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                          1⤵
                          • Modifies Internet Explorer settings
                          • Modifies registry class
                          PID:5476
                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                          1⤵
                          • Modifies registry class
                          PID:5428
                        • C:\Users\Admin\AppData\Local\Temp\D2A7.exe
                          C:\Users\Admin\AppData\Local\Temp\D2A7.exe
                          1⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          PID:5712
                          • C:\Users\Admin\AppData\Local\Temp\D2A7.exe
                            C:\Users\Admin\AppData\Local\Temp\D2A7.exe
                            2⤵
                            • Executes dropped EXE
                            • Adds Run key to start application
                            PID:5760
                            • C:\Windows\SysWOW64\icacls.exe
                              icacls "C:\Users\Admin\AppData\Local\2ff8ac70-83b1-4a90-b6f1-93d52ed8f1bd" /deny *S-1-1-0:(OI)(CI)(DE,DC)
                              3⤵
                              • Modifies file permissions
                              PID:5836
                            • C:\Users\Admin\AppData\Local\Temp\D2A7.exe
                              "C:\Users\Admin\AppData\Local\Temp\D2A7.exe" --Admin IsNotAutoStart IsNotTask
                              3⤵
                              • Executes dropped EXE
                              PID:5868
                              • C:\Users\Admin\AppData\Local\Temp\D2A7.exe
                                "C:\Users\Admin\AppData\Local\Temp\D2A7.exe" --Admin IsNotAutoStart IsNotTask
                                4⤵
                                • Executes dropped EXE
                                PID:3056
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 5868 -s 320
                                4⤵
                                • Program crash
                                PID:2032
                        • C:\Users\Admin\AppData\Local\Temp\DE12.exe
                          C:\Users\Admin\AppData\Local\Temp\DE12.exe
                          1⤵
                          • Executes dropped EXE
                          • Writes to the Master Boot Record (MBR)
                          PID:5736
                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                          1⤵
                          • Modifies registry class
                          PID:5888
                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                          1⤵
                          • Modifies registry class
                          PID:5980

                        Network

                        MITRE ATT&CK Enterprise v6

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • memory/188-281-0x0000000004DC0000-0x00000000052BE000-memory.dmp

                          Filesize

                          5.0MB

                          Download

                        • memory/352-224-0x000001E078570000-0x000001E0785BB000-memory.dmp

                          Filesize

                          300KB

                          Download

                        • memory/352-227-0x000001E078E40000-0x000001E078EB0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/372-167-0x0000000001600000-0x0000000001601000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/372-165-0x0000000002F80000-0x0000000002FB1000-memory.dmp

                          Filesize

                          196KB

                          Download

                        • memory/372-132-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/372-179-0x00000000055D0000-0x00000000055D1000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/372-173-0x0000000005530000-0x0000000005531000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/372-139-0x00000000015F0000-0x00000000015F1000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/928-248-0x0000020859E40000-0x0000020859EB0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1104-242-0x0000026B11320000-0x0000026B11390000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1228-264-0x0000015777240000-0x00000157772B0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1276-266-0x000001C197B60000-0x000001C197BD0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1352-253-0x000001A927A50000-0x000001A927AC0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1408-168-0x00000000053C0000-0x00000000053C1000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/1408-138-0x00000000050A0000-0x00000000050A1000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/1408-160-0x0000000005210000-0x0000000005211000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/1408-131-0x0000000000910000-0x0000000000911000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/1408-159-0x0000000002AF0000-0x0000000002B00000-memory.dmp

                          Filesize

                          64KB

                          Download

                        • memory/1408-164-0x0000000005820000-0x0000000005821000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/1408-170-0x0000000005340000-0x0000000005341000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/1804-236-0x000001B752210000-0x000001B752280000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1852-262-0x000001AD22F50000-0x000001AD22FC0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1880-119-0x0000000000030000-0x0000000000031000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/1880-122-0x0000000000760000-0x0000000000780000-memory.dmp

                          Filesize

                          128KB

                          Download

                        • memory/1880-130-0x000000001ABE0000-0x000000001ABE2000-memory.dmp

                          Filesize

                          8KB

                          Download

                        • memory/1880-123-0x0000000000780000-0x0000000000781000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/1880-121-0x0000000000750000-0x0000000000751000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2368-249-0x000001F4B0740000-0x000001F4B07B0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/2368-299-0x000001F4B20A0000-0x000001F4B20BB000-memory.dmp

                          Filesize

                          108KB

                          Download

                        • memory/2368-297-0x000001F4B2E00000-0x000001F4B2F06000-memory.dmp

                          Filesize

                          1.0MB

                          Download

                        • memory/2456-232-0x00000122DE830000-0x00000122DE8A0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/2472-237-0x000001B8EADD0000-0x000001B8EAE40000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/2616-268-0x000001C469900000-0x000001C469970000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/2644-270-0x000001BE65C40000-0x000001BE65CB0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/2864-247-0x000001EB92840000-0x000001EB928B0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/3064-292-0x0000000000840000-0x0000000000856000-memory.dmp

                          Filesize

                          88KB

                          Download

                        • memory/3200-226-0x0000000004510000-0x000000000456C000-memory.dmp

                          Filesize

                          368KB

                          Download

                        • memory/3200-222-0x0000000000F3A000-0x000000000103B000-memory.dmp

                          Filesize

                          1.0MB

                          Download

                        • memory/4352-174-0x00000000016F0000-0x00000000016F1000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/4352-172-0x00000000050E0000-0x0000000005119000-memory.dmp

                          Filesize

                          228KB

                          Download

                        • memory/4352-163-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/4352-178-0x00000000058B0000-0x00000000058B1000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/4352-169-0x00000000016B0000-0x00000000016B1000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/4408-283-0x0000000000400000-0x0000000000452000-memory.dmp

                          Filesize

                          328KB

                          Download

                        • memory/4408-282-0x00000000004B0000-0x00000000004B9000-memory.dmp

                          Filesize

                          36KB

                          Download

                        • memory/4816-192-0x0000000000400000-0x00000000005DE000-memory.dmp

                          Filesize

                          1.9MB

                          Download

                        • memory/4824-198-0x00000000071E0000-0x00000000071E1000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/4824-197-0x0000000002410000-0x0000000002411000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/4952-301-0x0000000000400000-0x00000000004AE000-memory.dmp

                          Filesize

                          696KB

                          Download

                        • memory/4952-300-0x00000000005E0000-0x000000000072A000-memory.dmp

                          Filesize

                          1.3MB

                          Download

                        • memory/5380-309-0x0000000005260000-0x0000000005261000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/5712-313-0x00000000021F0000-0x000000000230B000-memory.dmp

                          Filesize

                          1.1MB

                          Download

                        • memory/5736-317-0x0000000000710000-0x000000000077B000-memory.dmp

                          Filesize

                          428KB

                          Download

                        • memory/5736-318-0x0000000000400000-0x00000000004A9000-memory.dmp

                          Filesize

                          676KB

                          Download

                        • memory/5760-314-0x0000000000400000-0x0000000000537000-memory.dmp

                          Filesize

                          1.2MB

                          Download