ceb68d9f6e90f21f96fc3292651a2977c04b56ef5aaf974499c245505b4e7232

Analysis

max time kernel
77s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 03:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ceb68d9f6e90f21f96fc3292651a2977c04b56ef5aaf974499c245505b4e7232.exe
Size

1.5MB
MD5

87e061c66c3fd8a4b07c75901f3291e6
SHA1

659563198849645bbc83348df323251a07ce9547
SHA256

ceb68d9f6e90f21f96fc3292651a2977c04b56ef5aaf974499c245505b4e7232
SHA512

2277a71651e0745cdb7499bc3204458beff3a52aebb13dd266d60b566565ec945abe2d6c3b32c3be3061e52bbad6592e8f4fc9346892bbf8b5ced0487edbc221
SSDEEP

24576:f/CKAB78NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:faKk7gDUYmvFur31yAipQCtXxc0H

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
4068	alg.exe
4616	elevation_service.exe
4268	elevation_service.exe
1256	maintenanceservice.exe
4856	OSE.EXE
4060	DiagnosticsHub.StandardCollector.Service.exe
3828	fxssvc.exe
4132	msdtc.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	ceb68d9f6e90f21f96fc3292651a2977c04b56ef5aaf974499c245505b4e7232.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\9deafdf566ec4f27.bin	alg.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	alg.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{E0DAD904-81A0-419C-8915-76E4FE473E06}\chrome_installer.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	alg.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	alg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	alg.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	alg.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	alg.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	alg.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe	alg.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	alg.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	alg.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4876	ceb68d9f6e90f21f96fc3292651a2977c04b56ef5aaf974499c245505b4e7232.exe
Token: SeDebugPrivilege	4068	alg.exe
Token: SeDebugPrivilege	4068	alg.exe
Token: SeDebugPrivilege	4068	alg.exe
Token: SeTakeOwnershipPrivilege	4616	elevation_service.exe
Token: SeAuditPrivilege	3828	fxssvc.exe

C:\Users\Admin\AppData\Local\Temp\ceb68d9f6e90f21f96fc3292651a2977c04b56ef5aaf974499c245505b4e7232.exe
"C:\Users\Admin\AppData\Local\Temp\ceb68d9f6e90f21f96fc3292651a2977c04b56ef5aaf974499c245505b4e7232.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4876

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:4068

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4268

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:4856

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1256

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4616

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:4060

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:2908

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
PID:836

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
PID:2000

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
PID:1196

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
PID:3300

C:\Windows\system32\SearchProtocolHost.exe
"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
1⤵
PID:5876

C:\Windows\system32\SearchFilterHost.exe
"C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 900
1⤵
PID:5900

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
PID:5412

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:5300

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:5196

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2244

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:2864

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:4712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:4300

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
PID:4748

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
PID:5040

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
PID:3232

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
PID:4336

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
PID:4132

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
1.6MB

MD5
6efff302464ebf46654ca41d04e55d45

SHA1
a371506cf4d2b0448da6d1fb8835276ce6b19abf

SHA256
dd832d281c71501fa4a3f632e3ff2512efa11839419de6686381ab84750a1a65

SHA512
5a2b8da55b126ecd2e5a831c516ea1543d024487e49a142b1b97ecead717b738ee7ecda052be1a077b90304a7cad7a2e54b2ef3d7794e06446089db73ae30a09

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
92KB

MD5
a258b6fd7b21a0ed3a7cbe0cb8df2010

SHA1
bb452ce70bff198530b24f2b205cb88a8ebb5551

SHA256
8ac18fa327c77b8753368825fd3cbea0940eab01bf39ff1d2a7bb01467b3d898

SHA512
e7ff19a8554456ca4df7f2232b0c7881909b813ab90851fd7af4622cf9c8e3ca00b687bab51748701ff9b59c29abdcd47b200e30e3140880cce69c36951cfee9

Download Submit
C:\Windows\SysWOW64\perfhost.exe

Filesize
382KB

MD5
fc94a5eea3b8640564388e6e4cd75e2e

SHA1
8cdf46ea60404625a5db4774e8cf8aa988f693a3

SHA256
6d89a001f6a398df05f76b712e9d17740a50e7ae23afe5303bbb45ecfb445599

SHA512
2eac14826d3db7e6a2e629a6f080ceb4040fb8778c1664a27af37203d8e938de0a6ef80f56bab39d13b731397925e613910a0c4822fee6cd8a7cc45e615ee22b

Download Submit
C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

Filesize
832KB

MD5
3269a500d20eb3ed7624b4fb85b1ee23

SHA1
8b1e608838fe21d2255566027d7bf80c53facc7c

SHA256
e8968660bb025ff1a92e41d957c7a63b1077cd8279a020781cf9552c53213eca

SHA512
808e17219e77b79ea69d63404556224a18d0c858858667115b5bd8dae0ee5ccd1b2e2ecf870766099b34f68b555dba72e23f982d180ad598965601e18d9d1c2c

Download Submit
C:\Windows\System32\FXSSVC.exe

Filesize
1.2MB

MD5
a2c3dfe3167cdf32ac6fef5b31cde441

SHA1
9badb525fc2c5b7180a79c9e930fc2d11dabc4d0

SHA256
76d33d82f99d12c3f85702482954b98df74a4055252a003d25dc94a75321428b

SHA512
1fbe731ee1c95b1ef2c28cfc00bc8dea8ea3e4115221225d28ed95e8811e1acbc5b051a8f7746ebd114ec2c65ffb338b924eaabd9f45762f3fcaa6062e147ee0

Download Submit
C:\Windows\System32\alg.exe

Filesize
673KB

MD5
5ef12a1e01df822e8330073ee625353d

SHA1
03af16efbc3b3a689d3bda0e8eb202bcd3c74b93

SHA256
b50ab3a1fed8922de3f15fbfe3e4c1bb00c63aaad70803f0bdf657f4a6698142

SHA512
99d9c207579aa75db3fd1dffa4460131526c0ccc546b6a809f7dee05e3bddd565393cd637f5489ae540df683d867bdb7e1a491aec05208df6731d42b0e50d4f5

Download Submit
C:\Windows\System32\msdtc.exe

Filesize
1.5MB

MD5
928249d4796ac1a083d57e01bab429cf

SHA1
5dd94e888714513fe134d72cd03bad0da796666d

SHA256
e0aa934e7ce8786b9e054a5a92a48464fe9c3c284469bc251601a1f8e80c7598

SHA512
40e7918ce778bcbad0693e25cdebda519b2cc8f0010da8068eefc50a58007c7444a0db4aef956651518abcb0e059ad9d56e0ca8503aa9b611863b2aecf60f908

Download Submit
memory/836-351-0x0000000140000000-0x0000000140242000-memory.dmp

Filesize
2.3MB

Download
memory/836-290-0x0000000140000000-0x0000000140242000-memory.dmp

Filesize
2.3MB

Download
memory/836-298-0x0000000000680000-0x00000000006E0000-memory.dmp

Filesize
384KB

Download
memory/1196-360-0x0000000000720000-0x0000000000780000-memory.dmp

Filesize
384KB

Download
memory/1196-421-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/1196-353-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/1256-57-0x0000000001DE0000-0x0000000001E40000-memory.dmp

Filesize
384KB

Download
memory/1256-65-0x0000000140000000-0x0000000140261000-memory.dmp

Filesize
2.4MB

Download
memory/1256-61-0x0000000001DE0000-0x0000000001E40000-memory.dmp

Filesize
384KB

Download
memory/1256-51-0x0000000140000000-0x0000000140261000-memory.dmp

Filesize
2.4MB

Download
memory/1256-50-0x0000000001DE0000-0x0000000001E40000-memory.dmp

Filesize
384KB

Download
memory/2000-373-0x0000000000830000-0x0000000000897000-memory.dmp

Filesize
412KB

Download
memory/2000-366-0x0000000000400000-0x000000000062E000-memory.dmp

Filesize
2.2MB

Download
memory/2000-301-0x0000000000400000-0x000000000062E000-memory.dmp

Filesize
2.2MB

Download
memory/2000-308-0x0000000000830000-0x0000000000897000-memory.dmp

Filesize
412KB

Download
memory/2244-431-0x00000000007C0000-0x0000000000820000-memory.dmp

Filesize
384KB

Download
memory/2244-422-0x0000000140000000-0x00000001401FC000-memory.dmp

Filesize
2.0MB

Download
memory/2864-555-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/2864-419-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Filesize
384KB

Download
memory/2864-409-0x0000000140000000-0x0000000140147000-memory.dmp

Filesize
1.3MB

Download
memory/3232-392-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/3232-334-0x00000000006F0000-0x0000000000750000-memory.dmp

Filesize
384KB

Download
memory/3232-326-0x0000000140000000-0x00000001401D7000-memory.dmp

Filesize
1.8MB

Download
memory/3300-382-0x0000000140000000-0x0000000140279000-memory.dmp

Filesize
2.5MB

Download
memory/3300-448-0x0000000140000000-0x0000000140279000-memory.dmp

Filesize
2.5MB

Download
memory/3300-388-0x00000000008E0000-0x0000000000940000-memory.dmp

Filesize
384KB

Download
memory/3828-266-0x0000000000950000-0x00000000009B0000-memory.dmp

Filesize
384KB

Download
memory/3828-271-0x0000000000950000-0x00000000009B0000-memory.dmp

Filesize
384KB

Download
memory/3828-256-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/3828-270-0x0000000140000000-0x0000000140135000-memory.dmp

Filesize
1.2MB

Download
memory/3828-257-0x0000000000950000-0x00000000009B0000-memory.dmp

Filesize
384KB

Download
memory/4060-313-0x0000000140000000-0x0000000140240000-memory.dmp

Filesize
2.2MB

Download
memory/4060-245-0x00000000004C0000-0x0000000000520000-memory.dmp

Filesize
384KB

Download
memory/4060-246-0x0000000140000000-0x0000000140240000-memory.dmp

Filesize
2.2MB

Download
memory/4060-252-0x00000000004C0000-0x0000000000520000-memory.dmp

Filesize
384KB

Download
memory/4068-14-0x00000000007C0000-0x0000000000820000-memory.dmp

Filesize
384KB

Download
memory/4068-21-0x00000000007C0000-0x0000000000820000-memory.dmp

Filesize
384KB

Download
memory/4068-229-0x0000000140000000-0x0000000140241000-memory.dmp

Filesize
2.3MB

Download
memory/4068-15-0x0000000140000000-0x0000000140241000-memory.dmp

Filesize
2.3MB

Download
memory/4132-273-0x0000000140000000-0x0000000140250000-memory.dmp

Filesize
2.3MB

Download
memory/4132-282-0x0000000000C50000-0x0000000000CB0000-memory.dmp

Filesize
384KB

Download
memory/4132-340-0x0000000140000000-0x0000000140250000-memory.dmp

Filesize
2.3MB

Download
memory/4268-46-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/4268-237-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/4268-39-0x0000000140000000-0x000000014022B000-memory.dmp

Filesize
2.2MB

Download
memory/4268-38-0x00000000001A0000-0x0000000000200000-memory.dmp

Filesize
384KB

Download
memory/4336-380-0x0000000140000000-0x000000014022C000-memory.dmp

Filesize
2.2MB

Download
memory/4336-315-0x0000000140000000-0x000000014022C000-memory.dmp

Filesize
2.2MB

Download
memory/4336-322-0x0000000000580000-0x00000000005E0000-memory.dmp

Filesize
384KB

Download
memory/4616-236-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/4616-26-0x0000000000510000-0x0000000000570000-memory.dmp

Filesize
384KB

Download
memory/4616-27-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/4616-34-0x0000000000510000-0x0000000000570000-memory.dmp

Filesize
384KB

Download
memory/4712-403-0x0000000000C00000-0x0000000000C60000-memory.dmp

Filesize
384KB

Download
memory/4712-395-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/4712-406-0x0000000140000000-0x00000001401C0000-memory.dmp

Filesize
1.8MB

Download
memory/4748-435-0x0000000140000000-0x0000000140299000-memory.dmp

Filesize
2.6MB

Download
memory/4748-369-0x0000000140000000-0x0000000140299000-memory.dmp

Filesize
2.6MB

Download
memory/4748-376-0x0000000000E60000-0x0000000000EC0000-memory.dmp

Filesize
384KB

Download
memory/4856-66-0x00000000008F0000-0x0000000000950000-memory.dmp

Filesize
384KB

Download
memory/4856-69-0x0000000140000000-0x0000000140266000-memory.dmp

Filesize
2.4MB

Download
memory/4856-240-0x0000000140000000-0x0000000140266000-memory.dmp

Filesize
2.4MB

Download
memory/4856-74-0x00000000008F0000-0x0000000000950000-memory.dmp

Filesize
384KB

Download
memory/4876-0-0x0000000000400000-0x000000000064F000-memory.dmp

Filesize
2.3MB

Download
memory/4876-1-0x00000000007B0000-0x0000000000817000-memory.dmp

Filesize
412KB

Download
memory/4876-6-0x00000000007B0000-0x0000000000817000-memory.dmp

Filesize
412KB

Download
memory/4876-12-0x0000000000400000-0x000000000064F000-memory.dmp

Filesize
2.3MB

Download
memory/5040-349-0x0000000000710000-0x0000000000770000-memory.dmp

Filesize
384KB

Download
memory/5040-342-0x0000000140000000-0x000000014022D000-memory.dmp

Filesize
2.2MB

Download
memory/5040-408-0x0000000140000000-0x000000014022D000-memory.dmp

Filesize
2.2MB

Download
memory/5196-443-0x0000000000BF0000-0x0000000000C50000-memory.dmp

Filesize
384KB

Download
memory/5196-437-0x0000000140000000-0x0000000140216000-memory.dmp

Filesize
2.1MB

Download
memory/5300-457-0x0000000000540000-0x00000000005A0000-memory.dmp

Filesize
384KB

Download
memory/5300-450-0x0000000140000000-0x000000014025D000-memory.dmp

Filesize
2.4MB

Download
memory/5412-461-0x0000000140000000-0x0000000140179000-memory.dmp

Filesize
1.5MB

Download
memory/5412-470-0x0000000000600000-0x0000000000660000-memory.dmp

Filesize
384KB

Download