Overview

overview

10

Static

static

3

69d761d941...3a.exe

windows7-x64

10

69d761d941...3a.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-02-2024 19:15

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    69d761d941e1a7a4721e267e91167b3a.exe

  • Size

    170KB

  • MD5

    69d761d941e1a7a4721e267e91167b3a

  • SHA1

    7e83135738bdd132a8c9da031b4794852cfc9f8b

  • SHA256

    c6d317e1eb756b3577414068ac20fc445921f4edd86bef21dbab2d89920e4649

  • SHA512

    4ccfe22c2a726f10e4956383fb12371cc07be797707ac6b5dba1a14a5b798c24503bd4f29302c525240dffd0a3f1d3775ff575a2fddb4443df974d1de5ce1295

  • SSDEEP

    3072:lLWPQWxrjDjU6G+JLfeEXcUesyx0RcAJ+qVeYg:lLWPvjU6TFhXBes/c

Score
10/10
djvumarsstealersmokeloaderzgratdefaultpub1backdoordiscoveryevasionpersistenceransomwareratspywarestealertrojan

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://trad-einmyus.com/index.php

http://tradein-myus.com/index.php

http://trade-inmyus.com/index.php
rc4.i32
rc4.i32

Extracted

Family

djvu

C2

http://habrafa.com/test1/get.php

Attributes
  • extension

    .ldhy

  • offline_id

    pIGzEr0bxHiTz7xnvNidWeqzKkxMfVdHTyCkzwt1

  • payload_url

    http://brusuax.com/dl/build2.exe

    http://habrafa.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://we.tl/t-hPAqznkJKD Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0849ASdw

rsa_pubkey.plain

Extracted

Family

marsstealer

Botnet

Default

Signatures

  • Detect ZGRat V1 20 IoCs
  • Detected Djvu ransomware 9 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu
  • Mars Stealer

    An infostealer written in C++ based on other infostealers.

    stealermarsstealer
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 2 IoCs
    evasiontrojan
  • ZGRat

    ZGRat is remote access trojan written in C#.

    ratzgrat
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs
    evasion
  • Downloads MZ/PE file
  • Looks for VMWare Tools registry key 2 TTPs 2 IoCs
    evasion
  • .NET Reactor proctector 10 IoCs

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself 1 IoCs
  • Drops startup file 1 IoCs
  • Executes dropped EXE 11 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 3 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Maps connected drives based on registry 3 TTPs 4 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 4 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 33 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\69d761d941e1a7a4721e267e91167b3a.exe
    "C:\Users\Admin\AppData\Local\Temp\69d761d941e1a7a4721e267e91167b3a.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:1060
  • C:\Users\Admin\AppData\Local\Temp\D467.exe
    C:\Users\Admin\AppData\Local\Temp\D467.exe
    1⤵
    • Executes dropped EXE
    • Checks SCSI registry key(s)
    • Suspicious behavior: MapViewOfSection
    PID:1396
  • C:\Users\Admin\AppData\Local\Temp\EC45.exe
    C:\Users\Admin\AppData\Local\Temp\EC45.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2976
    • C:\Users\Admin\AppData\Local\Temp\EC45.exe
      C:\Users\Admin\AppData\Local\Temp\EC45.exe
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:2032
      • C:\Windows\SysWOW64\icacls.exe
        icacls "C:\Users\Admin\AppData\Local\bf2aaab3-2e6d-4bc3-9823-f2394dc451fe" /deny *S-1-1-0:(OI)(CI)(DE,DC)
        3⤵
        • Modifies file permissions
        PID:2264
      • C:\Users\Admin\AppData\Local\Temp\EC45.exe
        "C:\Users\Admin\AppData\Local\Temp\EC45.exe" --Admin IsNotAutoStart IsNotTask
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4288
        • C:\Users\Admin\AppData\Local\Temp\EC45.exe
          "C:\Users\Admin\AppData\Local\Temp\EC45.exe" --Admin IsNotAutoStart IsNotTask
          4⤵
          • Executes dropped EXE
          PID:3540
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3540 -s 568
            5⤵
            • Program crash
            PID:1052
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3540 -ip 3540
    1⤵
      PID:4612
    • C:\Users\Admin\AppData\Local\Temp\7184.exe
      C:\Users\Admin\AppData\Local\Temp\7184.exe
      1⤵
      • Executes dropped EXE
      PID:808
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 808 -s 1144
        2⤵
        • Program crash
        PID:3496
    • C:\Users\Admin\AppData\Local\Temp\8422.exe
      C:\Users\Admin\AppData\Local\Temp\8422.exe
      1⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:4964
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe"
        2⤵
        • Executes dropped EXE
        PID:2176
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4964 -s 1224
        2⤵
        • Program crash
        PID:804
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 808 -ip 808
      1⤵
        PID:872
      • C:\Users\Admin\AppData\Local\Temp\8A8C.exe
        C:\Users\Admin\AppData\Local\Temp\8A8C.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2504
      • C:\Users\Admin\AppData\Local\Temp\8FEC.exe
        C:\Users\Admin\AppData\Local\Temp\8FEC.exe
        1⤵
        • Looks for VirtualBox Guest Additions in registry
        • Looks for VMWare Tools registry key
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Adds Run key to start application
        • Maps connected drives based on registry
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4684
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4648
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'
            3⤵
            • Creates scheduled task(s)
            PID:4828
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpA582.tmp.bat""
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:384
          • C:\Windows\SysWOW64\timeout.exe
            timeout 3
            3⤵
            • Delays execution with timeout.exe
            PID:3172
          • C:\Users\Admin\AppData\Roaming\svchost.exe
            "C:\Users\Admin\AppData\Roaming\svchost.exe"
            3⤵
            • UAC bypass
            • Windows security bypass
            • Looks for VirtualBox Guest Additions in registry
            • Looks for VMWare Tools registry key
            • Checks BIOS information in registry
            • Checks computer location settings
            • Executes dropped EXE
            • Windows security modification
            • Checks whether UAC is enabled
            • Maps connected drives based on registry
            • Suspicious use of SetThreadContext
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:744
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\svchost.exe" -Force
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2616
            • C:\Windows\SysWOW64\calc.exe
              "C:\Windows\SYSWOW64\calc.exe"
              4⤵
              • Loads dropped DLL
              PID:2684
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 1344
                5⤵
                • Program crash
                PID:1084
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2684 -ip 2684
        1⤵
          PID:804
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4964 -ip 4964
          1⤵
            PID:2216

          Network

          MITRE ATT&CK Enterprise v15

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Scheduled Task/Job

          1
          T1053

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Scheduled Task/Job

          1
          T1053

          Privilege Escalation

          Abuse Elevation Control Mechanism

          1
          T1548

          Bypass User Account Control

          1
          T1548.002

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Scheduled Task/Job

          1
          T1053

          Defense Evasion

          Abuse Elevation Control Mechanism

          1
          T1548

          Bypass User Account Control

          1
          T1548.002

          File and Directory Permissions Modification

          1
          T1222

          Impair Defenses

          3
          T1562

          Disable or Modify Tools

          3
          T1562.001

          Modify Registry

          5
          T1112

          Virtualization/Sandbox Evasion

          2
          T1497

          Credential Access

          Unsecured Credentials

          2
          T1552

          Credentials In Files

          2
          T1552.001

          Discovery

          Peripheral Device Discovery

          2
          T1120

          Query Registry

          8
          T1012

          System Information Discovery

          6
          T1082

          Virtualization/Sandbox Evasion

          2
          T1497

          Lateral Movement

          Collection

          Data from Local System

          2
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\ProgramData\mozglue.dll
            Filesize

            133KB

            MD5

            8f73c08a9660691143661bf7332c3c27

            SHA1

            37fa65dd737c50fda710fdbde89e51374d0c204a

            SHA256

            3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

            SHA512

            0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

            Download Submit

          • C:\ProgramData\nss3.dll
            Filesize

            1.2MB

            MD5

            bfac4e3c5908856ba17d41edcd455a51

            SHA1

            8eec7e888767aa9e4cca8ff246eb2aacb9170428

            SHA256

            e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

            SHA512

            2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\7184.exe
            Filesize

            6.0MB

            MD5

            95e59305ad61119cf15ee95562bd05ba

            SHA1

            0f0059cda9609c46105cf022f609c407f3718e04

            SHA256

            dd87f94c961b9612bbd65761bee6ed15318d63652f262e2c425bd177a2341a19

            SHA512

            5fbcfe79162460080e0c3944df747835f0b8f2cdb35b038eb69eadf2eb85a209f7d5432a328d0f0eeafba036012f48793e3c08d94531b98a12a498bcf3b00ad2

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\8422.exe
            Filesize

            649KB

            MD5

            35ffefa212414c2538df410e5ad3afa7

            SHA1

            e7721fbb85e400c74c7f4de95f1c27b6318caabd

            SHA256

            9217999518147c602f16ed7d80c9b95dec621f442192ce49192736a27e73847f

            SHA512

            7bf9ffe99588a1e6e01a6c84fee7bd998b337653c908e33d3c10f1aa9abc7af925ca9d86a884099824133947614aa070181c973b220163dd99dde87765152a25

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\8A8C.exe
            Filesize

            952KB

            MD5

            422a9c5cfa6370c93a4bd5db29c3d196

            SHA1

            caaf89e601fde4bc9dbe3c0edda8e7efa5062e17

            SHA256

            82311d6280999d5c9d368377e30b8f55abe2a3d7d98f8c074f6e40c5be7cd965

            SHA512

            2caf014595f65caa26bd7c8396f981ee452ef01fdf35dde3e9e2e950855f564e97026f71c52b9a49526f9bca68d4f5c6d4bc9ba51d4b8330e38e4b4b84214e96

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\8FEC.exe
            Filesize

            68KB

            MD5

            cd2b5a09efdac0ffbd76111f44733138

            SHA1

            6db6bc9dba96632213d1077155725f388237e268

            SHA256

            1c6b4fadf6a74e1dfacd17468bdb0743ec21a1bdf3fcd4c3f58bf727efb1c74c

            SHA512

            16fa87494baa4d65bd170d346efe082b998689d0c3488cec764170f5c0e63a7a4ad2fc51f18aa710aa8bca1ed84af99965baae692a81cead192cfa63aa37c714

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\D467.exe
            Filesize

            170KB

            MD5

            69d761d941e1a7a4721e267e91167b3a

            SHA1

            7e83135738bdd132a8c9da031b4794852cfc9f8b

            SHA256

            c6d317e1eb756b3577414068ac20fc445921f4edd86bef21dbab2d89920e4649

            SHA512

            4ccfe22c2a726f10e4956383fb12371cc07be797707ac6b5dba1a14a5b798c24503bd4f29302c525240dffd0a3f1d3775ff575a2fddb4443df974d1de5ce1295

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\EC45.exe
            Filesize

            699KB

            MD5

            a2b38ede1742205c46b74ce044287fb9

            SHA1

            8415a9ab51551583f3ace6916816c4474a2ffb9b

            SHA256

            324a8068a203d94f77eb773e1491ca27fd52b5a2b5b220f50d3a9b86f9d69965

            SHA512

            9fb2d5c030bedcb71132db3c019fdf7131826e48cb4c64d779bd2e853ab110d8fd384e3ed07946ee8bd055c880e17510488b6edc68421a99a76bfd57872694d4

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ht1h5akx.k30.ps1
            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\tmpA582.tmp.bat
            Filesize

            151B

            MD5

            898507f383a392151f14d3f7d21126c9

            SHA1

            c32b9790caad6030a7179e17896a8a7c12d07069

            SHA256

            d26785055a0bca20e5e2a6592269b452659872489d1d13f317f1de60765902e9

            SHA512

            bf1f64640704b216953b40f6007025411da33d58c934d92cac3c497c0d52718da967196ae66a48d15c22dda822a8a1b2810b0ba10213955ddb69cecaf810306d

            Download Submit

          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe
            Filesize

            4KB

            MD5

            a5ce3aba68bdb438e98b1d0c70a3d95c

            SHA1

            013f5aa9057bf0b3c0c24824de9d075434501354

            SHA256

            9b860be98a046ea97a7f67b006e0b1bc9ab7731dd2a0f3a9fd3d710f6c43278a

            SHA512

            7446f1256873b51a59b9d2d3498cef5a41dbce55864c2a5fb8cb7d25f7d6e6d8ea249d551a45b75d99b1ad0d6fb4b5e4544e5ca77bcd627717d6598b5f566a79

            Download Submit

          • memory/744-624-0x0000000073990000-0x0000000074140000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/744-816-0x0000000073990000-0x0000000074140000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/808-67-0x0000000002D70000-0x0000000002D71000-memory.dmp

            Filesize

            4KB

            Download

          • memory/808-73-0x0000000000090000-0x0000000000BEB000-memory.dmp

            Filesize

            11.4MB

            Download

          • memory/808-75-0x0000000002D80000-0x0000000002DB2000-memory.dmp

            Filesize

            200KB

            Download

          • memory/808-77-0x0000000002D80000-0x0000000002DB2000-memory.dmp

            Filesize

            200KB

            Download

          • memory/808-76-0x0000000002D80000-0x0000000002DB2000-memory.dmp

            Filesize

            200KB

            Download

          • memory/808-74-0x0000000000090000-0x0000000000BEB000-memory.dmp

            Filesize

            11.4MB

            Download

          • memory/808-69-0x0000000000090000-0x0000000000BEB000-memory.dmp

            Filesize

            11.4MB

            Download

          • memory/808-66-0x0000000002D60000-0x0000000002D61000-memory.dmp

            Filesize

            4KB

            Download

          • memory/808-63-0x0000000002D30000-0x0000000002D31000-memory.dmp

            Filesize

            4KB

            Download

          • memory/808-199-0x0000000000090000-0x0000000000BEB000-memory.dmp

            Filesize

            11.4MB

            Download

          • memory/808-65-0x0000000002D40000-0x0000000002D41000-memory.dmp

            Filesize

            4KB

            Download

          • memory/808-61-0x0000000001250000-0x0000000001251000-memory.dmp

            Filesize

            4KB

            Download

          • memory/808-62-0x0000000001260000-0x0000000001261000-memory.dmp

            Filesize

            4KB

            Download

          • memory/808-64-0x0000000000090000-0x0000000000BEB000-memory.dmp

            Filesize

            11.4MB

            Download

          • memory/1060-3-0x0000000000400000-0x0000000002BD7000-memory.dmp

            Filesize

            39.8MB

            Download

          • memory/1060-5-0x0000000000400000-0x0000000002BD7000-memory.dmp

            Filesize

            39.8MB

            Download

          • memory/1060-1-0x0000000002EE0000-0x0000000002FE0000-memory.dmp

            Filesize

            1024KB

            Download

          • memory/1060-8-0x0000000002E80000-0x0000000002E8B000-memory.dmp

            Filesize

            44KB

            Download

          • memory/1060-2-0x0000000002E80000-0x0000000002E8B000-memory.dmp

            Filesize

            44KB

            Download

          • memory/1396-17-0x0000000002DA0000-0x0000000002EA0000-memory.dmp

            Filesize

            1024KB

            Download

          • memory/1396-18-0x0000000000400000-0x0000000002BD7000-memory.dmp

            Filesize

            39.8MB

            Download

          • memory/1396-20-0x0000000000400000-0x0000000002BD7000-memory.dmp

            Filesize

            39.8MB

            Download

          • memory/2032-30-0x0000000000400000-0x0000000000537000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/2032-44-0x0000000000400000-0x0000000000537000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/2032-33-0x0000000000400000-0x0000000000537000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/2032-32-0x0000000000400000-0x0000000000537000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/2032-34-0x0000000000400000-0x0000000000537000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/2504-104-0x0000000005A00000-0x0000000005B0A000-memory.dmp

            Filesize

            1.0MB

            Download

          • memory/2504-103-0x0000000073990000-0x0000000074140000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/2504-134-0x0000000005770000-0x000000000585B000-memory.dmp

            Filesize

            940KB

            Download

          • memory/2504-127-0x0000000005770000-0x000000000585B000-memory.dmp

            Filesize

            940KB

            Download

          • memory/2504-122-0x0000000005770000-0x000000000585B000-memory.dmp

            Filesize

            940KB

            Download

          • memory/2504-118-0x0000000005770000-0x000000000585B000-memory.dmp

            Filesize

            940KB

            Download

          • memory/2504-116-0x0000000005770000-0x000000000585B000-memory.dmp

            Filesize

            940KB

            Download

          • memory/2504-114-0x0000000005770000-0x000000000585B000-memory.dmp

            Filesize

            940KB

            Download

          • memory/2504-112-0x0000000005770000-0x000000000585B000-memory.dmp

            Filesize

            940KB

            Download

          • memory/2504-97-0x0000000000E00000-0x0000000000EF2000-memory.dmp

            Filesize

            968KB

            Download

          • memory/2504-98-0x0000000005770000-0x0000000005860000-memory.dmp

            Filesize

            960KB

            Download

          • memory/2504-110-0x0000000005770000-0x000000000585B000-memory.dmp

            Filesize

            940KB

            Download

          • memory/2504-108-0x0000000005770000-0x000000000585B000-memory.dmp

            Filesize

            940KB

            Download

          • memory/2504-101-0x0000000005F10000-0x0000000006528000-memory.dmp

            Filesize

            6.1MB

            Download

          • memory/2616-842-0x0000000002420000-0x0000000002430000-memory.dmp

            Filesize

            64KB

            Download

          • memory/2616-891-0x0000000005820000-0x0000000005B74000-memory.dmp

            Filesize

            3.3MB

            Download

          • memory/2616-823-0x0000000002430000-0x0000000002466000-memory.dmp

            Filesize

            216KB

            Download

          • memory/2616-829-0x0000000073990000-0x0000000074140000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/2616-832-0x0000000002420000-0x0000000002430000-memory.dmp

            Filesize

            64KB

            Download

          • memory/2616-1067-0x00000000062E0000-0x00000000062FE000-memory.dmp

            Filesize

            120KB

            Download

          • memory/2616-1054-0x0000000074A50000-0x0000000074A9C000-memory.dmp

            Filesize

            304KB

            Download

          • memory/2616-1051-0x0000000006300000-0x0000000006332000-memory.dmp

            Filesize

            200KB

            Download

          • memory/2616-1021-0x0000000002420000-0x0000000002430000-memory.dmp

            Filesize

            64KB

            Download

          • memory/2616-960-0x0000000005D70000-0x0000000005DBC000-memory.dmp

            Filesize

            304KB

            Download

          • memory/2616-956-0x0000000004A50000-0x0000000004A6E000-memory.dmp

            Filesize

            120KB

            Download

          • memory/2616-835-0x0000000004F30000-0x0000000005558000-memory.dmp

            Filesize

            6.2MB

            Download

          • memory/2616-866-0x0000000005590000-0x00000000055B2000-memory.dmp

            Filesize

            136KB

            Download

          • memory/2616-878-0x0000000005640000-0x00000000056A6000-memory.dmp

            Filesize

            408KB

            Download

          • memory/2684-814-0x0000000000400000-0x000000000043D000-memory.dmp

            Filesize

            244KB

            Download

          • memory/2976-29-0x0000000004940000-0x0000000004A5B000-memory.dmp

            Filesize

            1.1MB

            Download

          • memory/2976-28-0x0000000004890000-0x0000000004931000-memory.dmp

            Filesize

            644KB

            Download

          • memory/3436-19-0x0000000003230000-0x0000000003246000-memory.dmp

            Filesize

            88KB

            Download

          • memory/3436-4-0x0000000002BB0000-0x0000000002BC6000-memory.dmp

            Filesize

            88KB

            Download

          • memory/3540-53-0x0000000000400000-0x0000000000537000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/3540-50-0x0000000000400000-0x0000000000537000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/3540-51-0x0000000000400000-0x0000000000537000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/4288-47-0x0000000004880000-0x0000000004916000-memory.dmp

            Filesize

            600KB

            Download

          • memory/4684-216-0x00000000058F0000-0x0000000005956000-memory.dmp

            Filesize

            408KB

            Download

          • memory/4684-142-0x0000000004C30000-0x0000000004C4A000-memory.dmp

            Filesize

            104KB

            Download

          • memory/4684-206-0x0000000007660000-0x00000000076FC000-memory.dmp

            Filesize

            624KB

            Download

          • memory/4684-212-0x0000000007700000-0x000000000778E000-memory.dmp

            Filesize

            568KB

            Download

          • memory/4684-154-0x0000000004EF0000-0x0000000004F00000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4684-302-0x0000000073990000-0x0000000074140000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/4684-157-0x0000000004F00000-0x0000000004F0A000-memory.dmp

            Filesize

            40KB

            Download

          • memory/4684-148-0x0000000004D40000-0x0000000004DD2000-memory.dmp

            Filesize

            584KB

            Download

          • memory/4684-138-0x0000000000450000-0x0000000000466000-memory.dmp

            Filesize

            88KB

            Download

          • memory/4684-140-0x0000000073990000-0x0000000074140000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/4964-135-0x0000000005460000-0x0000000005509000-memory.dmp

            Filesize

            676KB

            Download

          • memory/4964-119-0x0000000005460000-0x0000000005509000-memory.dmp

            Filesize

            676KB

            Download

          • memory/4964-83-0x0000000000680000-0x0000000000780000-memory.dmp

            Filesize

            1024KB

            Download

          • memory/4964-87-0x0000000073990000-0x0000000074140000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/4964-123-0x0000000005460000-0x0000000005509000-memory.dmp

            Filesize

            676KB

            Download

          • memory/4964-840-0x0000000073990000-0x0000000074140000-memory.dmp

            Filesize

            7.7MB

            Download

          • memory/4964-86-0x0000000004DC0000-0x0000000004E70000-memory.dmp

            Filesize

            704KB

            Download

          • memory/4964-105-0x0000000005460000-0x0000000005509000-memory.dmp

            Filesize

            676KB

            Download

          • memory/4964-89-0x0000000002860000-0x0000000002870000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4964-126-0x0000000005460000-0x0000000005509000-memory.dmp

            Filesize

            676KB

            Download

          • memory/4964-90-0x0000000002860000-0x0000000002870000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4964-824-0x0000000000680000-0x0000000000780000-memory.dmp

            Filesize

            1024KB

            Download

          • memory/4964-91-0x0000000005460000-0x000000000550E000-memory.dmp

            Filesize

            696KB

            Download

          • memory/4964-1012-0x0000000002860000-0x0000000002870000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4964-1015-0x0000000002860000-0x0000000002870000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4964-1018-0x0000000002860000-0x0000000002870000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4964-85-0x0000000000400000-0x00000000004C8000-memory.dmp

            Filesize

            800KB

            Download

          • memory/4964-96-0x0000000002860000-0x0000000002870000-memory.dmp

            Filesize

            64KB

            Download

          • memory/4964-88-0x0000000004EB0000-0x0000000005454000-memory.dmp

            Filesize

            5.6MB

            Download

          • memory/4964-99-0x0000000005460000-0x0000000005509000-memory.dmp

            Filesize

            676KB

            Download

          • memory/4964-100-0x0000000005460000-0x0000000005509000-memory.dmp

            Filesize

            676KB

            Download

          • memory/4964-107-0x0000000005460000-0x0000000005509000-memory.dmp

            Filesize

            676KB

            Download

          • memory/4964-84-0x0000000002120000-0x00000000021E5000-memory.dmp

            Filesize

            788KB

            Download