Overview

overview

10

Static

static

3

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Analysis

  • max time kernel
    28s
  • max time network
    303s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    01-01-2024 05:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ff3022cc92fd5e0eb46d34568825a3d914a3ce7d24cea60660cdb3247956f098.exe

  • Size

    18.8MB

  • MD5

    ed2fd5173af900c56220101ce6648515

  • SHA1

    d8783b8dc155314c5680aebddd4e36df7ddfebbf

  • SHA256

    ff3022cc92fd5e0eb46d34568825a3d914a3ce7d24cea60660cdb3247956f098

  • SHA512

    ef7bac0140e2e492a4d1751d9a6d1fe6ec94649bd6a00006f159a067b774ee8870d567e0fae2e08ebf16db3d11c2dfe2fcf5884d7d27d74fdba34781500f9806

  • SSDEEP

    393216:deNXiJAZn67vPin33BIkI5k/y0KX7rEtwbsAlx6A1wK:ExZGQIH5bVdbsU

Score
10/10
betabotgluptebasmokeloaderstealcup3backdoorbotnetdiscoverydropperevasionloaderpersistencespywarestealertrojan

Malware Config

Extracted

Family

smokeloader

Botnet

up3

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/
rc4.i32
rc4.i32

Extracted

Family

stealc

C2

http://185.172.128.79

Attributes
  • url_path

    /3886d2276f6914c4.php

rc4.plain

Signatures

  • BetaBot

    Beta Bot is a Trojan that infects computers and disables Antivirus.

    trojanbackdoorbotnetbetabot
  • Glupteba

    Glupteba is a modular loader written in Golang with various components.

    loaderdropperglupteba
  • Glupteba payload 10 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Windows security bypass 2 TTPs 7 IoCs
    evasiontrojan
  • Enumerates VirtualBox registry keys 2 TTPs 10 IoCs
    evasion
  • Downloads MZ/PE file
  • Modifies Windows Firewall 1 TTPs 1 IoCs
    evasion
  • Sets file execution options in registry 2 TTPs 2 IoCs
    persistence
  • Executes dropped EXE 14 IoCs
  • Loads dropped DLL 30 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Registers COM server for autorun 1 TTPs 11 IoCs
    persistence
  • Windows security modification 2 TTPs 7 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies boot configuration data using bcdedit 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Drops file in Program Files directory 56 IoCs
  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 22 IoCs
  • Modifies system certificate store 2 TTPs 7 IoCs
    evasionspywaretrojan
  • Runs regedit.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 24 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\ff3022cc92fd5e0eb46d34568825a3d914a3ce7d24cea60660cdb3247956f098.exe
    "C:\Users\Admin\AppData\Local\Temp\ff3022cc92fd5e0eb46d34568825a3d914a3ce7d24cea60660cdb3247956f098.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1736
    • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
      "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2832
      • C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe
        "C:\Users\Admin\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe"
        3⤵
        • Windows security bypass
        • Executes dropped EXE
        • Loads dropped DLL
        • Windows security modification
        • Adds Run key to start application
        • Checks for VirtualBox DLLs, possible anti-VM trick
        • Drops file in Windows directory
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2036
        • C:\Windows\system32\cmd.exe
          C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2600
          • C:\Windows\system32\netsh.exe
            netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
            5⤵
            • Modifies Windows Firewall
            • Modifies data under HKEY_USERS
            PID:2156
        • C:\Windows\rss\csrss.exe
          C:\Windows\rss\csrss.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies system certificate store
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3028
          • C:\Windows\system32\schtasks.exe
            schtasks /delete /tn ScheduledUpdate /f
            5⤵
              PID:1476
            • C:\Windows\system32\schtasks.exe
              schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
              5⤵
              • Creates scheduled task(s)
              PID:1928
            • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
              "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies system certificate store
              PID:2220
            • C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
              C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
              5⤵
              • Executes dropped EXE
              PID:1508
            • C:\Windows\system32\bcdedit.exe
              C:\Windows\Sysnative\bcdedit.exe /v
              5⤵
              • Modifies boot configuration data using bcdedit
              PID:1536
            • C:\Windows\system32\schtasks.exe
              schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
              5⤵
              • Creates scheduled task(s)
              PID:2808
            • C:\Windows\windefender.exe
              "C:\Windows\windefender.exe"
              5⤵
                PID:884
                • C:\Windows\SysWOW64\cmd.exe
                  cmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                  6⤵
                    PID:2240
                    • C:\Windows\SysWOW64\sc.exe
                      sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)
                      7⤵
                      • Launches sc.exe
                      PID:2700
          • C:\Users\Admin\AppData\Local\Temp\tuc4.exe
            "C:\Users\Admin\AppData\Local\Temp\tuc4.exe"
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:2692
            • C:\Users\Admin\AppData\Local\Temp\is-CU3O1.tmp\tuc4.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-CU3O1.tmp\tuc4.tmp" /SL5="$60122,7884275,54272,C:\Users\Admin\AppData\Local\Temp\tuc4.exe"
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in Program Files directory
              • Suspicious use of FindShellTrayWindow
              PID:2620
          • C:\Users\Admin\AppData\Local\Temp\etopt.exe
            "C:\Users\Admin\AppData\Local\Temp\etopt.exe"
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Registers COM server for autorun
            • Drops file in Program Files directory
            • Drops file in Windows directory
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            PID:2080
          • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
            "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
            2⤵
              PID:2716
            • C:\Users\Admin\AppData\Local\Temp\InstallSetup8.exe
              "C:\Users\Admin\AppData\Local\Temp\InstallSetup8.exe"
              2⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:2924
              • C:\Users\Admin\AppData\Local\Temp\nsy5F81.tmp.exe
                C:\Users\Admin\AppData\Local\Temp\nsy5F81.tmp.exe
                3⤵
                • Executes dropped EXE
                • Checks processor information in registry
                PID:1464
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2924 -s 928
                3⤵
                • Program crash
                PID:2320
          • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
            "C:\Users\Admin\AppData\Local\Temp\toolspub2.exe"
            1⤵
            • Executes dropped EXE
            • Checks SCSI registry key(s)
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: MapViewOfSection
            PID:2748
          • C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
            C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
            1⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:2644
          • C:\Windows\system32\makecab.exe
            "C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240101051102.log C:\Windows\Logs\CBS\CbsPersist_20240101051102.cab
            1⤵
            • Drops file in Windows directory
            PID:2084
          • C:\Windows\system32\conhost.exe
            \??\C:\Windows\system32\conhost.exe "14061145524075834431291593723-62233320117216164182136747614-1345413249-1270078564"
            1⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2716
          • C:\Users\Admin\AppData\Local\Temp\AB9B.exe
            C:\Users\Admin\AppData\Local\Temp\AB9B.exe
            1⤵
            • Enumerates VirtualBox registry keys
            • Sets file execution options in registry
            • Executes dropped EXE
            • Checks whether UAC is enabled
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Checks processor information in registry
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            PID:1236
            • C:\Windows\SysWOW64\explorer.exe
              C:\Windows\SysWOW64\explorer.exe
              2⤵
              • Suspicious use of NtSetInformationThreadHideFromDebugger
              • Suspicious use of AdjustPrivilegeToken
              PID:1740
              • C:\Users\Admin\AppData\Local\Temp\35ukikuc_1.exe
                /suac
                3⤵
                  PID:2836
                  • C:\Windows\SysWOW64\regedit.exe
                    "C:\Windows\SysWOW64\regedit.exe"
                    4⤵
                    • Runs regedit.exe
                    PID:1700
                  • C:\Windows\SysWOW64\schtasks.exe
                    "C:\Windows\System32\schtasks.exe" /CREATE /SC ONLOGON /TN "Windows Update Check - 0x1BB70478" /TR "C:\PROGRA~3\JAVAUP~1\35ukikuc.exe" /RL HIGHEST
                    4⤵
                    • Creates scheduled task(s)
                    PID:1488
            • C:\Users\Admin\AppData\Local\Temp\B720.exe
              C:\Users\Admin\AppData\Local\Temp\B720.exe
              1⤵
                PID:2700
              • C:\Windows\windefender.exe
                C:\Windows\windefender.exe
                1⤵
                  PID:988

                Network

                MITRE ATT&CK Enterprise v15

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Scheduled Task/Job

                1
                T1053

                Persistence

                Boot or Logon Autostart Execution

                3
                T1547

                Registry Run Keys / Startup Folder

                3
                T1547.001

                Create or Modify System Process

                1
                T1543

                Windows Service

                1
                T1543.003

                Scheduled Task/Job

                1
                T1053

                Privilege Escalation

                Boot or Logon Autostart Execution

                3
                T1547

                Registry Run Keys / Startup Folder

                3
                T1547.001

                Create or Modify System Process

                1
                T1543

                Windows Service

                1
                T1543.003

                Scheduled Task/Job

                1
                T1053

                Defense Evasion

                Impair Defenses

                2
                T1562

                Disable or Modify Tools

                2
                T1562.001

                Modify Registry

                5
                T1112

                Subvert Trust Controls

                1
                T1553

                Install Root Certificate

                1
                T1553.004

                Virtualization/Sandbox Evasion

                1
                T1497

                Credential Access

                Unsecured Credentials

                1
                T1552

                Credentials In Files

                1
                T1552.001

                Discovery

                Peripheral Device Discovery

                1
                T1120

                Query Registry

                5
                T1012

                System Information Discovery

                5
                T1082

                Virtualization/Sandbox Evasion

                1
                T1497

                Lateral Movement

                Collection

                Data from Local System

                1
                T1005

                Command and Control

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\InstallSetup8.exe
                  Filesize

                  382KB

                  MD5

                  7bc600636df910a18eda22e9b44bf2a0

                  SHA1

                  3b8285384c871428b704ddd68177a0dd64fedb57

                  SHA256

                  80f13e1e33103f317376cb0d6a8295ba68b2f3d801e5a79718fe9748d5cfb135

                  SHA512

                  9d5c9a5b8d7d815d01422825bd404e8c15758a871f5472032a87fa17c2a64f3ec6a62857f4191151f2df05bbcb0f6ca5625665b448f1abae83cefdbd7afa141f

                  Download Submit

                • C:\Users\Admin\AppData\Local\Temp\toolspub2.exe
                  Filesize

                  92KB

                  MD5

                  34a8ce442674425ae01d01e7f4c88bcb

                  SHA1

                  d7d30970aa75ce1271402a0adae465fe1f9995c9

                  SHA256

                  7a084687df35c670ce06698e719664a55198c43660d47fc8fb16afda7ac59062

                  SHA512

                  9ddecb5b6827a1aff9682cc442d03a9a711dadf2325a4e3044eb3e8b3b465f0bfbf61b916408da1cc84585185c2794a80d1c636a7646441ed2f104fea6386ea3

                  Download Submit

                • \Users\Admin\AppData\Local\Temp\InstallSetup8.exe
                  Filesize

                  137KB

                  MD5

                  0ef3debf14ebb863953569d7c0a0990a

                  SHA1

                  c04a0b3f2e6538e7e3fbeb19fd74db9a283ae7aa

                  SHA256

                  82714b5f85e7bd57f9f3e8289701bcd783d95dcec1f81938bc7c982e091e81e9

                  SHA512

                  642a5c6c0b11032b5d2d583b2b9d60a5251c56c367e3eb085fcfc49c2d1179ef4f31386c5407586a2abd42c9059b81b7f10e29d502c670d09513823092721e9c

                  Download Submit

                • \Users\Admin\AppData\Local\Temp\toolspub2.exe
                  Filesize

                  283KB

                  MD5

                  2d24e3baa2a16e47bee10e91381e6391

                  SHA1

                  013b59b2cd69e93694196dfb34fddc8684cfd619

                  SHA256

                  ff2e975c649d66476c48ac9fe64455eb0727fede676d000728d09d62d2dc6db4

                  SHA512

                  be515895b29390e1c9c44620f7b18c8ae57d08627b8bbf7484b551ccf079011f95baa78e71c1a2a6280b544dd06444b509b7c9ba126b525d813afd68010b03e7

                  Download Submit

                • memory/1224-255-0x0000000002260000-0x0000000002276000-memory.dmp

                  Filesize

                  88KB

                  Download

                • memory/1224-466-0x0000000077A81000-0x0000000077A82000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1236-426-0x00000000005B0000-0x00000000005BD000-memory.dmp

                  Filesize

                  52KB

                  Download

                • memory/1236-446-0x00000000002A0000-0x00000000002A6000-memory.dmp

                  Filesize

                  24KB

                  Download

                • memory/1236-425-0x00000000002A0000-0x00000000002A6000-memory.dmp

                  Filesize

                  24KB

                  Download

                • memory/1236-424-0x0000000002500000-0x000000000250C000-memory.dmp

                  Filesize

                  48KB

                  Download

                • memory/1236-427-0x0000000001D10000-0x0000000001D76000-memory.dmp

                  Filesize

                  408KB

                  Download

                • memory/1236-423-0x0000000001D80000-0x0000000001D81000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1236-420-0x0000000001D10000-0x0000000001D76000-memory.dmp

                  Filesize

                  408KB

                  Download

                • memory/1236-418-0x0000000000010000-0x000000000006D000-memory.dmp

                  Filesize

                  372KB

                  Download

                • memory/1236-422-0x0000000077C20000-0x0000000077C21000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1236-447-0x0000000001DA0000-0x0000000001DA1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1236-448-0x0000000001D10000-0x0000000001D76000-memory.dmp

                  Filesize

                  408KB

                  Download

                • memory/1464-476-0x0000000075470000-0x0000000075478000-memory.dmp

                  Filesize

                  32KB

                  Download

                • memory/1464-477-0x000000001AB70000-0x000000001AB71000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1464-374-0x0000000000400000-0x0000000000857000-memory.dmp

                  Filesize

                  4.3MB

                  Download

                • memory/1464-438-0x0000000000400000-0x0000000000857000-memory.dmp

                  Filesize

                  4.3MB

                  Download

                • memory/1464-463-0x00000000009C0000-0x0000000000AC0000-memory.dmp

                  Filesize

                  1024KB

                  Download

                • memory/1464-471-0x00000000009B0000-0x00000000009B6000-memory.dmp

                  Filesize

                  24KB

                  Download

                • memory/1464-473-0x000000001AA50000-0x000000001AB14000-memory.dmp

                  Filesize

                  784KB

                  Download

                • memory/1464-480-0x000000001AA50000-0x000000001AB14000-memory.dmp

                  Filesize

                  784KB

                  Download

                • memory/1464-479-0x000000001AB80000-0x000000001AB8C000-memory.dmp

                  Filesize

                  48KB

                  Download

                • memory/1464-372-0x00000000009C0000-0x0000000000AC0000-memory.dmp

                  Filesize

                  1024KB

                  Download

                • memory/1464-373-0x0000000000220000-0x000000000023C000-memory.dmp

                  Filesize

                  112KB

                  Download

                • memory/1464-475-0x000000001AA50000-0x000000001AB14000-memory.dmp

                  Filesize

                  784KB

                  Download

                • memory/1464-470-0x0000000077C3D000-0x0000000077C3E000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1464-377-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                  Filesize

                  972KB

                  Download

                • memory/1736-1-0x0000000000DA0000-0x000000000207E000-memory.dmp

                  Filesize

                  18.9MB

                  Download

                • memory/1736-62-0x0000000074C50000-0x000000007533E000-memory.dmp

                  Filesize

                  6.9MB

                  Download

                • memory/1736-0-0x0000000074C50000-0x000000007533E000-memory.dmp

                  Filesize

                  6.9MB

                  Download

                • memory/1740-441-0x0000000077C10000-0x0000000077D91000-memory.dmp

                  Filesize

                  1.5MB

                  Download

                • memory/1740-429-0x0000000077C10000-0x0000000077D91000-memory.dmp

                  Filesize

                  1.5MB

                  Download

                • memory/1740-488-0x00000000000D0000-0x0000000000194000-memory.dmp

                  Filesize

                  784KB

                  Download

                • memory/1740-489-0x00000000004F0000-0x00000000004F6000-memory.dmp

                  Filesize

                  24KB

                  Download

                • memory/1740-492-0x00000000000D0000-0x0000000000194000-memory.dmp

                  Filesize

                  784KB

                  Download

                • memory/1740-482-0x0000000077C10000-0x0000000077D91000-memory.dmp

                  Filesize

                  1.5MB

                  Download

                • memory/1740-430-0x0000000077C10000-0x0000000077D91000-memory.dmp

                  Filesize

                  1.5MB

                  Download

                • memory/1740-433-0x0000000077C10000-0x0000000077D91000-memory.dmp

                  Filesize

                  1.5MB

                  Download

                • memory/1740-434-0x0000000077C10000-0x0000000077D91000-memory.dmp

                  Filesize

                  1.5MB

                  Download

                • memory/1740-435-0x00000000004F0000-0x00000000004F6000-memory.dmp

                  Filesize

                  24KB

                  Download

                • memory/1740-445-0x00000000000D0000-0x0000000000194000-memory.dmp

                  Filesize

                  784KB

                  Download

                • memory/1740-442-0x0000000000630000-0x000000000063C000-memory.dmp

                  Filesize

                  48KB

                  Download

                • memory/1740-443-0x00000000000D0000-0x0000000000194000-memory.dmp

                  Filesize

                  784KB

                  Download

                • memory/1740-439-0x00000000000D0000-0x0000000000194000-memory.dmp

                  Filesize

                  784KB

                  Download

                • memory/1740-437-0x0000000077C10000-0x0000000077D91000-memory.dmp

                  Filesize

                  1.5MB

                  Download

                • memory/1740-432-0x0000000077C10000-0x0000000077D91000-memory.dmp

                  Filesize

                  1.5MB

                  Download

                • memory/2036-262-0x00000000026B0000-0x0000000002AA8000-memory.dmp

                  Filesize

                  4.0MB

                  Download

                • memory/2036-261-0x00000000026B0000-0x0000000002AA8000-memory.dmp

                  Filesize

                  4.0MB

                  Download

                • memory/2036-286-0x00000000026B0000-0x0000000002AA8000-memory.dmp

                  Filesize

                  4.0MB

                  Download

                • memory/2036-263-0x0000000002AB0000-0x000000000339B000-memory.dmp

                  Filesize

                  8.9MB

                  Download

                • memory/2036-285-0x0000000000400000-0x0000000000D1C000-memory.dmp

                  Filesize

                  9.1MB

                  Download

                • memory/2036-265-0x0000000000400000-0x0000000000D1C000-memory.dmp

                  Filesize

                  9.1MB

                  Download

                • memory/2080-490-0x0000000077C3D000-0x0000000077C3E000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/2080-112-0x0000000003C10000-0x0000000004838000-memory.dmp

                  Filesize

                  12.2MB

                  Download

                • memory/2080-96-0x0000000010000000-0x000000001001B000-memory.dmp

                  Filesize

                  108KB

                  Download

                • memory/2080-182-0x0000000002DE0000-0x0000000002E1A000-memory.dmp

                  Filesize

                  232KB

                  Download

                • memory/2080-119-0x0000000002B40000-0x0000000002B41000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/2220-301-0x0000000140000000-0x00000001405E8000-memory.dmp

                  Filesize

                  5.9MB

                  Download

                • memory/2220-478-0x0000000077A30000-0x0000000077BD9000-memory.dmp

                  Filesize

                  1.7MB

                  Download

                • memory/2220-315-0x0000000140000000-0x00000001405E8000-memory.dmp

                  Filesize

                  5.9MB

                  Download

                • memory/2380-483-0x0000000077A81000-0x0000000077A82000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/2620-293-0x0000000000400000-0x00000000004BC000-memory.dmp

                  Filesize

                  752KB

                  Download

                • memory/2620-67-0x0000000000240000-0x0000000000241000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/2620-291-0x0000000000240000-0x0000000000241000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/2644-141-0x0000000000240000-0x0000000000241000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/2644-294-0x0000000000400000-0x0000000000965000-memory.dmp

                  Filesize

                  5.4MB

                  Download

                • memory/2644-298-0x0000000000240000-0x0000000000241000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/2644-494-0x00000000043C0000-0x0000000004484000-memory.dmp

                  Filesize

                  784KB

                  Download

                • memory/2692-38-0x0000000000400000-0x0000000000414000-memory.dmp

                  Filesize

                  80KB

                  Download

                • memory/2692-264-0x0000000000400000-0x0000000000414000-memory.dmp

                  Filesize

                  80KB

                  Download

                • memory/2700-459-0x0000000000C50000-0x00000000011E6000-memory.dmp

                  Filesize

                  5.6MB

                  Download

                • memory/2716-49-0x00000000004F0000-0x00000000005F0000-memory.dmp

                  Filesize

                  1024KB

                  Download

                • memory/2716-51-0x0000000000220000-0x0000000000229000-memory.dmp

                  Filesize

                  36KB

                  Download

                • memory/2748-66-0x0000000000400000-0x0000000000409000-memory.dmp

                  Filesize

                  36KB

                  Download

                • memory/2748-52-0x0000000000400000-0x0000000000409000-memory.dmp

                  Filesize

                  36KB

                  Download

                • memory/2748-257-0x0000000000400000-0x0000000000409000-memory.dmp

                  Filesize

                  36KB

                  Download

                • memory/2748-48-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/2832-102-0x0000000002790000-0x0000000002B88000-memory.dmp

                  Filesize

                  4.0MB

                  Download

                • memory/2832-256-0x0000000002B90000-0x000000000347B000-memory.dmp

                  Filesize

                  8.9MB

                  Download

                • memory/2832-140-0x0000000002B90000-0x000000000347B000-memory.dmp

                  Filesize

                  8.9MB

                  Download

                • memory/2832-181-0x0000000000400000-0x0000000000D1C000-memory.dmp

                  Filesize

                  9.1MB

                  Download

                • memory/2832-68-0x0000000002790000-0x0000000002B88000-memory.dmp

                  Filesize

                  4.0MB

                  Download

                • memory/2832-244-0x0000000000400000-0x0000000000D1C000-memory.dmp

                  Filesize

                  9.1MB

                  Download

                • memory/3028-287-0x0000000002660000-0x0000000002A58000-memory.dmp

                  Filesize

                  4.0MB

                  Download

                • memory/3028-376-0x0000000000400000-0x0000000000D1C000-memory.dmp

                  Filesize

                  9.1MB

                  Download

                • memory/3028-431-0x0000000000400000-0x0000000000D1C000-memory.dmp

                  Filesize

                  9.1MB

                  Download

                • memory/3028-289-0x0000000002660000-0x0000000002A58000-memory.dmp

                  Filesize

                  4.0MB

                  Download

                • memory/3028-290-0x0000000000400000-0x0000000000D1C000-memory.dmp

                  Filesize

                  9.1MB

                  Download