Analysis

  • max time kernel
    84s
  • max time network
    182s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    20/12/2021, 14:02

General

  • Target

    99194b593d58a4f74bd2ca7541f5d782db0d10fe7ec5fdeda5b5e8fe704394fa.exe

  • Size

    7.0MB

  • MD5

    27ee0fff858ebb65e9d645b3890418f9

  • SHA1

    78cce78871932c34b30a16296063ee1ca6c152e5

  • SHA256

    99194b593d58a4f74bd2ca7541f5d782db0d10fe7ec5fdeda5b5e8fe704394fa

  • SHA512

    193f9dca9b3a7f26b7e0222d784e2f88f76743141c51917ba4dc4232ba1e2205b9fa53762c55926f53ea9c37670d121ab971e77ed0e33641db51ee355737ef05

Malware Config

Extracted

Family

socelars

C2

http://www.biohazardgraphics.com/

Extracted

Family

vidar

Version

49.1

Botnet

915

C2

https://noc.social/@sergeev46

https://c.im/@sergeev47

Attributes
  • profile_id

    915

Extracted

Family

smokeloader

Version

2020

C2

http://rcacademy.at/upload/

http://e-lanpengeonline.com/upload/

http://vjcmvz.cn/upload/

http://galala.ru/upload/

http://witra.ru/upload/

rc4.i32
rc4.i32

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 2 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • NirSoft WebBrowserPassView 1 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 2 IoCs
  • Vidar Stealer 2 IoCs
  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Executes dropped EXE 25 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 2 IoCs
  • Modifies data under HKEY_USERS 5 IoCs
  • Modifies registry class 8 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\services.exe
    C:\Windows\system32\services.exe
    1⤵
      PID:464
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious use of SetThreadContext
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:864
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k SystemNetworkService
        2⤵
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        PID:1536
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k SystemNetworkService
        2⤵
          PID:2688
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k SystemNetworkService
          2⤵
            PID:2440
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k SystemNetworkService
            2⤵
              PID:2144
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k SystemNetworkService
              2⤵
                PID:3044
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k SystemNetworkService
                2⤵
                  PID:3036
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k SystemNetworkService
                  2⤵
                    PID:3032
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k SystemNetworkService
                    2⤵
                      PID:1680
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k SystemNetworkService
                      2⤵
                      • Modifies registry class
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2960
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k SystemNetworkService
                      2⤵
                        PID:1600
                    • C:\Users\Admin\AppData\Local\Temp\99194b593d58a4f74bd2ca7541f5d782db0d10fe7ec5fdeda5b5e8fe704394fa.exe
                      "C:\Users\Admin\AppData\Local\Temp\99194b593d58a4f74bd2ca7541f5d782db0d10fe7ec5fdeda5b5e8fe704394fa.exe"
                      1⤵
                      • Loads dropped DLL
                      • Suspicious use of WriteProcessMemory
                      PID:956
                      • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                        "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
                        2⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Suspicious use of WriteProcessMemory
                        PID:1872
                        • C:\Users\Admin\AppData\Local\Temp\7zS0573C026\setup_install.exe
                          "C:\Users\Admin\AppData\Local\Temp\7zS0573C026\setup_install.exe"
                          3⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Suspicious use of WriteProcessMemory
                          PID:528
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
                            4⤵
                              PID:1876
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                              4⤵
                              • Suspicious use of WriteProcessMemory
                              PID:1932
                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
                                5⤵
                                  PID:1200
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c Sun10467c5b95.exe
                                4⤵
                                • Loads dropped DLL
                                • Suspicious use of WriteProcessMemory
                                PID:1444
                                • C:\Users\Admin\AppData\Local\Temp\7zS0573C026\Sun10467c5b95.exe
                                  Sun10467c5b95.exe
                                  5⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  PID:1964
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c Sun108e4051ef0.exe
                                4⤵
                                • Loads dropped DLL
                                PID:1816
                                • C:\Users\Admin\AppData\Local\Temp\7zS0573C026\Sun108e4051ef0.exe
                                  Sun108e4051ef0.exe
                                  5⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1896
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c Sun1074b86ebb831862.exe
                                4⤵
                                • Loads dropped DLL
                                PID:1456
                                • C:\Users\Admin\AppData\Local\Temp\7zS0573C026\Sun1074b86ebb831862.exe
                                  Sun1074b86ebb831862.exe
                                  5⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  PID:1164
                                  • C:\Windows\SysWOW64\control.exe
                                    "C:\Windows\System32\control.exe" .\2c3M8M5c.RJ
                                    6⤵
                                      PID:2532
                                      • C:\Windows\SysWOW64\rundll32.exe
                                        "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\2c3M8M5c.RJ
                                        7⤵
                                          PID:2576
                                          • C:\Windows\system32\RunDll32.exe
                                            C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL .\2c3M8M5c.RJ
                                            8⤵
                                              PID:3012
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c Sun1050791613c996ff.exe
                                      4⤵
                                      • Loads dropped DLL
                                      PID:976
                                      • C:\Users\Admin\AppData\Local\Temp\7zS0573C026\Sun1050791613c996ff.exe
                                        Sun1050791613c996ff.exe
                                        5⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        PID:828
                                        • C:\Users\Admin\AppData\Local\Temp\7zS0573C026\Sun1050791613c996ff.exe
                                          "C:\Users\Admin\AppData\Local\Temp\7zS0573C026\Sun1050791613c996ff.exe" -u
                                          6⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          PID:1468
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c Sun10aa9ae1c57b995f.exe
                                      4⤵
                                      • Loads dropped DLL
                                      PID:1724
                                      • C:\Users\Admin\AppData\Local\Temp\7zS0573C026\Sun10aa9ae1c57b995f.exe
                                        Sun10aa9ae1c57b995f.exe
                                        5⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:2008
                                        • C:\Users\Admin\AppData\Local\Temp\7zS0573C026\Sun10aa9ae1c57b995f.exe
                                          C:\Users\Admin\AppData\Local\Temp\7zS0573C026\Sun10aa9ae1c57b995f.exe
                                          6⤵
                                            PID:2444
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c Sun10f1b87ddac.exe
                                        4⤵
                                        • Loads dropped DLL
                                        PID:572
                                        • C:\Users\Admin\AppData\Local\Temp\7zS0573C026\Sun10f1b87ddac.exe
                                          Sun10f1b87ddac.exe
                                          5⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Checks SCSI registry key(s)
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious behavior: MapViewOfSection
                                          PID:1752
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c Sun10fd677cdc.exe
                                        4⤵
                                        • Loads dropped DLL
                                        PID:1948
                                        • C:\Users\Admin\AppData\Local\Temp\7zS0573C026\Sun10fd677cdc.exe
                                          Sun10fd677cdc.exe
                                          5⤵
                                          • Executes dropped EXE
                                          PID:1400
                                          • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                            C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                            6⤵
                                            • Executes dropped EXE
                                            PID:2608
                                          • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                            C:\Users\Admin\AppData\Local\Temp\11111.exe /stab C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                            6⤵
                                            • Executes dropped EXE
                                            PID:2832
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c Sun10d73b7785b.exe
                                        4⤵
                                        • Loads dropped DLL
                                        PID:1888
                                        • C:\Users\Admin\AppData\Local\Temp\7zS0573C026\Sun10d73b7785b.exe
                                          Sun10d73b7785b.exe
                                          5⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          PID:1060
                                      • C:\Windows\SysWOW64\cmd.exe
                                        C:\Windows\system32\cmd.exe /c Sun10df2d13b8e171d6f.exe
                                        4⤵
                                        • Loads dropped DLL
                                        PID:1564
                                        • C:\Users\Admin\AppData\Local\Temp\7zS0573C026\Sun10df2d13b8e171d6f.exe
                                          Sun10df2d13b8e171d6f.exe
                                          5⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Modifies system certificate store
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:1056
                                          • C:\Windows\SysWOW64\cmd.exe
                                            cmd.exe /c taskkill /f /im chrome.exe
                                            6⤵
                                              PID:1472
                                              • C:\Windows\SysWOW64\taskkill.exe
                                                taskkill /f /im chrome.exe
                                                7⤵
                                                • Kills process with taskkill
                                                PID:560
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c Sun10f51ad6615.exe
                                          4⤵
                                          • Loads dropped DLL
                                          PID:1664
                                          • C:\Users\Admin\AppData\Local\Temp\7zS0573C026\Sun10f51ad6615.exe
                                            Sun10f51ad6615.exe
                                            5⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:1516
                                            • C:\Users\Admin\AppData\Local\Temp\7zS0573C026\Sun10f51ad6615.exe
                                              C:\Users\Admin\AppData\Local\Temp\7zS0573C026\Sun10f51ad6615.exe
                                              6⤵
                                                PID:2464
                                          • C:\Windows\SysWOW64\cmd.exe
                                            C:\Windows\system32\cmd.exe /c Sun10ee0af6c65e215a.exe
                                            4⤵
                                            • Loads dropped DLL
                                            PID:1612
                                            • C:\Users\Admin\AppData\Local\Temp\7zS0573C026\Sun10ee0af6c65e215a.exe
                                              Sun10ee0af6c65e215a.exe
                                              5⤵
                                              • Executes dropped EXE
                                              • Checks computer location settings
                                              • Loads dropped DLL
                                              PID:1788
                                              • C:\Users\Admin\Pictures\Adobe Films\CagEx7FIm_cgo_CibRqL7LEz.exe
                                                "C:\Users\Admin\Pictures\Adobe Films\CagEx7FIm_cgo_CibRqL7LEz.exe"
                                                6⤵
                                                  PID:1524
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c Sun10de08ca9cb.exe
                                              4⤵
                                              • Loads dropped DLL
                                              PID:792
                                              • C:\Users\Admin\AppData\Local\Temp\7zS0573C026\Sun10de08ca9cb.exe
                                                Sun10de08ca9cb.exe
                                                5⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                PID:1596
                                                • C:\Windows\SysWOW64\control.exe
                                                  "C:\Windows\System32\control.exe" .\2c3M8M5c.RJ
                                                  6⤵
                                                    PID:2076
                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                      "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL .\2c3M8M5c.RJ
                                                      7⤵
                                                        PID:2120
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c Sun10fe8cb62035134.exe
                                                  4⤵
                                                  • Loads dropped DLL
                                                  PID:760
                                                  • C:\Users\Admin\AppData\Local\Temp\7zS0573C026\Sun10fe8cb62035134.exe
                                                    Sun10fe8cb62035134.exe
                                                    5⤵
                                                    • Executes dropped EXE
                                                    • Loads dropped DLL
                                                    PID:1780
                                                    • C:\Users\Admin\AppData\Local\Temp\is-R61DO.tmp\Sun10fe8cb62035134.tmp
                                                      "C:\Users\Admin\AppData\Local\Temp\is-R61DO.tmp\Sun10fe8cb62035134.tmp" /SL5="$10174,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zS0573C026\Sun10fe8cb62035134.exe"
                                                      6⤵
                                                      • Executes dropped EXE
                                                      PID:2088
                                                      • C:\Users\Admin\AppData\Local\Temp\7zS0573C026\Sun10fe8cb62035134.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\7zS0573C026\Sun10fe8cb62035134.exe" /SILENT
                                                        7⤵
                                                        • Executes dropped EXE
                                                        PID:2164
                                                        • C:\Users\Admin\AppData\Local\Temp\is-4NS3M.tmp\Sun10fe8cb62035134.tmp
                                                          "C:\Users\Admin\AppData\Local\Temp\is-4NS3M.tmp\Sun10fe8cb62035134.tmp" /SL5="$20174,870426,780800,C:\Users\Admin\AppData\Local\Temp\7zS0573C026\Sun10fe8cb62035134.exe" /SILENT
                                                          8⤵
                                                          • Executes dropped EXE
                                                          • Drops file in Program Files directory
                                                          • Suspicious use of FindShellTrayWindow
                                                          PID:2204
                                                          • C:\Users\Admin\AppData\Local\Temp\is-70RBT.tmp\windllhost.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\is-70RBT.tmp\windllhost.exe" 77
                                                            9⤵
                                                            • Executes dropped EXE
                                                            PID:2104
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c Sun106a84a94b0.exe
                                                  4⤵
                                                  • Loads dropped DLL
                                                  PID:548
                                                  • C:\Users\Admin\AppData\Local\Temp\7zS0573C026\Sun106a84a94b0.exe
                                                    Sun106a84a94b0.exe
                                                    5⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:588
                                                    • C:\Users\Admin\AppData\Local\cef64895-1eb4-4eb9-8daf-d4a31bd51156.exe
                                                      "C:\Users\Admin\AppData\Local\cef64895-1eb4-4eb9-8daf-d4a31bd51156.exe"
                                                      6⤵
                                                        PID:2052
                                                      • C:\Users\Admin\AppData\Local\39715441-0252-44c3-aa7f-528f3a2962a0.exe
                                                        "C:\Users\Admin\AppData\Local\39715441-0252-44c3-aa7f-528f3a2962a0.exe"
                                                        6⤵
                                                          PID:1528
                                                        • C:\Users\Admin\AppData\Local\21040775-88f6-4934-a6a7-953d63719b44.exe
                                                          "C:\Users\Admin\AppData\Local\21040775-88f6-4934-a6a7-953d63719b44.exe"
                                                          6⤵
                                                            PID:2612
                                                          • C:\Users\Admin\AppData\Local\6f187d38-de75-4f82-a4ab-9adb353b77c5.exe
                                                            "C:\Users\Admin\AppData\Local\6f187d38-de75-4f82-a4ab-9adb353b77c5.exe"
                                                            6⤵
                                                              PID:1892
                                                            • C:\Users\Admin\AppData\Local\857df9b1-5080-4381-b1d1-9491997cfefd.exe
                                                              "C:\Users\Admin\AppData\Local\857df9b1-5080-4381-b1d1-9491997cfefd.exe"
                                                              6⤵
                                                                PID:2844
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c Sun1084932dd6b.exe /mixtwo
                                                            4⤵
                                                            • Loads dropped DLL
                                                            PID:1792
                                                            • C:\Users\Admin\AppData\Local\Temp\7zS0573C026\Sun1084932dd6b.exe
                                                              Sun1084932dd6b.exe /mixtwo
                                                              5⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Suspicious use of SetThreadContext
                                                              PID:1520
                                                              • C:\Users\Admin\AppData\Local\Temp\7zS0573C026\Sun1084932dd6b.exe
                                                                Sun1084932dd6b.exe /mixtwo
                                                                6⤵
                                                                • Executes dropped EXE
                                                                PID:652
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  "C:\Windows\System32\cmd.exe" /c taskkill /im "Sun1084932dd6b.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\7zS0573C026\Sun1084932dd6b.exe" & exit
                                                                  7⤵
                                                                    PID:2388
                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                      taskkill /im "Sun1084932dd6b.exe" /f
                                                                      8⤵
                                                                      • Kills process with taskkill
                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                      PID:2436
                                                      • C:\Windows\system32\rundll32.exe
                                                        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                        1⤵
                                                        • Process spawned unexpected child process
                                                        PID:2948
                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                          2⤵
                                                            PID:2960
                                                        • C:\Windows\system32\LogonUI.exe
                                                          "LogonUI.exe" /flags:0x0
                                                          1⤵
                                                            PID:2584
                                                          • C:\Windows\system32\LogonUI.exe
                                                            "LogonUI.exe" /flags:0x1
                                                            1⤵
                                                              PID:280

                                                            Network

                                                                  MITRE ATT&CK Enterprise v6

                                                                  Replay Monitor

                                                                  Loading Replay Monitor...

                                                                  Downloads

                                                                  • memory/280-348-0x00000000026E0000-0x00000000026E1000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/528-90-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                    Filesize

                                                                    152KB

                                                                  • memory/528-95-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                    Filesize

                                                                    100KB

                                                                  • memory/528-89-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                    Filesize

                                                                    1.5MB

                                                                  • memory/528-91-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                    Filesize

                                                                    100KB

                                                                  • memory/528-94-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                    Filesize

                                                                    100KB

                                                                  • memory/528-85-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                    Filesize

                                                                    572KB

                                                                  • memory/528-98-0x0000000064940000-0x0000000064959000-memory.dmp

                                                                    Filesize

                                                                    100KB

                                                                  • memory/528-100-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                    Filesize

                                                                    572KB

                                                                  • memory/528-88-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                    Filesize

                                                                    1.5MB

                                                                  • memory/528-101-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                    Filesize

                                                                    1.5MB

                                                                  • memory/528-87-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                    Filesize

                                                                    1.5MB

                                                                  • memory/528-103-0x000000006B280000-0x000000006B2A6000-memory.dmp

                                                                    Filesize

                                                                    152KB

                                                                  • memory/528-86-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                                                                    Filesize

                                                                    1.5MB

                                                                  • memory/528-83-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                    Filesize

                                                                    572KB

                                                                  • memory/528-84-0x000000006B440000-0x000000006B4CF000-memory.dmp

                                                                    Filesize

                                                                    572KB

                                                                  • memory/588-194-0x0000000001370000-0x0000000001371000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/588-256-0x000000001B0D0000-0x000000001B0D2000-memory.dmp

                                                                    Filesize

                                                                    8KB

                                                                  • memory/652-206-0x0000000000400000-0x0000000000450000-memory.dmp

                                                                    Filesize

                                                                    320KB

                                                                  • memory/652-208-0x0000000000400000-0x0000000000450000-memory.dmp

                                                                    Filesize

                                                                    320KB

                                                                  • memory/652-215-0x0000000000400000-0x0000000000450000-memory.dmp

                                                                    Filesize

                                                                    320KB

                                                                  • memory/652-219-0x0000000000400000-0x0000000000450000-memory.dmp

                                                                    Filesize

                                                                    320KB

                                                                  • memory/864-274-0x0000000000A10000-0x0000000000A5D000-memory.dmp

                                                                    Filesize

                                                                    308KB

                                                                  • memory/864-271-0x0000000001D40000-0x0000000001DB2000-memory.dmp

                                                                    Filesize

                                                                    456KB

                                                                  • memory/956-54-0x0000000075D11000-0x0000000075D13000-memory.dmp

                                                                    Filesize

                                                                    8KB

                                                                  • memory/1060-222-0x0000000001EE0000-0x0000000001FB9000-memory.dmp

                                                                    Filesize

                                                                    868KB

                                                                  • memory/1060-220-0x0000000000700000-0x000000000077D000-memory.dmp

                                                                    Filesize

                                                                    500KB

                                                                  • memory/1060-224-0x0000000000400000-0x0000000000535000-memory.dmp

                                                                    Filesize

                                                                    1.2MB

                                                                  • memory/1200-241-0x0000000001EE0000-0x0000000002B2A000-memory.dmp

                                                                    Filesize

                                                                    12.3MB

                                                                  • memory/1200-284-0x0000000001EE0000-0x0000000002B2A000-memory.dmp

                                                                    Filesize

                                                                    12.3MB

                                                                  • memory/1300-242-0x0000000002AE0000-0x0000000002AF6000-memory.dmp

                                                                    Filesize

                                                                    88KB

                                                                  • memory/1516-259-0x00000000009E0000-0x00000000009E1000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/1516-262-0x0000000000400000-0x000000000048C000-memory.dmp

                                                                    Filesize

                                                                    560KB

                                                                  • memory/1516-212-0x00000000013C0000-0x00000000013C1000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/1536-278-0x00000000004D0000-0x0000000000542000-memory.dmp

                                                                    Filesize

                                                                    456KB

                                                                  • memory/1752-221-0x00000000006C0000-0x00000000006D0000-memory.dmp

                                                                    Filesize

                                                                    64KB

                                                                  • memory/1752-223-0x0000000000230000-0x00000000002F8000-memory.dmp

                                                                    Filesize

                                                                    800KB

                                                                  • memory/1752-225-0x0000000000400000-0x00000000004C8000-memory.dmp

                                                                    Filesize

                                                                    800KB

                                                                  • memory/1780-218-0x0000000000400000-0x00000000004CC000-memory.dmp

                                                                    Filesize

                                                                    816KB

                                                                  • memory/1788-270-0x0000000003C60000-0x0000000003DAE000-memory.dmp

                                                                    Filesize

                                                                    1.3MB

                                                                  • memory/1892-318-0x00000000005D0000-0x0000000000615000-memory.dmp

                                                                    Filesize

                                                                    276KB

                                                                  • memory/1896-196-0x0000000000330000-0x0000000000331000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/1896-251-0x000000001B230000-0x000000001B232000-memory.dmp

                                                                    Filesize

                                                                    8KB

                                                                  • memory/2008-258-0x0000000000A70000-0x0000000000A71000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/2008-213-0x00000000008D0000-0x00000000008D1000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/2008-261-0x0000000000380000-0x0000000000381000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/2052-298-0x0000000004A00000-0x0000000004A01000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/2088-235-0x00000000003E0000-0x00000000003E1000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/2164-236-0x0000000000400000-0x00000000004CC000-memory.dmp

                                                                    Filesize

                                                                    816KB

                                                                  • memory/2204-240-0x0000000000260000-0x0000000000261000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/2576-260-0x0000000000250000-0x0000000000251000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/2576-263-0x000000002D890000-0x000000002D94A000-memory.dmp

                                                                    Filesize

                                                                    744KB

                                                                  • memory/2576-264-0x000000002DA10000-0x000000002DAC9000-memory.dmp

                                                                    Filesize

                                                                    740KB

                                                                  • memory/2584-307-0x00000000027C0000-0x00000000027C1000-memory.dmp

                                                                    Filesize

                                                                    4KB

                                                                  • memory/2612-306-0x00000000002F0000-0x0000000000335000-memory.dmp

                                                                    Filesize

                                                                    276KB

                                                                  • memory/2960-272-0x0000000002030000-0x0000000002131000-memory.dmp

                                                                    Filesize

                                                                    1.0MB

                                                                  • memory/2960-273-0x0000000000270000-0x00000000002CD000-memory.dmp

                                                                    Filesize

                                                                    372KB