Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-05-2023 09:26

General

  • Target

    Purchase order 3500354689.exe

  • Size

    1.4MB

  • MD5

    54449cb838ba6a7de0d11f73de31c1af

  • SHA1

    4fa134aaab1517fc86d77de166e8cb5dc65943df

  • SHA256

    2062e48bd178d835beb3c39a878ea0da87aae5a4a34e3322a12bc3e9e96bf52d

  • SHA512

    d9177818bf33a55fda1a4dadd98db20c8f72bea1ee3d43d707ef3ddaaed7af944cc97dfb14d649f916573f201730d6bd39d51506ae314cb38882f59d7be19bc4

  • SSDEEP

    24576:KRmht8BU5wGMUq6HxSzB793rWyxLV08a5XwE7uWhDVzeWhWGAUlCwUY/l:3l5MUqF99TxLG8aJ3lZLeUlv/l

Malware Config

Extracted

Family

blustealer

C2

https://api.telegram.org/bot5797428905:AAGaRRXGZN1d9GGFd3sE5x4uSpCGF0PU4m4/sendMessage?chat_id=1251788325

Signatures

  • BluStealer

    A Modular information stealer written in Visual Basic.

  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Drops file in System32 directory 24 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Purchase order 3500354689.exe
    "C:\Users\Admin\AppData\Local\Temp\Purchase order 3500354689.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:524
    • C:\Users\Admin\AppData\Local\Temp\Purchase order 3500354689.exe
      "C:\Users\Admin\AppData\Local\Temp\Purchase order 3500354689.exe"
      2⤵
      • Drops file in System32 directory
      • Suspicious use of SetThreadContext
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4560
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        3⤵
        • Accesses Microsoft Outlook profiles
        • outlook_office_path
        • outlook_win_path
        PID:4660
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    PID:3392
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    PID:1500
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:1468
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:1552
    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:3544
    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:4140
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:64
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:4784
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:3044
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:1160
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      PID:2268
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:1524
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:4608
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:3204
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:4348
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:2612
      • C:\Windows\System32\OpenSSH\ssh-agent.exe
        C:\Windows\System32\OpenSSH\ssh-agent.exe
        1⤵
        • Executes dropped EXE
        PID:636
      • C:\Windows\system32\TieringEngineService.exe
        C:\Windows\system32\TieringEngineService.exe
        1⤵
        • Executes dropped EXE
        • Checks processor information in registry
        • Suspicious use of AdjustPrivilegeToken
        PID:4144
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1944
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:404
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3664
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4496
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:2176
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5076
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:3556
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 900
          2⤵
          • Modifies data under HKEY_USERS
          PID:2676

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

        Filesize

        2.1MB

        MD5

        39bbc6730d44e6e1213098e988ea425f

        SHA1

        fe74dad1ddae19af7ce2e0841cb6bef95026edd1

        SHA256

        017b8c85b32c6e3926f44a77e76629f6a93641af33dd12605f4657da2ad0065d

        SHA512

        8b9dfd30a4f277861a87b47304bd9ac65b9f01e4a4169ed9cb383d94d9bfd57c1143c577f519e8fa70d2b9795c7142923e571a101a4208883110a73bd5b4af3d

      • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

        Filesize

        1.4MB

        MD5

        4ea2b7477aef825306281b9acecc4ab3

        SHA1

        b33bf59d62738be52bbae81f18ffd33ffde83c0b

        SHA256

        5657482180bf3a26e832b460d42539427951980eec8f3cd91cfb7d4252cd2bfc

        SHA512

        286d1eef974b139dc78d09aa4e5cc67e2a4c69e8c674e02cb28627d05314400e52cdd3c8a4928686c371c664cee1336f11875e67b3dd46fb692586f444fc7832

      • C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE

        Filesize

        1.5MB

        MD5

        85086676ba4d239201101f4e89453477

        SHA1

        c1c51be3710ddff97f1e67831305007079abad8f

        SHA256

        bafc0d0a36da5b87941bd1fbc2619f4f9c7da22e53910a1f60fa2a2f3cf8f254

        SHA512

        75e95c89b3e9cbdbfdeccdd637e195cd7667538d650cd9683c37f3df234fac2d0c874376a5e299b77c35f0fa45e0da6b1bc4b3325fa80752e85e07e6b51f4ff2

      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

        Filesize

        2.1MB

        MD5

        38c9feef6368c8c27767b5ac9ce49569

        SHA1

        5e51c2b08c48ad76fafc4701e639fe31d96bf277

        SHA256

        75d3da31657e81320e7d3dbc38fc14336c483fdf41266135460b76093e2c2487

        SHA512

        3015b21d29b167d4162ee9bca29eb913ebd7c01dddb14770d7a19171fd9f7b5cd2ac89dda24b7f934d3b94f6dadd2ad4702f83b804f2fbc5e363e21aa4674686

      • C:\Windows\SysWOW64\perfhost.exe

        Filesize

        1.2MB

        MD5

        c47e5aa75e7a93cd7d82d218dbbc6672

        SHA1

        cb349558efb210d84e96d6f6247fb488de4a6642

        SHA256

        531a170655f2e553b20894ccf60eda7db96218acbafdac9e2943bc4ea0d01361

        SHA512

        7ce08984126ef6588195d1dfda29b16425f0702957b1ffd323e6dd4648ba20f4f31ac5e5ace3ff2363cb0efe15dc9ef201ba9462138e7576407c8408ed249f86

      • C:\Windows\System32\AgentService.exe

        Filesize

        1.7MB

        MD5

        d713471547984683f4240c8c7e2b6b89

        SHA1

        1c5636fde785cbbaebe7787df75714ef6353671f

        SHA256

        37427ad05afe05e937c6a8d10653fe868e9557c823dfb13188a31a9a7e811cbe

        SHA512

        a0d2a13bea2869aad30f547fa0f29844d6a3948680828f2197a0aa97f73b9552238efa3e5079cfe4265b7a04ba1597544a6e090af8a91d38b8c75911156d6cf2

      • C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

        Filesize

        1.3MB

        MD5

        cebf13bdbbaf35b1687da9797a995ae5

        SHA1

        7c9f23dc50064074d46471d0e7e2ef050df30e25

        SHA256

        7dde19d5c7ea2da5d1bd8fc395d066a2157edc547ec5cced6d96b5caba1cf286

        SHA512

        b88cc668267dbff4e10abe23b550b32d7d19ff566f00706934afcb73ba7c1218aba28036775f64c93e3f02f5d2093939f056533af9d8dc2c01b086f759d6c102

      • C:\Windows\System32\FXSSVC.exe

        Filesize

        1.2MB

        MD5

        2ac2bde0fdef44e34dd3cffa402a17d2

        SHA1

        3d246b3fb64682751f71123f765705f92f19cffd

        SHA256

        520981c003228a5344661ec39a1c0a19946ea1b36f8fdf6606f1ed8afb22b603

        SHA512

        2afeffa671b96804eee87488deb114e4c525714cae4ad77de87912a68b596a888f11a40742239a1667220ce311bd8b2234bbe2298028fcd5005e1602753cbb42

      • C:\Windows\System32\Locator.exe

        Filesize

        1.2MB

        MD5

        e595f7b14026ce950c492dabdb392ec6

        SHA1

        3e40be11969debe6f0073b9d070fc68c74f51f54

        SHA256

        d7821e84b5f6a25954a9200aa606c73c97c5e0b379e84b5542f916616a63dceb

        SHA512

        bbacffc0249fc693b3a771152b020a97a5892f24304cf2bfae567c104f97c2b6a24337caad3029a66af1d432c3a58017dcf2fe33be92a7119d9e7181e505e240

      • C:\Windows\System32\OpenSSH\ssh-agent.exe

        Filesize

        1.6MB

        MD5

        9229856e5b9b255c9ea499193d89d9a1

        SHA1

        758f1360fc402017f15120a40eca76d419c43f4d

        SHA256

        bd0de438426170fc01fcafa400f30d15fae2bab2727ae136524032058b9c050e

        SHA512

        24f2e28824eaf931749d9df9e1ff3e4500d2a0c4959e144ccb2a73e3949d3b672fccb2a9dd03e909336b7effdaf437de9e37691bf78d93ea1563d35e2b66bbc3

      • C:\Windows\System32\OpenSSH\ssh-agent.exe

        Filesize

        1.6MB

        MD5

        9229856e5b9b255c9ea499193d89d9a1

        SHA1

        758f1360fc402017f15120a40eca76d419c43f4d

        SHA256

        bd0de438426170fc01fcafa400f30d15fae2bab2727ae136524032058b9c050e

        SHA512

        24f2e28824eaf931749d9df9e1ff3e4500d2a0c4959e144ccb2a73e3949d3b672fccb2a9dd03e909336b7effdaf437de9e37691bf78d93ea1563d35e2b66bbc3

      • C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe

        Filesize

        1.3MB

        MD5

        f1b1fb0d29ba5d1ab4a792429df7458d

        SHA1

        47f1b50cbe9193f75dfe483d28efa968c60704d5

        SHA256

        123644c7d11c2e7dd578c6f0127b9d83cc9c60e82d3b93624248d80c6320e0ac

        SHA512

        ca78ce150bbc5aabf5ea8591c1c91768867fee20f36b525ad7cedf77312298e71467235d54330cc10794675df9a8942a3969f1bcdc2157db6032215e7e9477e3

      • C:\Windows\System32\SearchIndexer.exe

        Filesize

        1.4MB

        MD5

        e9bd56370beeb3fc99fe9e6c8504dcac

        SHA1

        153199e2ba404a3c13994e138f39d32c1bcd2554

        SHA256

        c3a7e659725a107fd88d629fc44ca23188d21108165401952e2a74a934b15da3

        SHA512

        3e82d734b9c932f3ee86af13b7bd70c5a4f932d5b2662cd5e7530afb5d125e1922b8b756866a1bd86b4f4c6516c3b94951f2113489ecc91c65074fa18b2bc265

      • C:\Windows\System32\SensorDataService.exe

        Filesize

        1.8MB

        MD5

        3571ebe6bba2fd2d3a1ce7e93a2f46a4

        SHA1

        524f9dc5e916477d5fed5261965bb65460d73854

        SHA256

        ef38606e5b89dfa9dd3406ddcf1ccff53762c36505fc2f2b2b8e009532f1cf32

        SHA512

        eb98c3a83195b5dd0e144822b0c22e2daac1ccd4cdc9f779d9546949092268798044680dd5a9f2dc0f8abb11058f288849d519a0c8587e65d5537e7b41ba3080

      • C:\Windows\System32\Spectrum.exe

        Filesize

        1.4MB

        MD5

        a7d08f86c44490155c39374009d2a136

        SHA1

        8c965d7373d7760254ea4db32cfb42287e250077

        SHA256

        b9878b29208808252df29265bc75e1fb9ab27c554285374663327db3f101f382

        SHA512

        9fb2b694a10faeb4a51172814e4fe910c66c96c695056a0cd88e504c98d15a3bfe3a4eb25b0fc65e56ead92e27db6287b32e156007e174890a541c8165e13d13

      • C:\Windows\System32\TieringEngineService.exe

        Filesize

        1.5MB

        MD5

        b64fe0b72f4105d9f0ccb8de11c18231

        SHA1

        5fef5f01a266c84709401588e75772eb73322712

        SHA256

        2e6dc516990f06d0fd6a36420a369eaf4d18e4aa733db96e71cfc92a969f4cdc

        SHA512

        0b40551448babad67549d5187d2990306ec3a6cb2d606c82d3735814ca28ce6f6972ab9104e8cfdbc51833dd65ee62973164fb471c33e7124bf1d0c0fc13dfe0

      • C:\Windows\System32\VSSVC.exe

        Filesize

        2.0MB

        MD5

        ec0ebea267bca343d0a263f278b756e6

        SHA1

        132ea0c832e62a7712d497dbd93564dcf26a7e18

        SHA256

        fcbe76886257f338711ca3d91f3369952e6e14899ab87bbb266186d92137514a

        SHA512

        1064f1c7380401057163f0436786d7fe35db352b7ee5004784b0040da926dac5636837dce682813c991e3ca9cf62c90addae5c588d8481c0dcb231cd502877d9

      • C:\Windows\System32\alg.exe

        Filesize

        1.3MB

        MD5

        b9aeef6de903c3b8d0a0aa10c65d253c

        SHA1

        f3c63a62a184c41fe10c6695a14f13903fd5cf2b

        SHA256

        65b0fd0b370f978c5fd34f94459f8b6dbb55fe5590bc09427874201c46515a51

        SHA512

        6949a4589db1465d9e54d2f872abb23107c4f0d4abb89164d46f296d1c20546500797d91cda9413868a1cbde55b1a39ece91840d6fef17f59ff0f20e1d3f9b24

      • C:\Windows\System32\msdtc.exe

        Filesize

        1.4MB

        MD5

        042333190230275ec01d9ee33fad26cb

        SHA1

        e50be334ed99dc20feedead376eef35ef82ab125

        SHA256

        48fc2246fec2257f198284279b6b0dc3995aad2bb1fd740dcb1ebdd347b8f8bc

        SHA512

        ee7b2d6378da12304ea9495d6ad7b3f18b3a9abf7599a364a95ff877b9661ece99ccc3b24ee235b0c80bee948b8df882664b0d14dc7149cafcbe23de42f8ea28

      • C:\Windows\System32\snmptrap.exe

        Filesize

        1.2MB

        MD5

        ee10dd69a8a83027421d3140d3d9f5de

        SHA1

        f07773d74191741dad7fa77c71af2b3ef9de2bc8

        SHA256

        e03736e37c9ffedf8c7dc0a3909043f09bcb297526df2bc9de1fccf037fec3f3

        SHA512

        a8f0940b548ad14c2b5cc834bcc5ba807d29fe59d91f18512a4095f631e31cf401b29e4fdbebced7c44b7f20169ab4102fbaf682d0d72f3f48dc475d74a69478

      • C:\Windows\System32\vds.exe

        Filesize

        1.3MB

        MD5

        4cf97719a29d7ada4f5700379beaf43f

        SHA1

        5fd79b6fd6844806a7af1120b35f6825e1201a44

        SHA256

        b404dbd7c7db999ce2efee1ed96b2d3b5fab16d4702e34e055c3ffd61d8ad6b1

        SHA512

        5fc7a8c994bb2fdad0b8d99e3dd5c0011fe15b1c408e268aacdcea8715f6a10b579004fe3fabbabf610e93a55577cb7254fc10acb0b511788dea37c18fc58e3f

      • C:\Windows\System32\wbem\WmiApSrv.exe

        Filesize

        1.4MB

        MD5

        bfe1f572aaf35082b57c3eb82cc26a79

        SHA1

        966a27ec80ce53c9d2cf1ec0085708f585e4061b

        SHA256

        9c647d4511c61c2c3b90b257c340cf193db5f9af4cfe48ab9ab5bc73e5f30488

        SHA512

        f5f5e79f116ae71772b3f10edb8e2c98970e9ab13a854ed3aaf66ab5cde8e76ab61d2e4da655a1a6166f29a6b9645ed65ceee10c209126a54d9c2fc50587ba10

      • C:\Windows\System32\wbengine.exe

        Filesize

        2.1MB

        MD5

        2a910188e717e6c7177d9e6e701344cd

        SHA1

        0e7f26f1653199fa4c81b3dd1b9299106e52e6d7

        SHA256

        701371b2f0e90e2e523b05a0e5a602e4c64aa7f56e2003ba2b1d73dd46fe1e00

        SHA512

        4397cd749a10cd179a38649ec74a2f8147529bb794907cf9e9c1e0993b9025f528614756a74d028ffdb3a9c66150d28e82cedb25840b990df2f4db4188f06662

      • memory/64-218-0x0000000000CD0000-0x0000000000D30000-memory.dmp

        Filesize

        384KB

      • memory/64-229-0x0000000000CD0000-0x0000000000D30000-memory.dmp

        Filesize

        384KB

      • memory/64-232-0x0000000140000000-0x0000000140221000-memory.dmp

        Filesize

        2.1MB

      • memory/64-226-0x0000000000CD0000-0x0000000000D30000-memory.dmp

        Filesize

        384KB

      • memory/64-221-0x0000000140000000-0x0000000140221000-memory.dmp

        Filesize

        2.1MB

      • memory/404-386-0x0000000140000000-0x0000000140147000-memory.dmp

        Filesize

        1.3MB

      • memory/524-137-0x0000000005AB0000-0x0000000005AC0000-memory.dmp

        Filesize

        64KB

      • memory/524-133-0x0000000000DA0000-0x0000000000F10000-memory.dmp

        Filesize

        1.4MB

      • memory/524-134-0x0000000005E20000-0x00000000063C4000-memory.dmp

        Filesize

        5.6MB

      • memory/524-135-0x0000000005910000-0x00000000059A2000-memory.dmp

        Filesize

        584KB

      • memory/524-136-0x00000000058D0000-0x00000000058DA000-memory.dmp

        Filesize

        40KB

      • memory/524-139-0x0000000009030000-0x00000000090CC000-memory.dmp

        Filesize

        624KB

      • memory/524-138-0x0000000005AB0000-0x0000000005AC0000-memory.dmp

        Filesize

        64KB

      • memory/636-348-0x0000000140000000-0x0000000140259000-memory.dmp

        Filesize

        2.3MB

      • memory/1160-289-0x0000000140000000-0x0000000140202000-memory.dmp

        Filesize

        2.0MB

      • memory/1500-179-0x0000000140000000-0x0000000140200000-memory.dmp

        Filesize

        2.0MB

      • memory/1500-169-0x0000000000710000-0x0000000000770000-memory.dmp

        Filesize

        384KB

      • memory/1500-175-0x0000000000710000-0x0000000000770000-memory.dmp

        Filesize

        384KB

      • memory/1524-294-0x0000000140000000-0x00000001401EC000-memory.dmp

        Filesize

        1.9MB

      • memory/1552-195-0x0000000000980000-0x00000000009E0000-memory.dmp

        Filesize

        384KB

      • memory/1552-199-0x0000000140000000-0x0000000140135000-memory.dmp

        Filesize

        1.2MB

      • memory/1552-181-0x0000000000980000-0x00000000009E0000-memory.dmp

        Filesize

        384KB

      • memory/1552-187-0x0000000000980000-0x00000000009E0000-memory.dmp

        Filesize

        384KB

      • memory/1944-373-0x0000000140000000-0x00000001401C0000-memory.dmp

        Filesize

        1.8MB

      • memory/1944-367-0x0000000140000000-0x00000001401C0000-memory.dmp

        Filesize

        1.8MB

      • memory/2176-640-0x0000000140000000-0x000000014021D000-memory.dmp

        Filesize

        2.1MB

      • memory/2176-410-0x0000000140000000-0x000000014021D000-memory.dmp

        Filesize

        2.1MB

      • memory/2268-292-0x0000000000400000-0x00000000005EE000-memory.dmp

        Filesize

        1.9MB

      • memory/2676-788-0x00000247EA930000-0x00000247EA93E000-memory.dmp

        Filesize

        56KB

      • memory/2676-617-0x00000247EA400000-0x00000247EA401000-memory.dmp

        Filesize

        4KB

      • memory/2676-705-0x00000247EA420000-0x00000247EA469000-memory.dmp

        Filesize

        292KB

      • memory/2676-616-0x00000247E98D0000-0x00000247E98E0000-memory.dmp

        Filesize

        64KB

      • memory/2676-770-0x00000247EA930000-0x00000247EA93E000-memory.dmp

        Filesize

        56KB

      • memory/2676-790-0x00000247EA930000-0x00000247EA93E000-memory.dmp

        Filesize

        56KB

      • memory/2676-786-0x00000247EA930000-0x00000247EA93E000-memory.dmp

        Filesize

        56KB

      • memory/2676-789-0x00000247EA930000-0x00000247EA93E000-memory.dmp

        Filesize

        56KB

      • memory/2676-787-0x00000247EA930000-0x00000247EA93E000-memory.dmp

        Filesize

        56KB

      • memory/2676-664-0x00000247EA400000-0x00000247EA401000-memory.dmp

        Filesize

        4KB

      • memory/2676-792-0x00000247EA930000-0x00000247EA93E000-memory.dmp

        Filesize

        56KB

      • memory/2676-791-0x00000247EA930000-0x00000247EA93E000-memory.dmp

        Filesize

        56KB

      • memory/2676-639-0x00000247EA420000-0x00000247EA430000-memory.dmp

        Filesize

        64KB

      • memory/2676-771-0x00000247EA930000-0x00000247EA93E000-memory.dmp

        Filesize

        56KB

      • memory/2676-784-0x00000247EA930000-0x00000247EA93E000-memory.dmp

        Filesize

        56KB

      • memory/2676-785-0x00000247EA930000-0x00000247EA93E000-memory.dmp

        Filesize

        56KB

      • memory/2676-793-0x00000247EA930000-0x00000247EA93E000-memory.dmp

        Filesize

        56KB

      • memory/3044-257-0x0000000140000000-0x0000000140226000-memory.dmp

        Filesize

        2.1MB

      • memory/3204-326-0x0000000140000000-0x00000001401ED000-memory.dmp

        Filesize

        1.9MB

      • memory/3392-178-0x0000000140000000-0x0000000140201000-memory.dmp

        Filesize

        2.0MB

      • memory/3392-157-0x00000000006F0000-0x0000000000750000-memory.dmp

        Filesize

        384KB

      • memory/3392-163-0x00000000006F0000-0x0000000000750000-memory.dmp

        Filesize

        384KB

      • memory/3544-203-0x00000000004D0000-0x0000000000530000-memory.dmp

        Filesize

        384KB

      • memory/3544-347-0x0000000140000000-0x0000000140237000-memory.dmp

        Filesize

        2.2MB

      • memory/3544-192-0x00000000004D0000-0x0000000000530000-memory.dmp

        Filesize

        384KB

      • memory/3544-201-0x0000000140000000-0x0000000140237000-memory.dmp

        Filesize

        2.2MB

      • memory/3664-389-0x0000000140000000-0x00000001401FC000-memory.dmp

        Filesize

        2.0MB

      • memory/3664-638-0x0000000140000000-0x00000001401FC000-memory.dmp

        Filesize

        2.0MB

      • memory/4140-208-0x0000000000190000-0x00000000001F0000-memory.dmp

        Filesize

        384KB

      • memory/4140-214-0x0000000000190000-0x00000000001F0000-memory.dmp

        Filesize

        384KB

      • memory/4140-219-0x0000000140000000-0x000000014022B000-memory.dmp

        Filesize

        2.2MB

      • memory/4140-365-0x0000000140000000-0x000000014022B000-memory.dmp

        Filesize

        2.2MB

      • memory/4144-363-0x0000000140000000-0x0000000140239000-memory.dmp

        Filesize

        2.2MB

      • memory/4348-330-0x0000000140000000-0x0000000140169000-memory.dmp

        Filesize

        1.4MB

      • memory/4348-582-0x0000000140000000-0x0000000140169000-memory.dmp

        Filesize

        1.4MB

      • memory/4496-408-0x0000000140000000-0x0000000140216000-memory.dmp

        Filesize

        2.1MB

      • memory/4560-149-0x0000000003220000-0x0000000003286000-memory.dmp

        Filesize

        408KB

      • memory/4560-155-0x0000000000400000-0x0000000000654000-memory.dmp

        Filesize

        2.3MB

      • memory/4560-140-0x0000000000400000-0x0000000000654000-memory.dmp

        Filesize

        2.3MB

      • memory/4560-258-0x0000000000400000-0x0000000000654000-memory.dmp

        Filesize

        2.3MB

      • memory/4560-143-0x0000000000400000-0x0000000000654000-memory.dmp

        Filesize

        2.3MB

      • memory/4560-144-0x0000000003220000-0x0000000003286000-memory.dmp

        Filesize

        408KB

      • memory/4608-322-0x0000000140000000-0x00000001401D7000-memory.dmp

        Filesize

        1.8MB

      • memory/4608-553-0x0000000140000000-0x00000001401D7000-memory.dmp

        Filesize

        1.8MB

      • memory/4660-190-0x0000000001000000-0x0000000001066000-memory.dmp

        Filesize

        408KB

      • memory/4660-202-0x0000000005580000-0x0000000005590000-memory.dmp

        Filesize

        64KB

      • memory/4784-243-0x0000000140000000-0x0000000140210000-memory.dmp

        Filesize

        2.1MB

      • memory/4784-234-0x00000000006D0000-0x0000000000730000-memory.dmp

        Filesize

        384KB

      • memory/5076-652-0x0000000140000000-0x0000000140179000-memory.dmp

        Filesize

        1.5MB

      • memory/5076-459-0x0000000140000000-0x0000000140179000-memory.dmp

        Filesize

        1.5MB